Text

Application to Modify the Technical Specifications for Browns Ferry (TS-512), Sequoyah (TS-17-03), and Watts Bar (TS-17-20) to Resolve the Open Phase Issue Identified in NRC Bulletin 2012-01, Design Vulnerability in Electrical Power System
	ML17324A349
Person / Time
Site:
Issue date:	11/17/2017
From:	James Shea; Tennessee Valley Authority
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	BL-12-001, CNL-17-034, TS-17-03, TS-17-20, TS-512
	Download: ML17324A349 (169)
	v • d • e

Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-17-034 November 17, 2017 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Units 1, 2, and 3 Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 NRC Docket Nos. 50-259, 50-260, and 50-296 Sequoyah Nuclear Plant, Units 1 and 2 Renewed Facility Operating License Nos. DPR-77 and DPR-79 NRC Docket Nos. 50-327 and 50-328 Watts Bar Nuclear Plant, Units 1 and 2 Facility Operating License Nos. NPF-90 and NPF-96 NRC Docket Nos. 50-390 and 50-391

Subject:

Application to Modify the Technical Specifications for the Browns Ferry Nuclear Plant (TS-512), Sequoyah Nuclear Plant (TS-17-03) and Watts Bar Nuclear Plant (TS-17-20) to Resolve the Open Phase Issue Identified in NRC Bulletin 2012-01, Design Vulnerability in Electrical Power System

References:

1. NRC Bulletin 2012-01, Design Vulnerability in Electric Power System, dated July 27, 2012 (ML12074A115)

2. Nuclear Energy Institute (NEI) letter to NRC, Industry Initiative on Open Phase Condition, dated October 9, 2013 (ML13333A147)

3. NEI letter to NRC, Industry Initiative on Open Phase Condition, Revision 1, dated March 16, 2015 (ML15075A455)

4. NRC BTP 8-9, Open Phase Conditions in Electric Power System, Revision 0, July 2015 (ML15057A085)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, "Application for amendment of license, construction permit, or early site permit,"

Tennessee Valley Authority (TVA) is submitting a request for an amendment to Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, Renewed Facility Operating License Nos. DPR-77 and DPR-79 for the Sequoyah Nuclear Plant (SQN), Units 1 and 2, and Facility Operating License Nos.

NPF-90 and NPF-96 for the Watts Bar Nuclear Plant (WBN), Units 1 and 2. This license amendment request (LAR) proposes adding a new level of protection, Unbalanced Voltage to the Technical Specifications (TS) for the loss of power (LOP) instrumentation.

U.S. Nuclear Regulatory Commission CNL-17-034 Page 2 November 17, 2017 In Reference 1, the Nuclear Regulatory Commission (NRC) issued Bulletin 2012-01, "Design Vulnerability in Electric Power System," which requested addressees to submit specific information regarding plant design and operating configurations relative to the regulatory requirements of General Design Criterion (GDC) 17, Electric Power Systems. In Reference 2, the Nuclear Energy Institute (NEI) notified the NRC that the nuclear industrys chief nuclear officers had approved a formal initiative (voluntary industry initiative (VII)) to address the open phase condition (OPC). Reference 2 further stated that the VII represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors. Reference 2 provided a due date of December 31, 2017, to complete actions to resolve the OPC design vulnerability for this initiative. Subsequently, in Reference 3, this completion date was revised to December 31, 2018.

Industry operating experience indicates that the potential concern with OPCs on offsite power sources is the resultant unbalanced voltage that they can cause. Consequently, the proposed TS changes support the installation of Class 1E Unbalanced Voltage Relays (UVRs) on the medium voltage shutdown buses at BFN, SQN, and WBN to address potential concerns with OPCs. References 1 and 2 include descriptions of industry operating events in which a single electrical conductor on overhead three phase power circuits associated with nuclear power plant offsite power supplies failed open without being detected by existing protective relaying.

These equipment failures caused voltage unbalances in the downstream power system. In the case of the January 2012 event at Byron Unit 2, the voltage unbalance had an adverse effect on operating plant equipment. TVAs proposed change not only provides protection from postulated open phase events, it provides protection against potentially adverse voltage unbalanced conditions in general, regardless of their origin.

TVAs approach installs Class 1E unbalanced voltage relays (UVRs) on the medium voltage shutdown buses, which provide Class 1E equipment protection. The calculations supporting the addition of these new relays and associated settings utilized a bottom up analysis of the Class 1E system. That is, based on the setpoints, the protection scheme provides equipment protection from the effects of an unbalanced voltage in a similar fashion to the existing degraded and loss of voltage protection schemes. These new relays ensure Class 1E loads would not be damaged by appropriately allowing the existing logic to isolate the Class 1E system from the offsite power source during a sustained unbalanced voltage (degraded voltage) event. The safety-related loads would then be powered by the emergency diesel generators, and would continue to perform their design basis functions.

While TVAs unbalanced voltage protection scheme does provide protection from open phase events, it is not limited to only that specific initiating event. The addition of this new Class 1E unbalanced voltage protection scheme provides a means to detect and automatically respond to not only the open circuit condition or high impedance ground fault condition, but other events that could cause an unbalanced voltage and potentially prevent the connected safety equipment from operating.

to this letter provides a description of the proposed changes, technical evaluation of the proposed changes, regulatory evaluation, and a discussion of environmental considerations. During the August 1, 2017, pre-submittal meeting, NRC requested additional

U.S. Nuclear Regulatory Commission CNL-17-034 Page 3 November 17, 2017 information to be provided as part of the LAR to facilitate understanding of the planned modifications especially with respect to open phase. Attachments 1.1 through 1.4 to provide background information, a comparison of the unbalanced voltage methodology with degraded voltage, and a comparison of the TVA solution to the VII (References 2 and 3) and the NRC Branch Technical Position (BTP) 8-9, Open Phase Conditions in Electrical Power System (Reference 4).

Also included in Enclosure 1 are site-specific documents, site electrical distribution system, existing TS pages marked up to show the proposed changes, existing TS Bases pages marked up to show the proposed changes for information only, revised (clean) TS pages, and UFSAR excerpts, which are provided in Attachments 2.1 through 2.5 for BFN, Attachments 3.1 through 3.5 for SQN, and Attachments 4.1 through 4.5 for WBN, respectively.

The BFN, SQN, and WBN Plant Operations Review Committees and the TVA Nuclear Safety Review Board have reviewed this proposed change and determined that operation of each nuclear unit in accordance with the proposed change will not endanger the health and safety of the public.

TVA has determined that there are no significant hazards considerations associated with the proposed change and that the license change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(9). Additionally, in accordance with 10 CFR 50.91(b)(1), TVA is sending a copy of this letter and the enclosures to the Alabama State Department of Public Health and the Tennessee State Department of Environment and Conservation.

For ease of review and as requested by NRC during the pre-submittal meeting, additional information has been provided in this license amendment that goes beyond what TVA is seeking approval for. TVA is specifically requesting approval of the UVR setpoints and setpoint methodology contained in this proposed license amendment by September 30, 2018.

Following NRC approval, implementation of the Class 1E unbalanced voltage protection scheme would be accomplished by December 31, 2018. Note that the automatic main control room (MCR) alarm of abnormal unbalanced voltage levels that do not affect the function of connected equipment is not a requirement of the VII. However, this automatic MCR alarm feature is included in the fleet design and will be available after final implementation is complete. For BFN, the addition of the MCR unbalanced voltage alarm relay annunciation may require a unit refuel outage for activation. Consequently, activation of the automatic MCR annunciation feature may extend past December 31, 2018, however identification of relay operation would be managed with compensatory measures (e.g., operator rounds) for identification within the TS Limiting Condition for Operation (LCO) completion time requirements. SQN and WBN have no similar unit outage requirement for activation of the MCR alarm. Therefore, full implementation of the Class 1E unbalanced voltage protection scheme at SQN and WBN will occur by December 31, 2018.

U.S. Nuclear Regulatory Commission CNL-17-034 Page 4 November 17, 2017 There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Edward Schrull at (423) 751 -3850.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 17th day of November 2017.

. Shea President, Nuclear Regulatory Affairs and Support Services

Enclosure:

1.

Evaluation of Proposed Change cc (Enclosure):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant NRC Senior Resident Inspector - Sequoyah Nuclear Plant NRC Senior Resident Inspector - Watts Bar Nuclear Plant NRC Project Manager - Browns Ferry Nuclear Plant NRC Project Manager - Sequoyah Nuclear Plant NRC Project Manager - Watts Bar Nuclear Plant State Health Officer, Alabama Department of Public Health Director, Division of Radiological Health - Tennessee State Department of Environment and Conservation

ENCLOSURE 1 Tennessee Valley Authority BROWNS FERRY NUCLEAR PLANT UNITS 1, 2, AND 3 SEQUOYAH NUCLEAR PLANT UNITS 1 AND 2 WATTS BAR NUCLEAR PLANT UNITS 1 AND 2 EVALUATION OF PROPOSED CHANGE

Subject:

Application to Modify the Technical Specifications for the Browns Ferry Nuclear Plant (TS-512), Sequoyah Nuclear Plant (TS-17-03) and Watts Bar Nuclear Plant (TS-17-20) to Resolve the Open Phase Issue Identified in NRC Bulletin 2012-01, Design Vulnerability in Electrical Power System CNL-17-034 E1-1 CONTENTS 1.0 Summary Description........................................................................................ 3 2.0 Detailed Description.......................................................................................... 3 2.1 Reason for the Proposed Change.................................................................... 3 2.2 Description for BFN........................................................................................... 4 2.2.1 BFN System Design and Operation.................................................................. 4 2.2.2 BFN Current Technical Specifications............................................................... 5 2.2.3 BFN Description of the Proposed Change........................................................ 5 2.2.4 BFN UVR Surveillance Requirements............................................................... 6 2.3 Description for the Sequoyah Nuclear Plant-.................................................... 6 2.3.1 SQN System Design and Operation.................................................................. 6 2.3.2 SQN Current Technical Specifications.............................................................. 6 2.3.3 SQN Description of the Proposed Change........................................................ 7 2.3.4 SQN UVR Surveillance Requirements.............................................................. 7 2.4 Description for the Watts Bar Nuclear Plant..................................................... 7 2.4.1 WBN System Design and Operation................................................................. 7 2.4.2 WBN Current Technical Specifications............................................................. 8 2.4.3 WBN Description of the Proposed Change....................................................... 8 2.4.4 WBN UVR Surveillance Requirements............................................................. 9 3.0 Technical Evaluation......................................................................................... 9 3.1 Vulnerability Studies Summary....................................................................... 11 3.2 Design Solution Description............................................................................ 12 3.3 Justification for Unbalanced Voltage Setpoint Methodology........................... 15 3.4 Analytical Limits and UVR Nominal Setpoints................................................ 16 3.5 Failure Modes and Effects Considerations..................................................... 18 3.6 Hardware Installation...................................................................................... 19 4.0 Regulatory Evaluation..................................................................................... 19 4.1 Applicable Regulatory Requirements/Criteria................................................. 19 4.2 Precedent........................................................................................................ 20 4.3 No Significant Hazards Consideration............................................................ 21

ENCLOSURE 1 CNL-17-034 E1 - 2 4.4 Conclusions.................................................................................................... 23 5.0 Environmental Consideration.......................................................................... 23 6.0 References...................................................................................................... 24

- Fleet Information 1.1 Class 1E UVR Comparison to VII and BTP 8-9 1.2 History and Background of the Open Phase Condition 1.3 NRC Bulletin 2012-01 Summary Report Excerpts 1.4 Technical Concepts documented in NRC/Industry documents

- BFN-Specific Information 2.1 BFN Electrical Distribution System Diagram 2.2 Proposed TS Changes (Mark-Ups) for BFN, Units 1, 2, and 3 2.3 Proposed TS Bases Changes (Mark-Ups) for BFN, Units 1, 2, and 3 (Information Only) 2.4 Proposed TS Changes (Clean) for BFN, Units 1, 2, and 3 2.5 Excerpts from BFN UFSAR

- SQN-Specific Information 3.1 SQN Electrical Distribution System Diagram 3.2 Proposed TS Changes (Mark-Ups) for SQN, Units 1 and 2 3.3 Proposed TS Bases Changes (Mark-Ups) for SQN, Units 1 and 2 (Information Only) 3.4 Proposed TS Changes (Clean) for SQN, Units 1 and 2 3.5 Excerpts from SQN UFSAR

- WBN-Specific Information 4.1 WBN Electrical Distribution System Diagram 4.2 Proposed TS Changes (Mark-Ups) for WBN, Units 1 and 2 4.3 Proposed TS Bases Changes (Mark-Ups) for WBN, Units 1 and 2 (Information Only) 4.4 Proposed TS Changes (Clean) for WBN, Units 1 and 2 4.5 Excerpts from WBN UFSAR

ENCLOSURE 1 CNL-17-034 E1 - 3 1.0

SUMMARY

DESCRIPTION In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, "Application for amendment of license, construction permit, or early site permit," the Tennessee Valley Authority (TVA) is submitting a request for an amendment to Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, Renewed Facility Operating License Nos. DPR-77 and DPR 79 for the Sequoyah Nuclear Plant (SQN),

Units 1 and 2, and Facility Operating License Nos. NPF-90 and NPF-96 for the Watts Bar Nuclear Plant (WBN), Units 1 and 2. This license amendment request (LAR) proposes adding a new level of protection, Unbalanced Voltage, to the Technical Specifications (TS) for the loss of power (LOP) instrumentation.

In Reference 1, the Nuclear Regulatory Commission (NRC) issued Bulletin 2012-01, "Design Vulnerability in Electric Power System," which requested addressees to submit specific information regarding plant design and operating configurations relative to the regulatory requirements of General Design Criterion (GDC) 17, Electric Power Systems. In Reference 2, the Nuclear Energy Institute (NEI) notified the NRC that the nuclear industrys chief nuclear officers approved a formal initiative to address the open phase condition (OPC). Reference 2 further stated that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors. Reference 2 provided a due date of December 31, 2017, to complete actions to resolve the OPC design vulnerability for this initiative. Subsequently, in Reference 3 this completion date was revised to December 31, 2018.

TVAs approach installs Class 1E unbalanced voltage relays (UVRs) on the medium voltage shutdown boards (SDBDs) (4.16 kilovolt (kV) at BFN and 6.9 kV at SQN and WBN), which provide Class 1E equipment protection. Appropriate instrument settings and actions are added to the BFN, SQN, and WBN Technical Specifications (TS) to address Unbalanced Voltage.

2.0 DETAILED DESCRIPTION The reason for the proposed change is provided in Section 2.1, which is consistent for all three TVA sites. BFN-specific information is included in Section 2.2, SQN-specific information is included in Section 2.3, and WBN-specific information is included in Section 2.4.

2.1 Reason for the Proposed Change For this fleet submittal, the primary reason for the proposed change is to provide equipment protection from the effects of an unbalanced voltage in a similar fashion to the existing degraded and loss of voltage protection schemes. The identification of the vulnerability was based on industry operating experience and subsequent commitment to meet the voluntary Nuclear Strategic Issues Advisory Committee (NSIAC) Open Phase Industry Initiative, also known as the Voluntary Industry Initiative (VII)

(References 2 and 3) for GDC 17 Compliance.

ENCLOSURE 1 CNL-17-034 E1 - 4 The following summarizes the manner in which the Class 1E UVR protection scheme complies with the criteria contained in both the VII and NRC Branch Technical Position (BTP) 8-9, Open Phase Conditions in Electrical Power System (Reference 4):

The Class 1E UVR protection scheme considers location and condition definitions (i.e., grounding) of an open phase for both the VII and BTP 8-9.

The Class 1E UVR protection scheme satisfies the automatic detection criteria of the VII and functional intent of BTP 8-9 (i.e., all OPCs that can affect the function of the Class 1E equipment function are detected).

The Class 1E UVR protection scheme satisfies automatic protection of Class 1E equipment requirements for both the VII and BTP 8-9.

Note that TVA has not committed and is not now committing to compliance with BTP 8-9.

.1 provides a comparison of the VII (References 2 and 3) and BTP 8-9 (Reference 4) criteria including a summary of the delta between these two documents and how the UVR complies with the criteria. The Class 1E UVR protection scheme exceeds the requirements of both the VII and BTP 8-9 by including all events in any location outside the Class 1E boundary that can negatively affect voltage balance to Class 1E equipment.

Non-automatic methods of detection are not included in this LAR. The operators determination of offsite power source operability would satisfy the required non-automatic detection criteria for an open phase on a standby source within a reasonable time as stated in the VII. Offsite power source operability criteria and reasonable assurance of the capacity and capability of the offsite power source are existing requirements for all three stations operation. Automatic detection is neither a requirement for determination of capacity and capability, nor is it required in the VII or GDC 17. Additional discussion concerning the differences between operability and protection are included in Section 3.

In order to fully understand the complete reasoning behind this proposed change, a discussion of the history of the open phase condition and the nuclear industrys response to its discovery as an initiating event is necessary. See Attachment 1.2 for further details of this history and background for the open phase condition.

2.2 Description for BFN 2.2.1 BFN System Design and Operation The BFN electrical power distribution system is shown in Attachment 2.1. BFN is connected to the TVA system network by seven 500-kV lines. Normal station power is from the unit station service transformers (USSTs) connected between the generator breaker and main transformer of each unit. Startup power is from the TVA 500-kV system network through the 500 to 22-kV main and 20.7 to 4.16-kV USSTs. Auxiliary power is available through the two common station service transformers (CSSTs),

which are fed from two 161-kV lines supplying the 161-kV switchyard. The standby source of auxiliary power is from eight diesel generators (DGs). These DGs start automatically on receipt of an accident signal, loss of voltage, or degraded voltage on the associated shutdown board.

ENCLOSURE 1 CNL-17-034 E1 - 5 Excerpts from BFNs existing UFSAR sections pertinent to the system design and operation are provided in Attachment 2.5 for ease of understanding. These excerpts include information about degraded voltage protection that is referenced as part of the unbalanced voltage protection scheme.

2.2.2 BFN Current Technical Specifications The BFN Units 1, 2, and 3 TS 3.3.8.1 Loss of Power (LOP) Instrumentation currently contains operability requirements, required actions, and Surveillance Requirements (SRs) for loss of voltage and degraded voltage conditions. TS Table 3.3.8.1-1, Loss of Power Instrumentation identifies the functions, required channels per board, applicable SRs, and allowable values.

This LAR adds the unbalanced voltage function to BFN TS 3.3.8.1 and TS Table 3.3.8.1-1 as described in Section 2.2.3.

2.2.3 BFN Description of the Proposed Change The proposed changes add the unbalanced voltage function to BFN TS 3.3.8.1 as follows:

A new Condition E and its required actions are added to TS 3.3.8.1 that applies when one or more UVRs are inoperable on one shutdown board.

A new Function 3 is added to Table 3.3.8.1-1 to include unbalanced voltage.

Existing Condition E and its associated Required Action E.1 are renamed as Condition F and Required Action F.1.

As shown in Attachment 2.2, the proposed new Condition E has a five-day completion time that is consistent with the existing completion time and basis for a functionally identical loss in Condition D (i.e., loss of function of the degraded voltage protection scheme). As noted in the Bases for TS 3.3.8.1 (Attachment 2.3), Condition D and the new Condition E, the five-day completion time is justified based on the remaining redundancy of the 4.16 kV shutdown boards. In the event that a shutdown board is inoperable, the remaining shutdown boards are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition. The overall reliability is reduced, however, because another single failure in the remaining three 4.16 kV shutdown boards could result in the minimum required ESF functions not being supported. Therefore, the 4.16 kV shutdown board must be restored to operable status within five days. The five-day time limit before requiring a unit shutdown in this condition is acceptable because the remaining 4.16 kV shutdown boards have AC power available, and the probability of an event of a postulated design basis accident in conjunction with a single failure of a redundant component in the 4.16 kV shutdown board with alternating current (AC) power is low.

The existing SRs 3.3.8.1.2 and 3.3.8.1.3 apply to the unbalanced voltage function.

The marked-up TS pages showing the proposed changes for BFN Units 1, 2, and 3 are provided in Attachment 2.2. The associated TS Bases proposed changes for BFN Units 1, 2, and 3 are provided in Attachment 2.3 for information only. The clean typed TS pages are provided in Attachment 2.4.

ENCLOSURE 1 CNL-17-034 E1 - 6 2.2.4 BFN UVR Surveillance Requirements Surveillance of the UVRs is required as defined in 10 CFR 50.36(c)(3) to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

The surveillance requirements for the unbalanced voltage function are the same as the existing surveillance requirements for the degraded voltage function. Therefore, the existing surveillance requirements and frequencies for the degraded voltage function are utilized for the unbalanced voltage function. The justifications provided in the current UFSAR as well as in Section 2 of this enclosure provide the basis and justification. Existing SRs 3.3.8.1.2 and 3.3.8.1.3 apply to the new UVRs and are included in the proposed changes to TS Table 3.3.8.1-1.

2.3 Description for the Sequoyah Nuclear Plant 2.3.1 SQN System Design and Operation The SQN station electrical power distribution system is shown in Attachment 3.1. For SQN Units 1 and 2, the plant electric power system consists of the main generator, the generator circuit breaker (GCB), the USSTs, the CSSTs, the main bank transformers, the DGs, the batteries, and the electric distribution system. The main generator supplies electrical power through isolated phase buses to the main bank transformers and the USSTs. During normal operations, the auxiliary power is typically supplied by unit power through the USSTs. During startup and shutdown, the auxiliary power is typically supplied by the 500-kV system through the main bank and USSTs for Unit 1 and the 161-kV system through the main bank and USSTs for Unit 2. During startup, shutdown, and normal operations, auxiliary power may be supplied by the 161-kV system through the CSSTs. The standby onsite power is supplied by four DGs. The power to the 6.9-kV common boards is supplied by the 161-kV system through the CSSTs.

Excerpts from SQNs existing UFSAR sections pertinent to the system design and operation are provided in Attachment 3.5 for ease of understanding.

2.3.2 SQN Current Technical Specifications The SQN Units 1 and 2 TS 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation currently contains operability requirements, required actions, and SRs for loss of voltage and degraded voltage conditions. TS Table 3.3.5-1, Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation identifies the functions, applicable modes, required channels, applicable SRs, allowable values, and nominal trip setpoints.

This LAR adds the unbalanced voltage function to SQN TS 3.3.5 and TS Table 3.3.5-1 as described in Section 2.3.3.

ENCLOSURE 1 CNL-17-034 E1 - 7 2.3.3 SQN Description of the Proposed Change The proposed changes add the unbalanced voltage function to SQN TS 3.3.5 as follows:

A new Condition C and its required actions are added to TS 3.3.5 that applies when one or more UVRs are inoperable.

A new Function 3 is added to Table 3.3.5-1 to include "unbalanced voltage."

Existing Condition C and its associated Required Action C.1 are renamed as Condition D and Required Action D.1 The one-hour completion time for the proposed new Required Action C.1 is consistent with the completion time for Required Actions B.1.1 and B.1.2 (i.e., loss of function of the degraded voltage protection scheme) and is based on the low probability of an event requiring an LOP start occurring during this interval.

The existing SRs 3.3.5.1 and 3.3.5.2 apply to the unbalanced voltage function.

The marked-up TS pages showing the proposed changes for SQN Units 1 and 2 are provided in Attachment 3.2. The associated TS Bases proposed changes for SQN Units 1 and 2 are provided in Attachment 3.3 for information only. The clean typed TS pages are provided in Attachment 3.4.

2.3.4 SQN UVR Surveillance Requirements Surveillance of the UVRs is required as defined in 10 CFR 50.36(c)(3) to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

The surveillance requirements for the unbalanced voltage function are the same as the existing surveillance requirements for the degraded voltage function. Therefore, the existing surveillance requirements and frequencies for the degraded voltage function are utilized for the unbalanced voltage function. The justifications provided in the current UFSAR as well as in Section 2 of this enclosure provide the basis and justification. Existing SRs 3.3.5.1 and 3.3.5.2 apply to the new UVR relays and are included in the proposed changes to TS Table 3.3.5-1.

2.4 Description for the Watts Bar Nuclear Plant 2.4.1 WBN System Design and Operation The WBN station electric power system consists of the main generators, the USSTs, the CSSTs, the diesel generators (EDGs), the batteries, and the electric distribution system as shown in Attachment 4.1. Under normal operating conditions, the main generators supply electrical power through isolated-phase buses to the main step-up transformers and through the USSTs to the non-safety auxiliary power system. Offsite electrical power normally supplies Class 1E circuits through the 161-kV system via CSSTs C and D. Alternatively, offsite power to the Class 1E system can also be supplied through CSSTs A or B, but not both simultaneously, if the normal CSST is unavailable. The primaries of the USSTs are connected to the isolated-phase bus at a point between the generator terminals and the low-voltage connection of the main transformers. During normal operation, station auxiliary power is taken from the main

ENCLOSURE 1 CNL-17-034 E1 - 8 generator through the USSTs and from the 161-kV system through the CSSTs. During startup and shutdown, all auxiliary power is supplied from the 161-kV system through CSSTs A, B, C and D. The standby (onsite) power is supplied by four DGs. Capability is also provided to supply the Class 1E circuits through the 161-kV system via CSST A or B in the event CSST D or C, respectively, is unavailable.

Excerpts from WBNs existing UFSAR sections pertinent to the system design and operation are provided in Attachment 4.5 for ease of understanding.

2.4.2 WBN Current Technical Specifications The WBN Units 1 and 2 TS 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation currently contains operability requirements, required actions, and Surveillance Requirements (SRs) for loss of voltage, degraded voltage, DG start, and load shed conditions. TS Table 3.3.5-1, Loss of Power (LOP) Diesel Generator (DG)

Start Instrumentation identifies the functions, required channels, applicable SRs, trip setpoints, and allowable values.

This LAR adds the unbalanced voltage function to WBN TS 3.3.5 and TS Table 3.3.5-1 as described in Section 2.4.3.

2.4.3 WBN Description of the Proposed Change The proposed changes add the unbalanced voltage function to TS 3.3.5 as follows:

A new Condition C and its required actions are added to TS 3.3.5 that applies when one or more functions with one channel per bus are inoperable. A new Note is added to Condition C stating that Condition C is only applicable to Function 5.

A new Note is added to both Condition A and Condition B stating that those conditions are not applicable to the new Function 5.

A new Function 5 is added to Table 3.3.5-1 to include "unbalanced voltage."

Existing Condition C and its associated Required Action C.1 are renamed as Condition D and Required Action D.1.

The one-hour completion time for the new Required Action C.1 is consistent with the completion time for Required Action B.1 (i.e., loss of function of the degraded voltage protection scheme) and is based on the low probability of an event requiring an LOP start occurring during this interval.

The existing SRs 3.3.5.1, 3.3.5.2, and 3.3.5.3 apply to the unbalanced voltage function.

The marked-up TS pages showing the proposed changes for WBN Units 1 and 2 are provided in Attachment 4.2. The associated TS Bases proposed changes for WBN Units 1 and 2 are provided in Attachment 4.3 for information only. The clean typed TS pages are provided in Attachment 4.4.

ENCLOSURE 1 CNL-17-034 E1 - 9 2.4.4 WBN UVR Surveillance Requirements Surveillance of the UVRs is required as defined in 10 CFR 50.36(c)(3) to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met.

The surveillance requirements for the unbalanced voltage function are the same as the existing surveillance requirements for the degraded voltage function. Therefore, the existing surveillance requirements and frequencies for the degraded voltage function are utilized for the unbalanced voltage function. The justifications provided in the current UFSAR as well as in Section 2 of this enclosure provide the basis and justification. Existing SRs 3.3.5.1, 3.3.5.2,and 3.3.5.3 apply to the new UVRs and are included in the proposed changes to TS Table 3.3.5-1.

3.0 TECHNICAL EVALUATION

The discussion in Section 3 of this Enclosure applies to all TVA sites.

As detailed in NRC Bulletin 2012-01, during the Byron Nuclear Power Station (BNPS) event, both the offsite and onsite electric systems were unable to perform their intended safety functions due to the unbalanced voltage caused by the open phase event. As a consequence, manual actions were necessary to restore Engineered Safety Feature (ESF) functions. Attachment 1.3 contains excerpts of the recommendations that NRC stated in their summary report of industry responses to NRC Bulletin 2012-01 (Reference 1).

While TVAs unbalanced voltage protection scheme does provide protection from open phase events, it is not limited to only that specific initiating event. The addition of this new Class 1E unbalanced voltage protection scheme provides a means to detect and automatically respond to not only the open circuit condition or high impedance ground fault condition, but other events which could cause an unbalanced voltage and potentially prevent the connected safety equipment from performing its intended safety function. The intent of this installation is to provide a Class 1E protection scheme consistent with BFN, SQN, and WBNs current licensing basis and GDC 17 requirements. The existing protective circuitry is sufficiently sensitive to detect design basis conditions such as a loss of voltage condition or a sustained balanced degraded voltage condition and would separate the Class 1E buses from a connected balanced failed source. The new circuitry is sufficiently sensitive to detect the new design basis condition, unbalanced voltage, and would separate the Class 1E buses from a connected unbalanced failed source.

TVA evaluated a number of non-safety and safety related options to resolve the identified open phase concern. As stated in Attachment 1.2, initial studies evaluated one and/or two open phases on the high side transformer connection and determined station vulnerability. During performance of these studies, TVA discovered that open phase events could cause adverse unbalanced voltages at the Class 1E system that were not always identified by existing transformer or Class 1E protection. It is essential to note that not all open phase events are adverse or cause adverse effects. The situation where no adverse effect occurs has been documented both in the TVA vulnerability studies as well as demonstrated in a full scale open phase test at the Bellefonte Nuclear Plant with NRC personnel in attendance.

ENCLOSURE 1 CNL-17-034 E1 - 10 To address the identified design vulnerability where adverse effects occur, design changes were developed to implement a new protection scheme to protect Class 1E equipment safety function. To fully understand TVAs technical solution, the technical concepts already issued in NRC and industry documents are presented. See.4 for excerpts from issued documents that detail these technical concepts.

Technical Concept 1: Open phase is an event that may cause voltage unbalance.

Technical Concept 2: The design vulnerability identified by the Byron event is the loss of safety function due to unbalanced voltages caused by the open phase event (not the open phase event itself).

The identified design vulnerability by industry and NRC is the loss of safety function due to an open phase event. To resolve this issue, TVA is adding new Class 1E UVRs to automatically transfer the medium voltage shutdown board equipment to the DGs in the event the Class 1E bus unbalanced voltage levels were to affect the functioning of the connected Class 1E equipment. This option was selected to address not just the open phase issue that occurred at BNPS, but a broader set of events that could cause unbalanced voltages, thereby fully closing the identified design vulnerability. The Class 1E unbalanced voltage protective function is designed to protect the functionality of the Class 1E equipment from unbalanced voltage, including in the presence of an open phase of consequence. The existing loss of voltage and degraded voltage relay schemes remain in place with no changes to their setpoints or time delays.

It is important to note that there is no design vulnerability associated with just the detection of an open phase event. However, NRC published documents that recommend automatic detection of all open phase events regardless of their effect on safety equipment (e.g., Reference 4). While this requirement has been included in NRC documents, there is no documented technical justification listed or regulatory precedent determined for this type of requirement. Automatic detection of any event that has no immediate consequence is not a safety requirement, and therefore not a requirement of a protective function. This type of detection is only an indication of potential degradation to offsite power operability (i.e., capacity and capability to perform its safety function) and detection requirements have already been established as part of the offsite power operability requirements. Offsite power operability is determined by several factors including but not limited to: breaker alignment, communication from transmission system operator, voltage indications in the nuclear power station, voltage correcting device availability/operation, and transformer cooling fans operational.

These indications allow an operator to make a determination of offsite power operability. Many of these items are not automatically alarmed in the main control room (MCR); however operators maintain reasonable assurance that the offsite power source remains operable. Note that offsite power operability is directly related to future capacity and capability during a future postulated design basis accident; operability is determined in a number of ways because future values cannot be measured. Any additional actions to provide reasonable assurance of offsite power capacity and capability (i.e., operability due to an open phase) will be consistent with existing practices of providing reasonable assurance of offsite power capacity and capability (i.e., operability due to degraded voltage) and are not part of this LAR.

ENCLOSURE 1 CNL-17-034 E1 - 11 In support of the planned design changes, TVA developed analyses to (1) determine if the vulnerability from an open phase event exists and (2) determine the analytical limits and related setpoints to ensure Class 1E equipment protection. These items are further discussed in Sections 3.1 and 3.2.

3.1 Vulnerability Studies Summary The purpose of the vulnerability studies was to determine the effects of open-phase faults (OPF) on the Class 1E power system and structures, systems, and components (SSCs). For any cases where the OPF could not be detected with existing protection systems, it was identified as a potential vulnerability. An overview of the analytical method for and the results of the vulnerability studies follow.

INPO Event Reports IER L2-12-14, IER L3-13-13, and NRC Bulletin 2012-01 describe a nuclear safety concern involving an open-phase fault occurring on the offsite power supply of a nuclear plant. In response to this industry-wide concern, the Nuclear Energy Institute (NEI) formed a focus group of recognized technical experts to study the issue and identify an appropriate response from nuclear licensees. Through the efforts of this focus group, it became apparent that this was a previously unanalyzed failure mode for nuclear station offsite power and that there was no standard method for analyzing the effects of such faults. Power system analysis experts from multiple companies determined that the various types of open-phase faults that must be analyzed (e.g., true open-circuit, open-circuit with ground, open-circuit with high impedance to ground) would involve complex analysis, modeling techniques, and equipment data beyond the typical for a nuclear station. There was no standard software for performing such an analysis, so various software tools were used (sometimes in unintended ways) in an attempt to obtain meaningful results. Because ETAP software was already in use by most of the nuclear industry, the ETAP Nuclear Utility Users Group (NUUG) worked with the software developer (ETAP) to enhance ETAPs ability to accurately study the effects of open-phase faults using conventional modeling techniques (unbalanced load flow) and using equipment data that should be readily available. As a result, ETAP 12 was designed to provide the nuclear industry with a qualified software package to simulate the effects of open-phase faults using the Unbalanced Load Flow module (ULF).

The vulnerability studies used similar analytical methods/techniques to determine the effects of open-phase faults as those used in the ETAP NUUG OPFA Task Force. The overall method is a steady-state load flow technique. While this cannot determine the dynamic response of the power system to an OPF, it does provide steady-state voltages and currents throughout the system (phase and sequence quantities). These results are indicative of the systems response to the OPF with all loads remaining in their initial state (i.e. running or starting). These results can then be compared to a given criteria for either detectability (can the fault be detected with protective devices) or acceptability (is the fault acceptable for continued safe operation).

Because it would take an almost unlimited number of simulations to produce accurate results for every eventuality (e.g., various transformer loading, temperature variations, impedance tolerances, grid voltage variation, grid voltage balance) this study uses bounding techniques to account for the competing conservatisms

ENCLOSURE 1 CNL-17-034 E1 - 12 needed to address these variations and tolerances. In addition, margins are applied to the results when determining the ability of protective devices to detect the OPF.

The existing models of record were used to run the analysis and the existing calculations of record were used to determine the applicable operating scenarios and alignments. The results of the unbalanced load flow were compared to the existing plant protective device schemes/settings in order to determine if the open phase fault could be adequately detected. The vulnerability study did not determine the acceptability of the effects of the open phase event and unbalanced voltages, rather it only determined the ability of existing protective devices to detect the open phase event.

The vulnerability studies identified vulnerabilities for detecting certain open phase events. The need for further calculations to determine connected Class 1E equipment response was required.

Once a vulnerability was established, examining all possible open phase configurations and open phase locations, which would have included an unlimited number of possible simulations to determine the detectability of each of the eventualities, was not needed.

Note that due to all the different configurations, transformer loading, connected equipment, grid values, and open phase faults locations, the ability to calculate all eventualities is not achievable without developing bounding scenarios. The reason analyses of all the different open phase events and bounding scenarios were not required is because the analytical limits calculations would ultimately determine the acceptable limit of unbalanced voltage levels to maintain protection of the equipment.

The setpoints provide protection for any and all eventualities that could cause unbalanced voltages to exceed the setpoints. For TVA, the calculation of effect of any eventuality is no longer required because the setpoints determine acceptability (i.e., any eventuality contemplated above that does not trigger the setpoint is acceptable).

3.2 TVA Design Description The main issue with an open phase event degrading an offsite power circuit is that loss of a phase can cause a voltage unbalance in the connected distribution system. This unbalance causes additional heating in the connected loads due to the negative sequence phase currents. At lower-level voltage unbalances, a resulting elevated temperature can cause a reduction in service life (leading to premature failure). If the voltage unbalance is high enough, the resulting current unbalance can cause protective devices (overcurrent relays, circuit breakers, thermal overload relays) to trip prematurely, leading to an unanalyzed loss of safety loads. For a double open phase fault (two phases open-circuit), the connected loads lose rotational torque which causes them to quickly transition to locked-rotor current conditions and ultimately trip their protective devices, also leading to an unanalyzed loss of safety loads.

As stated above, voltage unbalance can cause motor overheating damage due to negative sequence current. Per National Electrical Manufactures Association (NEMA)

MG-1 (Reference 5), Motors and Generators, motors can withstand 1% voltage unbalance and should not be operated above 5% voltage unbalance. The inverse-time relationship between voltage unbalance and motor thermal damage can be seen in Figure 2 (Figure 18 of Reference 6). As shown in Figure 2, as the percent voltage unbalance increases, the time before motor thermal damage is reduced.

ENCLOSURE 1 CNL-17-034 E1 - 13 Figure 2 - Voltage Unbalance vs. Motor Thermal Damage An open phase event in a three phase power system (single or double), causes a negative sequence over-voltage condition in the individual phase voltages. Therefore, the unbalanced voltage protection scheme contains phase unbalance relays (also known as a negative sequence overvoltage relays) that essentially compare the voltages in all three phases and determines the amount of negative sequence voltage to determine if the voltage has become unbalanced. Negative sequence overvoltage relays were chosen to monitor the amount of negative sequence voltage at the SDBD (bus) level, which correlates to the amount of voltage unbalance in the Class 1E distribution system. The relays include a built-in, adjustable time delay intended to allow the relay to ride through anticipated system disturbances and for those disturbances to be cleared by other protective devices (e.g., a ground fault causes voltage unbalance, but would typically be cleared by ground fault protection). Should a voltage unbalance occur with a negative sequence component larger than the setpoint value, a time delay would be initiated. If the negative sequence component exists longer than the time delay, a trip signal (contact closure) would be generated.

The UVR design provides protection against loss of safety function due to unbalanced voltages at the Class 1E level, which includes protection from upstream open phase events, primary and secondary transformer open phase events, and all other eventualities that can cause an unacceptable unbalanced voltage level. The new protection scheme utilizes existing undervoltage protection circuits by connecting to existing sensing circuits (bus potential transformers (PTs)) and utilizing existing logic circuits to trip offsite power. Based on experience with similar relays, TVA utilized the ABB Type 60Q phase unbalance relay (negative sequence overvoltage) because these relays were already qualified for Class 1E use and were similar to existing degraded voltage relays (DVRs). Refer to Figure 3 for a generalized connection diagram.

ENCLOSURE 1 CNL-17-034 E1 - 14 Figure 3 - Connection Diagram Utilizing a bottom-up setpoint methodology, alarm, low trip, and high trip setpoints were determined. The alarm setpoint protects against long term motor degradation or loss of life and is based on ANSI allowable values. The associated time delay allows for clearing anticipated ground faults. The low trip setpoint protects against loss of safety function on offsite power (i.e., ensures everything works) by ensuring no motors trip on current for running or starting and no motors fail to start including during LOCA sequencing. The associated time delay is based on the safety analysis limit for the DG start time. The high trip setpoint protects the ability to survive the unbalance and transfer required safety loads to the DGs by ensuring no motors trip on current for running or starting. The associated time delay is based on survival time at 100%

voltage unbalance. Setpoint determination is independent of grid operation, transformer configuration, generation conditions, loading conditions, or anything outside the Class 1E boundary. The setpoints are determined to ensure Class 1E equipment will operate within their capability limits, irrespective of upstream conditions and connections. Calculation methodology is further discussed in Section 3.4.

The logic scheme is set up in a permissive 1-out-of-2 logic to ensure reliability and security. For the logic scheme, the alarm relay is used to supervise either the low trip or high trip relays to initiate the existing logic to transfer from the degraded offsite power source to the DGs prior to individual safety related motors tripping. This provides both redundancy as well as reliability (prevent nuisance tripping). For a given unbalanced voltage, if the alarm relay and either the low trip relay or high trip relay times out, the resulting trip signal is sent to the existing logic that trips the incoming offsite power circuit breakers on the medium voltage SDBD. This disconnects the onsite Class 1E distribution system from the voltage unbalance. Existing under-voltage protective relays would then transfer the affected Class 1E board to the onsite power supply (DG),

in the same manner as a loss-of-offsite power.

The Class 1E protection continuously measures viability of the connected offsite power source with respect to voltage balance allowing the safety system to remain on an adequate preferred offsite power source until it is determined to be degraded and provide automatic transfer to the onsite power source as described in GDC 17.

ENCLOSURE 1 CNL-17-034 E1 - 15 In summary, the unbalanced voltage protective relay scheme monitors the Class 1E bus voltage on the medium voltage safety bus via the Class 1E bus PTs measuring the three phase voltage, to verify the bus voltage is balanced enough for the running and starting of Class 1E motors to operate. Upon responding to an unbalanced voltage condition, the protective relay scheme would actuate after a time delay to pick-up the auxiliary relay, which would disconnect the preferred power supply. The unbalanced voltage protection scheme is commensurate with the degraded voltage sensing system design discussed in Reference 7.

3.3 Justification for Unbalanced Voltage Setpoint Methodology This section summarizes the setpoint methodology utilized for the UVR. This methodology is based on the DVR methodology that was accepted by the NRC during WBN Unit 2 licensing (Reference 15, Section 8.3).

DVR setpoint determination was questioned as part of the WBN Unit 2 licensing process. These same types of questions have been asked to the industry by the NRC since the NRC required licensees to install DVRs as a result of the Millstone Event that is described in Reference 8. This topic was determined to be an industry wide concern and the Nuclear Energy Institute (NEI) formed a Degraded Voltage Task Force to provide an acceptable technical resolution to the concerns identified by both the NRC and the Industry. NEI 15-01 An Analytical Approach for Establishing Degraded Voltage Relay (DVR) Settings (Reference 9) represents the WBN degraded voltage setpoint analytical methodology for industry use because it represents an NRC-acceptable methodology.

Because both protection schemes protect functionality of Class 1E equipment from degraded voltage (i.e., DVR protects from balanced degradation of voltage and UVR protects from unbalanced degradation of voltage), the same analytical techniques and methodologies were used. Furthermore, by utilizing the same analytical approach, which has already been established to be in accordance with NRC regulatory guidance (as discussed in Reference 14), the UVR setpoint methodology and techniques can also be considered to be in accordance with NRC regulatory guidance documents.

Both protection schemes (DVR and UVR) provide equivalent protection from a voltage degradation that can cause the loss of safety function, the same methodology for analysis can be utilized for setpoint determination (i.e., voltage and time delay). Like the DVR scheme, the UVR scheme is not intended to ensure operability of the offsite power supply, but rather to ensure that the safety-related loads have adequate voltage to perform their intended safety function when connected to offsite power.

The UVR scheme does not require the complete set of NEI 15-01 analyses that were performed for the DVR for the following reasons:

1. Voltage balance is not a significantly self-correcting event by lessening the current draw associated with starting motors like degraded voltage is.

Therefore, there is no need to confirm reset, ensuring the scheme does not inadvertently trip under anticipated transient events.

2. Transmission unbalanced voltage levels are typically present and levels are typically regulated by NERC, not nuclear interface requirements.

ENCLOSURE 1 CNL-17-034 E1 - 16

3. There are no separate time delays associated with accident or non-accident conditions. That is, time delays are considered for the most bounding condition whether an accident or non-accident and therefore by definition, protect for both conditions.

The bottom up type analysis was previously described in NEI 15-01 as an analysis where the minimum operating voltage for the required loads is a pass/fail criterion, which is consistent with the methodology of IEEE Standard 741-1997, Annex A.

As with the degraded voltage methodology/techniques, the use of a steady-state analysis where upstream system voltages can be accounted for by simply connecting a fixed voltage source to the monitored bus is utilized for unbalanced voltage. The fixed unbalanced voltage source is set with as high as possible unbalanced voltage while still keeping the operating voltage of all required Class 1E loads within their design requirements. This technique establishes the analytical limit for the unbalanced voltage setting. By utilizing this method, the crediting of any voltage balancing equipment outside the Class 1E system is precluded. Once the analytical limit is established for running motors, the adequacy of this analytical limit is confirmed for motor starting of connected Class 1E motors.

Finally, analyses confirm the time delays, with and without an accident signal, which would ensure all Class 1E loads required for postulated design basis accidents auto-transfer to the onsite power supply if the UVR-monitored bus experiences unbalanced voltage conditions that affect the function of the connected equipment.

This protective device analysis essentially shows the coordination between the UVR time delay and any protective devices that are capable of preventing transfer to the onsite supply (e.g., overcurrent devices that could trip and require a manual reset). It is important to note that motor stalling is acceptable so long as the individual equipment protective device does not actuate and render the motor unavailable upon transfer.

This is consistent with the analytical methodology of the analysis which confirms the Loss of Voltage Relay setpoint preventing motor stalling for longer non-accident degraded voltage time delays.

3.4 Analytical Limits and UVR Nominal Setpoints In order to determine the analytical limits for the unbalanced voltage relays, a supporting analysis is done in the same bottom-up manner based on load requirements, and independent of characteristics of the incoming power source. The underlying bases behind these allowable limits for voltage unbalance and associated time delays are: (1) accepted industry standards (e.g., References 5 and 12), (2) design requirements of the connected Class 1E loads, and (3) the analysis time allowed for connection to the onsite power supply.

Setpoint computations with assumptions, explanation of use of industry standards, and conclusions are provided in each stations analytical limits calculations. These calculations establish the applicable analytical limits and boundaries. Those limits were then used to establish the setpoints, accounting for all associated errors and tolerances.

ENCLOSURE 1 CNL-17-034 E1 - 17 The following provides a methodology summary for each of the relay setpoints:

Alarm Relay Setpoint The Alarm Relay must alert the control room operators of an abnormal voltage unbalance and thereby protects against unacceptable loss of life or long-term motor degradation for the connected Class 1E loads.

The lower operating limit for the setting is greater than the acceptable normal range for voltage unbalance from industry standards.

The upper analytical limit of the setting prevents an unacceptable reduction of service life from the additional heating caused by a voltage unbalance. This result can be accomplished by ensuring the additional heating does not outpace that accounted for in traditional overload protection settings. To avoid nuisance alarms, the relay nominal setting should be as close as possible to this upper limit, accounting for associated errors and tolerances.

The lower operating limit of the time delay is set to avoid nuisance alarms in the main control room during anticipated electrical distribution system faults, but greater than the clearing time of switchyard ground fault protection devices.

The upper operating limit of the time delay is less than the transformer tap changer setpoints.

Low Trip Relay Setpoint The Low Trip Relay protects against loss of safety function for the connected Class 1E loads during a voltage unbalance. The analytical limit protects the point where the required safety loads perform their safety function during a voltage unbalance, operational occurrences, and design basis events.

The lower operating limit of the setting is greater than the Alarm Relay setting.

The upper analytical limit of the setting is less than the recommended maximum limit of voltage unbalance for motors to tolerate from industry standards. To avoid nuisance tripping (unnecessary loss of offsite power), the relay nominal setting should be as close as possible to this upper limit, accounting for associated errors and tolerances.

The lower operating limit of the time delay is greater than the Alarm Relay time delay setting.

The upper analytical limit of the time delay is less than the safety analysis time allowed for the emergency diesel generators to come up to rated speed and voltage and be ready to accept load. This value should be equivalent to the upper analytical limit of the degraded voltage relay time delay.

ENCLOSURE 1 CNL-17-034 E1 - 18 High Trip Relay Setpoint The High Trip Relay protects against loss of safety function for the connected Class 1E loads during a voltage unbalance. This relay provides a faster tripping time for high-level unbalances, where catastrophic load failure may occur within a few seconds.

The lower operating limit of the setting is greater than the Alarm Relay setting.

The upper analytical limit of the setting is less than the smaller of:

o The maximum relay setting (relay should be capable of at least 25% voltage unbalance), or o The maximum limit of voltage unbalance to prevent motor stalling, based on industry standards o To avoid nuisance tripping (unnecessary loss of offsite power), the relay nominal setting should be as close as possible to this upper limit, accounting for associated errors and tolerances.

The lower operating limit of the time delay is greater than the Alarm Relay time delay setting.

The upper analytical limit of the time delay is less than the minimum design time allowed for motor starting, adjusting for additional current created by unbalanced voltages, and less than the tripping time of overcurrent protective devices during unbalance voltage conditions.

3.5 Failure Modes and Effects Considerations The purpose of the Failure Modes and Effects Analysis (FMEA) is to identify potential Unbalanced Voltage Protection function failure modes and evaluate their impact on the design to preclude subsequent operational concerns. A summary of the FMEA performed for the UVR scheme is provided below:

If one of the UVRs fails to operate, the existing undervoltage protection schemes would still be available and unaffected to provide existing level of protection for the Class 1E equipment.

If one of the UVRs were to spuriously actuate, the remaining relays on the bus would not actuate and the permissive 1-out-of-2 logic would not be satisfied.

If one of the UVRs fails to operate during an unbalanced voltage condition, the existing undervoltage protection schemes would still be available and unaffected to provide their existing level of protection for the Class 1E equipment. In this case, as with all the possible failure modes, there are redundant safety trains, that is, the opposite safety train would still be available to provide safe shutdown capability.

If one of the Class 1E PTs fail, all levels of undervoltage protection would be actuated and begin timing. Due to the longer time delay of the UVR with respect to the Loss of Voltage (LOV) protection scheme, the LOV scheme would actuate the transfer due to the substantially low voltage measurements.

Fuse failure remains bounded by existing protection schemes.

ENCLOSURE 1 CNL-17-034 E1 - 19 This modification does not affect the number of occurrences of unbalanced voltage conditions and there is no increase in the failure rate of the auxiliary relay that trips the Class 1E bus feeder breakers. In addition, the UVRs are subject to routine surveillance testing and maintenance to ensure they are capable of performing their intended function. Therefore, the addition of the new UVRs does not cause an increase in the failure rate.

3.6 Hardware Installation The hardware modifications have already been installed on 12 of the 16 shutdown boards in the TVA fleet and the rest are currently scheduled to be completed by Spring 2018.

The currently installed hardware is performing a monitoring function with significantly lower setpoints. The trip function and MCR annunciation portion has been disabled and is a blind installation to operators. Upon NRC approval of this LAR, final setpoints will be entered into the 60Q relays and the trip/alarm function will be enabled.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria Comparison to 10 CFR 50.36 Criteria for TS Inclusion The need to include the proposed negative sequence voltage protection function operability and surveillance requirements into the BFN, SQN, and WBN TS was evaluated against the 10 CFR 50.36(c) criteria, and it was determined to meet Criterion 3 of 10 CFR 50.36(c)(2)(ii) as discussed below.

Criterion 3 states:

A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

The operability of the station electric power sources is part of the primary success path for mitigating an accident assuming a loss of all onsite AC power sources (e.g., loss of all EDGs). An operable offsite power circuit must be capable of maintaining rated voltage while connected to the Class 1E buses and accepting required loads during an accident. Similar to the loss of voltage and degraded voltage protective circuitry, the unbalanced voltage protection circuitry is integral to ensuring that the offsite power system is capable of performing its design function of powering the medium voltage Class 1E buses. Therefore, the BFN, SQN, and WBN unbalanced voltage scheme satisfies Criterion 3 for inclusion in the TS.

The proposed change has been evaluated to determine whether the applicable regulations and requirements, noted below, continue to be met.

BFN Units 1, 2, and 3 were not licensed to the 10 CFR 50, Appendix A, GDC. The plants' Updated Final Safety Analysis Report (UFSAR), Appendix A, "Conformance to

ENCLOSURE 1 CNL-17-034 E1 - 20 AEC Proposed General Design Criteria," provides an assessment against the draft GDC published in November 1965 (Units 1 and 2) and July 1967 (Unit 3). While there is not a direct correlation between the current and draft GDC published in November 1965 (Units 1 and 2) and July 1967 (Unit 3), a review has determined that the plant-specific requirements are sufficiently similar to the Appendix A GDC as related to the proposed change. Therefore, TVA has concluded that the proposed change is applicable to BFN, Units 1, 2, and 3.

Criterion 17 - Electric power systems An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite power sources, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a LOCA to assure that core cooling, containment integrity, and other vital safety functions are maintained.

Provisions shall be included to minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power sources.

Compliance with GDC 17 is addressed in the BFN, SQN, and WBN UFSARs.

Based on the review of the above requirements, TVA has determined that the proposed change does not require any exemptions or relief from regulatory requirements, other than revising the TS as described, and does not affect conformance with any of the above noted regulatory requirements or criteria.

4.2 Precedent There are no other applicable regulatory precedents regarding the changes proposed in this LAR.

ENCLOSURE 1 CNL-17-034 E1 - 21 4.3 No Significant Hazards Consideration In accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.90, "Application for amendment of license, construction permit, or early site permit," the Tennessee Valley Authority (TVA) is submitting a request for an amendment to Renewed Facility Operating License Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, Renewed Facility Operating License Nos. DPR-77 and DPR-79 for the Sequoyah Nuclear Plant (SQN),

Units 1 and 2, and Facility Operating License Nos. NPF-90 and NPF-96 for the Watts Bar Nuclear Plant (WBN), Units 1 and 2. This license amendment request (LAR) proposes changes to the Technical Specifications (TS) to add a new level of undervoltage protection, Unbalanced Voltage.

TVA has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change to add a new unbalanced voltage relay (UVR) function at BFN, SQN, and WBN provides another level of undervoltage protection for the Class 1E electrical equipment. The new relay setpoints ensure that the normally operating Class 1E motors and equipment, which are powered from the Class 1E buses, are appropriately isolated from the normal offsite power source and would not be damaged in the event of sustained unbalanced voltage. The addition of the UVR function continues to allow the existing undervoltage protection circuitry to function as originally designed (i.e., degraded and loss of voltage protection remain in place and are unaffected by this change).

The addition of the new UVR function has no impact on accident initiators or precursors; does not alter the accident analysis assumptions or the manner in which the plant is operated or maintained; and does not affect the probability of operator error.

Based on the above, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change to add a new UVR function at BFN, SQN, and WBN provides another level of undervoltage protection for the Class 1E electrical equipment. This

ENCLOSURE 1 CNL-17-034 E1 - 22 change ensures that the assumption in the previously evaluated accidents, which may involve a degraded voltage condition, continue to be valid.

The proposed change does not result in the creation of any new accident precursors; does not result in changes to any existing accident scenarios; and does not introduce any operational changes or mechanisms that would create the possibility of a new or different kind of accident. The UVR function would not affect the existing loss of voltage and degraded voltage protection schemes, would not affect the number of occurrences of degraded voltage conditions that would cause the actuation of the existing Loss of Voltage Relays, Degraded Voltage Relays or the new UVRs; would not affect the failure rate of the existing protection relays; and would not impact the assumptions in any existing accident scenario.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The current undervoltage protection circuitry is designed to isolate the normally operating Class 1E motors/equipment, which are powered from the Class 1E buses, from the offsite power source such that the subject equipment would not be damaged in the event of sustained degraded bus voltage. After the Class 1E buses are isolated from the offsite power supply, the Class 1E motors would be sequenced back on the Class 1E bus powered by the diesel generators (DGs) and continue to perform their design basis function to mitigate the consequences of an accident, with a specified margin of safety.

With the addition of the new level of undervoltage protection, the capability of the Class 1E equipment is assured. Thus the equipment would continue to perform its design basis function to mitigate the consequences of the previously analyzed accidents and maintain the existing margin to safety currently assumed in the accident analyses.

A DG start due to a safety injection signal (i.e., loss of coolant accident) and the subsequent sequencing of Class 1E loads back onto the Class 1E buses, powered by the DG, are not adversely affected by this change. If an actual loss of voltage condition were to occur on the Class 1E buses, the loss of voltage time delays would continue to isolate the Class 1E distribution system from the offsite power source prior to the DG assuming the Class 1E loads. The Class 1E loads would sequence back on the bus in a specified order and timer interval, again ensuring that the existing accident analysis assumptions remain valid and the existing margin to safety is unaffected.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92 (c),

and, accordingly, a finding of no significant hazards consideration is justified.

ENCLOSURE 1 CNL-17-034 E1 - 23 4.4 Conclusions In conclusion, based on the considerations discussed above, there is reasonable assurance that (1) the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

ENCLOSURE 1 CNL-17-034 E1 - 24

6.0 REFERENCES

1. NRC Bulletin 2012-01, Design Vulnerability in Electric Power System, dated July 27, 2012 (ML12074A115)

2. NEI letter to NRC, Industry Initiative on Open Phase Condition, dated October 9, 2013 (ML13333A147)

3. NEI letter to NRC, Industry Initiative on Open Phase Condition, Revision 1, dated March 16, 2015 (ML15075A455)

4. NRC BTP 8-9, Open Phase Conditions in Electric Power System, Revision 0, July 2015 (ML15057A085)

5. NEMA MG 1-1987, Motors and Generators

6. Motor Temperature Estimation Incorporating Dynamic Rotor Impedance, IEEE Transactions on Energy Conversion, Vol. 6, No. 1, March 1991

7. NRC Letter to TVA, Safety Evaluation and Statement of Staff Positions Relative to the Emergency Power Systems for Operating Reactors, dated June 3, 1977 (ML4008006117)

8. NRC Letter to TVA, Description of Events - Millstone Unit 2 and Request for Information, dated August 13, 1976 (ML4005002163)

9. NEI 15-01, An Analytical Approach for Establishing Degraded Voltage Relay (DVR)

Settings, Revision 0, March 2015 (ML15089A329)

10. NRC Information Notice 2012-03, Design Vulnerability in Electric Power System, dated March 1, 2012 (ML120480170)

11. Letter from Exelon Nuclear to NRC, Supplemental Licensee Event Report 2012-001-01, Unit 2 Loss of Normal Offsite Power and Reactor Trip and Unit 1 Loss of Normal Offsite Power Due to Failure of System Auxiliary Transformer Inverted Insulators, dated September 28, 2012 (ML12272A358)

12. IEEE Std 741-1997 (R2002), IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations

13. NRC memorandum, NRC Bulletin 2012-01, Design Vulnerability in Electric Power System: Summary Report, dated February 26, 2013 (ML13052A711)

14. TVA Letter to NRC, CNL-15-030, Response to Watts Bar Nuclear Plant Unit 2 Request for Additional Information Regarding Chapter 8, Electrical Power -

Supplemental Safety Evaluation Report (SSER 22, Open Item 30)

(TAC No. ME2731), dated January 30, 2015

15. NUREG-0847, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2, Supplement 28, August 2015

.1 - Class 1E UVR Comparison to VII and BTP 8-9 A1.1 - 1 Criteria BTP 8-9 VII Delta (Note 1)

Class 1E UVR Solution Location and Condition of an Open Phase.

Loss of one of the three phases of the independent circuits on the high voltage side of a transformer connecting an offsite power circuit to the transmission system with a high impedance ground fault condition.

An open phase, with or without a ground, which is located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 off-site power circuit to the transmission system.

None The UVR protection scheme does not differentiate between the location or grounding of an open phase event (i.e., all events listed here are considered for every mode of operation where the Class 1E bus is in operation).

Any open phase event, in any location outside the Class 1E boundary, that can cause an unbalanced voltage that affects the function of the connected Class 1E equipment is alarmed and protected against.

Therefore, Class 1E UVR protection considers events and grounding conditions that are beyond both the VII and BTP.

Loss of one of the three phases of the independent circuits on the high voltage side of a transformer connecting an offsite power circuit to the transmission system without a high impedance ground fault condition.

An open phase, with or without a ground, which is located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 off-site power circuit to the transmission system.

None Loss of two of the three phases of the offsite power circuit on the high voltage side of a transformer connecting an offsite power circuit to the transmission system without a ground fault condition.

Two open phases which are located on the high voltage side of a transformer connecting a general design criterion (GDC) 17 off-site power circuit to the transmission system.

VII does not address elimination of grounding of two open phases All potential OPCs on the high voltage and low voltage side of transformers and interconnecting onsite auxiliary power circuits have been considered No similar wording.

BTP increased scope to low voltage side of transformer

.1 - Class 1E UVR Comparison to VII and BTP 8-9 A1.1 - 2 Criteria BTP 8-9 VII Delta (Note 1)

Class 1E UVR Solution Automatic Detection Requirements The OPC should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions.

An open phase condition must be detected and alarmed in the control room unless it can be shown that the open phase condition does not prevent functioning of important-to-safety structures, systems and components. If the licensee can demonstrate that the open phase condition does not prevent the functioning, then detection of the open phase condition should occur within a reasonably short period of time (e.g., 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

BTP increased scope to all OPC detection regardless of effect on operability and/or equipment function.

All OPCs that affect the function of the connected Class 1E equipment are automatically detected in the Main Control Room (MCR) via the output of the actuation ABB 60Q trip scheme.

Additionally, any event that causes the unbalanced voltage to increase above an anticipated operational level and potentially cause long term overheating (i.e., no functionality effect, only monetary replacement effects) will be alarmed in the MCR via the alarm relay.

Both of these alarms have associated time delays to account for anticipated transient operation occurrences. No indications will be provided in the MCR when fully capable power is being provided to the Class 1E equipment (i.e.,

no adverse Class 1E equipment effects)

The detection circuit should minimize spurious indications for an operable offsite power source in the range of voltage perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc.,

normally expected in the transmission system.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious action that could cause separation from an operable off-site GDC 17 source.

Additionally, the protective scheme should not separate the operable off-site GDC 17 source in the range of voltage unbalance normally expected in the transmission system.

VII increased scope beyond detection to actuation circuit requirement If the plant auxiliaries are supplied from the main generator and the offsite power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., OPC) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any subsequent design bases conditions that rely on offsite power circuit(s) for safe shutdown do not create plant transients or abnormal operating conditions.

It is recognized that some transformers have very low or no loading when in the standby mode. Automatic detection may not be possible in this condition; however, automatic detection must happen as soon as loads are transferred to this standby source.

Additionally, if automatic detection is not possible, shiftly surveillance requirements must be established to look for evidence of an open phase.

BTP increased scope to all OPC detection in the main control room regardless of effect on operability and/or equipment function Automatic detection for standby transformer is immediately provided when the Class 1E equipment is connected. Alternate means of detection for open phases can be utilized to confirm offsite power operability within the existing LCO action times at each station, consistent with each station's existing offsite power operability determination. Class 1E protection will be provided 100% of the time, including during a subsequent design basis event.

If offsite power circuit(s) is (are) functionally degraded due to OPCs, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable offsite power source or onsite standby power system within the time assumed in the accident analysis and without actuating any protective devices, given a concurrent design basis event.

Automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing bases.

None Existing undervoltage logic for Class 1E bus transfer is utilized by the UVR protection scheme to transfer Class 1E equipment to the onsite power supply.

.1 - Class 1E UVR Comparison to VII and BTP 8-9 A1.1 - 3 Criteria BTP 8-9 VII Delta (Note 1)

Class 1E UVR Solution Automatic Protection of ESF Equipment Requirements Power quality issues caused by OPCs such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses.

The open phase condition does not adversely affect the function of important-to-safety structures, systems and components BTP increased scope to include phase angle shifts and harmonic distortion which is not currently identified as an effect of OPC The OPC event causes unbalanced voltage power quality issues which can affect Class 1E buses. The new protection scheme measures those quantities to ensure equipment functionality is maintained.

Protection scheme should comply with applicable requirements including single failure criteria for ESF systems.

Accident assumptions must still include licensing provisions associated with single failures.

None UVR is a Class 1E protection scheme.

Protection scheme design should minimize misoperation, maloperation, and spurious actuation of an operable off-site power source.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious action that could cause separation from an operable off-site GDC 17 source.

None Only a source which affects the function of the connected Class 1E equipment will be disconnected. Setpoint determination for the UVRs is based on the most limiting component(s) ability to maintain function and not exceed manufacture's recommendations.

Operability is not determined by the protection equipment.

The protective scheme should not separate the operable off-site power source in the range of voltage perturbations such as switching surges, load or generation variations etc., normally expected in the transmission system.

Additionally, the protective scheme should not separate the operable off-site GDC 17 source in the range of voltage unbalance normally expected in the transmission system.

Functionally the same; voltage perturbations vs.

voltage unbalance The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturers recommendations.

An open phase condition will not prevent functioning of important-to-safety structures, systems, and components.

None Alarm setpoints protect equipment per manufacturers recommendations and trip setpoints protect ESF component function.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of OPCs should be identified and implemented consistent with the operability requirements specified in the plant TSs Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10 CFR 50.36.

None Setpoints will be added to the instrumentation section of the TS (similar to DVR and LOV) and will be consistent with operability requirements currently specified in the existing plant TS.

Note 1: The term None in the Delta column signifies that there is minimal or no functional differences between the two documents.

.2 - History and Background of the Open Phase Condition CNL-17-034 A1.2 - 1 On January 30, 2012, an operating event at Byron Station Unit 2 showed that the existing Class 1E undervoltage protection schemes have a design deficiency. The cause of the event was determined to be a loss of C-phase voltage to both unit system auxiliary transformers due to a failed insulator in the 345-kV switchyard. The loss of C-phase voltage to the system auxiliary transformers resulted in an unbalanced voltage condition on station buses caused by degraded voltage on phases A-C and B-C. The reactor protection scheme correctly recognized the unbalanced voltage condition (one of two phase undervoltage on two of four reactor coolant pumps (RCPs)) on the 6.9-kV buses and initiated a unit scram. However, the safety-related bus protection schemes did not protect the function of the safety related equipment while connected to a degraded offsite power source. This event revealed a vulnerability in the original plant protective relaying scheme design in that it was unable to detect the unbalanced voltage caused by the open phase connection resulting from a switchyard component failure.

The original design and licensing bases did not protect for a single-phase failure to the system auxiliary transformers. Thus, the undervoltage and overcurrent protective functions associated with the safety buses and the system auxiliary transformers were not designed to detect such a failure.

Following the Byron event, the nuclear industry recognized the potential safety concern and held weekly phone calls to share information and causes for determination of applicability. To document up-to-date industry knowledge of the event that caused a failure of the Class 1E safety system, the Institute of Nuclear Power Operations (INPO) issued an event report, IER L2-12-14 on February 16, 2012, which included a summary of the event, causes and contributing factors, as well as recommendations to develop corrective actions applicable to each plant. As more information became available, several other documents were issued (e.g., NRC Information Notice (IN) 2012-03 (Reference 10), NRC Bulletin 2012-01 (Reference 1), and the Byron Supplemental Licensee Event Report (Reference 11)).

Figure 1 provides a timeline representation of some of the issued documents.

.2 - History and Background of the Open Phase Condition CNL-17-034 A1.2 - 2 Figure 1 - Timeline of Open Phase Documents During 2012, TVA reviewed the accounts of other operating experience for this type of event (i.e., a phase opening). During the review period, the nuclear industry discovered that there was no existing design or regulatory requirement for this type of failure and no prior calculated information available to provide a determinate solution. In order to definitively quantify the vulnerability, TVA utilized ETAP software (Electrical Power System Analysis & Operation Software) that at that time, was used in >90% of the US nuclear industry for auxiliary power system analysis. By working with TVA and other industry experts, the ETAP program was modified to enable the nuclear industry to perform unbalanced load flow analyses by opening a phase of input power to connected equipment. Beginning in February 2013, the nuclear industry was able to begin performing analyses to define each stations vulnerability to the open phase event.

While the determination of critical parameters and studies was just beginning, there was a need for the industry to commit to do something prior to the analysis being completed due to the potential safety consequences. To satisfy this need, NSIAC through NEI, created and accepted the industry initiative in October 2013. The open phase industry initiative documents the generalized criteria that the industry must work towards in order to maintain safety system function and resolve the safety consequences associated with open phase events.

TVA continued to analyze the possibility of an open phase event occurring at a TVA nuclear station. TVA began by employing a top down type analysis that considered the effect on all the equipment connected to the Class 1E system. Various scenarios were

.2 - History and Background of the Open Phase Condition CNL-17-034 A1.2 - 3 considered and TVA determined that there were several critical parameters required for accurately calculating the consequences of an open phase. The need for exact values for these currently unknown parameters was determined to cause orders of magnitude changes in results. However, as presented at the NRC public meeting held on January 14 and 15, 2015, there were only two general results of this type of top down analysis: 1. no operating effect, or 2. loss of equipment functionality with no equipment damage. Because actual data is required to definitively determine which result type (i.e., no effect or loss of functionality), TVA determined that if actual data could not be obtained, calculated results could not be accurately justified. An additional accuracy concern stemmed from the top down analysis. There are numerous variables in the preferred power supply (PPS); therefore, in order to produce a bounding scenario, all of these variables would have to be established to determine the worst case. A completely bounding scenario could not be created because it was impossible to determine the worst case due to competing restraints (e.g., what would be the worst case for an ungrounded fault would not be the worst case for a grounded fault).

TVAs vulnerability studies identified that by removing one phase from the power source, the consequence was the potential to create an unbalanced phase voltage to connected equipment. These analyses confirmed instances of unbalanced voltage documented since the 1950s. These vulnerability studies also confirmed that the new industry event, i.e., the open phase event, was really just a subset of the unbalanced voltage condition. TVA determined that an open phase on the high side of a transformer was not the only event that would produce an unbalanced voltage.

Industry standards and discussions of unbalanced voltage are contained in electrical textbooks and various papers (e.g., NEMA MG-1 (Reference 5)).

To confirm the analytical model for open phase, TVA performed the Bellefonte Nuclear Plant (BLN) Open Phase Test. This test verified that the model critical parameters were correctly inputted and that the methodology for the analysis matched real world data.

The results of the test verified that the methodology and calculations produced values equivalent to the actual plant readings.

During the timeframe of the TVA open phase analysis (2012-2015), TVA was also in the process of licensing WBN Unit 2. During this time, the NRC staff asked several questions regarding the TVA degraded voltage setpoint methodology. Because the same power system analysis (PSA) team was involved in both open phase and degraded voltage, this team identified that the same type of protection criteria existed for both degraded voltage and the open phase industry initiative. This equivalency was determined because the results of both events (degraded voltage and unbalanced voltage) equal the loss of equipment function due to connection to a source that is not capable of providing the proper voltage levels for the equipment to function. The PSA team determined that because the criteria were equivalent, the analytical methodology by which the DVR and open phase events are analyzed should also be equivalent.

During the licensing process for WBN Unit 2, TVA performed one method found acceptable by NRC for determination of setpoint methodology of degraded voltage. This methodology was later documented in NEI 15-01 An Analytical Approach for Establishing Degraded Voltage Relay (DVR) Settings (Reference 9). The PSA team utilized the existing qualified plant models for the TVA fleet to perform unbalanced voltage calculations in the same bottom up manner as the DVR setpoint methodology.

.2 - History and Background of the Open Phase Condition CNL-17-034 A1.2 - 4 This bottom up methodology determined the unbalanced voltage limits necessary to ensure that the required safety electrical equipment and devices would successfully complete their required safety function, and to ensure that the duration of the unbalanced voltage condition would not result in equipment damage. The bottom up methodology is consistent throughout the TVA fleet for both degraded voltage and unbalanced voltage, as well as in industry standard IEEE 741 IEEE Standard Criteria for the Protection of Class 1E Power Systems and Equipment in Nuclear Power Generating Stations (Reference 12).

An additional benefit of the bottom up methodology vs. the top down methodology is that the bottom up methodology removed the uncertainty of the top-down methodology resulting from the lack of actual equipment data, which was not available for either the degraded voltage or unbalanced voltage analyses. Another benefit was that there was no need for a first-of-a-kind analysis to verify safety function for an unbalanced voltage. Instead, a consistent methodology was employed that has been used since the early licensing of the TVA plants prior to the 1980s and was re-confirmed by the NRC during the WBN Unit 2 licensing period.

The combination of TVAs PSA team involvement in both analyses (DVR and open phase) and TVA maintaining leadership engagement in all facets of the open phase event since 2012 (including participation in the initial event phone calls, open phase analysis working group, NEIs open phase steering committee, and full scale open phase testing) allowed TVA to develop a comprehensive and elegant solution to the design vulnerability identified by the Bryon event that exceeds the criteria in both the open phase condition VII (References 2 and 3) and BTP 8-9 (Reference 4). The TVA Class 1E unbalanced voltage solution is consistent with the existing NRC-approved undervoltage protection schemes (DVR and Loss of Voltage) and exceeds protection criteria provided in BTP 8-9. In addition, this protection scheme exceeds the previously identified industry and regulatory requirements by providing protection from not only an open phase on the high side of the transformer, but from any event in any location outside the Class 1E system that can cause an unbalanced voltage which can prevent the functioning of connected Class 1E equipment.

.3 - NRC Bulletin 2012-01 Summary Report Excerpts CNL-17-034 A1.3 - 1 An excerpt from the NRCs response to the industry response to the bulletin, NRC Bulletin 2012-01, Design Vulnerability in Electric Power System: Summary Report, dated February 26, 2013 (Reference 13), states: The staff recognizes that the current plant licensing bases documents have not specifically identified this design vulnerability discussed in BL 2012-01. The NRC had not specifically required licensees to address this design vulnerability at the time of licensing or through subsequent generic communications because this design vulnerability and the safety significance was not known to the staff until the Byron Unit 2 event occurred which led to a scenario where neither the offsite power system nor the onsite power system was able to perform its intended safety functions. However, the regulatory requirements discussed above existed at the time of licensing these plants; therefore, NRC may have to take regulatory actions to address this design vulnerability. The staff recommendations were:

1) For current operating plants, the staff recommends the NRC take further regulatory actions to require licensees to provide design features to detect and automatically respond to a single-phase open circuit or high impedance fault condition on the high voltage side of a credited offsite circuit. This will ensure that an offsite and an onsite electric power system with adequate capacity and capability will be immediately available to permit the functioning of structures, systems, and components important to safety in the event of anticipated operational occurrences and postulated accidents.

(2) For the four new reactors with COLs, the staff recommends the NRC take further regulatory actions to require licensees to provide design features to detect and respond to a single-phase open circuit with or without high impedance fault condition on the high voltage side of a credited offsite circuit prior to the fuel load. In addition, the staff recommends that NRC verifies the licensees have provided design features and analyses to show that the offsite power system is capable of supplying assumed plant loads as well as required voltages at the interface with the onsite ac power system that will support operation of assumed loads during normal, abnormal, and accident conditions as required by Inspections, Tests, Analyses, and Acceptance Criteria.

(3) All licensees should have operating procedures and surveillances to monitor the availability and operability of offsite power supplies (all three phases) at the ESF buses, at least once every shift during normal plant operation based on the design vulnerability identified in the Bulletin.

(4) All licensees should implement corrective actions in accordance with 10 CFR 50, Appendix B, Criterion XVI Corrective Actions, to ensure that the onsite and the offsite electric power systems can perform its intended safety functions based on the design vulnerability identified in this Bulletin.

.4 - Technical Concepts documented in NRC/Industry documents CNL-17-034 A1.4 - 1 The following technical concepts have been documented here for ease of retrieval. Note that these are direct excerpts from these documents:

Technical Concept 1:

Open phase is an event that may cause voltage unbalance.

NRC Information Notice 2012-03 (03-01-2012)

The open circuit created an unbalanced voltage condition (loss of phase) on the two 6.9-kV non safety-related RCP buses and the two 4.16-kV ESF buses. ESF loads remained energized momentarily, relying on equipment-protective devices to prevent damage from single phasing or an overcurrent condition. The overload condition caused several safety-related loads to trip.

NRC Bulletin 2012-01 (07-27-2012)

On January 30, 2012, Byron Station, Unit 2 experienced an automatic reactor trip from full power because the reactor protection scheme detected an undervoltage condition on the 6.9-kV buses that power reactor coolant pumps (RCPs) B and C (one of two phase undervoltage on two of four RCPs initiate a reactor trip). The undervoltage condition was caused by a broken insulator stack of the phase C conductor for the 345-kV power circuit that supplies both SATs. This insulator failure caused the phase C conductor to break off from the power line disconnect switch, resulting in a phase C open circuit and a high impedance ground fault.

After the reactor trip, the two 6.9-kV buses that power RCPs A and D, which were aligned to the UATs, automatically transferred to the SATs, as designed. Because phase C was on an open circuit condition, the flow of current on phases A and B increased due to unbalanced voltage and caused all four RCPs to trip on phase overcurrent. Even though phase C was on an open circuit condition, the SATs continued to provide power to the 4.16-kV ESF buses A and B because of a design vulnerability revealed by this event. The open circuit created an unbalanced voltage condition on the two 6.9-kV non safety-related RCP buses and the two 4.16-kV ESF buses. ESF loads remained energized momentarily, relying on equipment protective devices to prevent damage from an unbalanced overcurrent condition. The overload condition caused several ESF loads to trip.

Byron Supplemental LER (09-28-2012)

The January 30, 2012, event was initiated by a mechanical failure of a 345 kV Ohio Brass inverted porcelain insulator on the System Auxiliary Transformer (SAT) 242-1/2 A-Frame structure in the Switchyard resulting in an open phase non-faulted condition on phase C. The 4.16 kV ESF buses undervoltage protection scheme did not automatically switch over to the emergency DGs. However, the 6.9 kV buses powering the Reactor Coolant Pumps did recognize the undervoltage condition and as designed generated a reactor trip signal. The 4.16 kV ESF buses remained energized with a voltage unbalance.

.4 - Technical Concepts documented in NRC/Industry documents CNL-17-034 A1.4 - 2 NRC BTP 8-9 (07-2015)

On January 30, 2012, Unit 2 experienced an automatic reactor trip from full power because the reactor protection scheme detected an undervoltage condition on the 6.9-kV buses that power the RCPs. The undervoltage condition was caused by a broken inverted porcelain insulator stack of the Phase C conductor for the 345-kV power circuit that supplies both SATs. The insulator failure resulted in a high impedance fault through the fallen Phase C conductor and a sustained open phase condition on the high voltage side of the SAT. The open circuit created an unbalanced voltage condition on the two 6.9-kV non safety-related RCP buses and the two 4.16-kV ESF buses. Some ESF loads that were energized relied on equipment protective devices to prevent damage from an unbalanced overcurrent condition. The phase overcurrent condition actuated relays to trip several ESF loads.

Technical Concept 2:

The design vulnerability identified by the Byron event is the loss of safety function due to unbalanced voltages caused by the open phase event.

NRC Information Notice 2012-03 (03-01-2012)

On January 30, 2012, Byron Station, Unit 2 experienced an automatic reactor trip from full power because of an undervoltage condition on two 6.9-kV electrical buses that power RCPs B and C. A broken insulator stack for the phase C conductor on the 345-kV power circuit that supplies both SATs caused the undervoltage condition. This insulator failure caused the phase C conductor to break off from the power line disconnect switch resulting in a phase C open circuit. Although the break in the power line may have caused phase C to ground, the 345-kV circuit does not have ground fault protection and the switchyard breakers did not open.

After the reactor trip, the two 6.9-kV buses that power RCPs A and D, which were aligned to the UATs, automatically transferred to the SATs, as designed. Because phase C was open circuited, the flow of current on phases A and B increased and caused all four RCPs to trip on phase overcurrent. With no RCPs functioning, control room operators performed a natural-circulation cooldown.

Even though phase C was open circuited, the SATs continued to provide power to the 4.16-kV ESF buses A and B because of a design vulnerability this event revealed. The open circuit created an unbalanced voltage condition (loss of phase) on the two 6.9-kV nonsafety-related RCP buses and the two 4.16-kV ESF buses. ESF loads remained energized momentarily, relying on equipment-protective devices to prevent damage from single phasing or an overcurrent condition. The overload condition caused several safety-related loads to trip.

NRC Bulletin 2012-01 (07-27-2012)

After the reactor trip, the two 6.9-kV buses that power RCPs A and D, which were aligned to the UATs, automatically transferred to the SATs, as designed. Because phase C was on an open circuit condition, the flow of current on phases A and B increased due to unbalanced voltage and caused all four RCPs to trip on phase overcurrent. Even though phase C was on an open circuit condition, the SATs

.4 - Technical Concepts documented in NRC/Industry documents CNL-17-034 A1.4 - 3 continued to provide power to the 4.16-kV ESF buses A and B because of a design vulnerability revealed by this event. The open circuit created an unbalanced voltage condition on the two 6.9-kV nonsafety-related RCP buses and the two 4.16-kV ESF buses. ESF loads remained energized momentarily, relying on equipment protective devices to prevent damage from an unbalanced overcurrent condition. The overload condition caused several ESF loads to trip.

With no RCPs functioning, control room operators performed a natural-circulation cooldown. Approximately 8 minutes after the reactor trip, the control room operators diagnosed the loss of phase C condition when the bus voltage selector switch was switched from monitoring the A-B phase voltage to the B-C and C-A phase voltages and manually tripped breakers to separate the unit buses from the offsite power source.

When the operators opened the SAT feeder breakers to the two 4.16-kV ESF buses, the loss of ESF bus voltage caused the EDGs to automatically start and restore power to the ESF buses. The licensee declared a notice of unusual event based on the loss of offsite power. The next day, the licensee completed the switchyard repairs, restored offsite power, and terminated the notice of unusual event.

The licensee reviewed the event and identified design vulnerabilities in the protection scheme for the 4.16-kV ESF buses. The loss of power instrumentation protection scheme is designed with two undervoltage relays on each of the two ESF buses. These relays are part of a two-out-of-two trip logic based on the voltages being monitored between phases A-B and B-C of ESF buses. Even though phase C was on open circuit, the voltage between phases A-B was normal; therefore, the situation did not satisfy the trip logic. Because the conditions of the two-out-of-two trip logic were not met, the protection system generated no protective trip signals to automatically separate the ESF buses from the offsite power source.

Byron Supplemental LER (09-28-2012)

On January 30, 2012, at 1039, in accordance with 10 CFR 50.72 (a)(1)(i), (b)(2)(iv)(B) and (b)(3)(iv)(A), an Emergency Notification System (ENS) notification to the NRC was made for the Unusual Event (UE) declaration, the reactor trip and the safety system actuations. This ENS notification was later updated at 1218, to include reporting criteria of 10 CFR 50.72 (b)(2)(i), (b)(2)(xi) and (b)(3)(v)(D) for TS required shutdown, offsite notification and a loss of safety function. A subsequent review of the reportability criteria selected concluded that the TS required shutdown should not have been checked on the ENS notification since the Unit was already in Mode 3, Hot Standby, when the TS condition requiring a shutdown to Mode 5 was entered. NUREG 1022 guidance indicates this reporting criterion does not apply after entering Mode 3. Periodic ENS update calls were made for the duration of the event. On January 31, 2012, at 2119, an ENS notification was made for the UE termination.

On February 3, 2012, at 2210, a voluntary ENS notification was made to communicate the design vulnerability in the 4.16 kV ESF bus undervoltage protection scheme and that it may have generic applicability to the industry. As a clarification to the voluntary ENS notification, the analysis mentioned in the report that was assessing the safety significance, was not a documented written analysis or assessment from the vendor supporting the plant modeling, but rather initial engineering judgment from the input.

Further deterministic engineering judgment of the safety significance of this design vulnerability does not support the initial judgment and is being formally evaluated to

.4 - Technical Concepts documented in NRC/Industry documents CNL-17-034 A1.4 - 4 make a final determination. In addition, this LER is submitted in accordance with 10 CFR 50.73 (a)(2)(iv)(A), (a)(2)(v)(D), (a)(2)(vii) and (a)(2)(ix)(A).

The adequacy of the undervoltage protection design was assessed in an operability evaluation for the loss of offsite power DG start instrumentation. It concluded that the current protection design is operable and that detection down to the level of this type of failure was beyond regulatory design requirements. However, the design vulnerability will be addressed with a means to eliminate this vulnerability in single open phase detection scheme.

In the interim, compensatory measures have been taken to enhance diagnosing and responding to a similar event. These measures include enhance procedural direction to diagnose and recover from this condition, a Control Room alarm function for detecting an phase imbalance, and a designated operator to monitor 4.16 kV ESF bus voltage and to open the SAT-1/2 feed breakers when an open single phase condition is detected.

NRC BTP 8-9 (07-2015)

A review of other operating experience identified design vulnerabilities associated with single-phase open circuit conditions at South Texas, Unit 2 (see LER 50-499/2001-001, ML011010017); Beaver Valley Power Station, Unit 1 (see LER 50-334/2007-002, ML080280592); and a single event that affected Nine Mile Point, Unit 1 (see LER 50-220/2005-04, ML060620519) and James A. Fitzpatrick Power Plant (see LER 50-333/2005-06, ML060610079.)

These events involved offsite power circuits that were rendered inoperable due to an open circuit in one phase. In each instance (except South Texas, Unit 2), the condition went undetected for several weeks because offsite power was not aligned to the ESF buses during normal operation and the surveillance procedures, which recorded phase--o-phase voltage, did not identify the loss of the single phase. At South Texas, Unit 2, offsite power was normally aligned to ESF and nonsafety plant buses and the reactor was manually tripped by the operator when the three Circulating Water Pumps were tripped by the open phase condition. Operating experience has identified three similar international events:

1. On December 22, 2012, Unit 1 at Bruce Power Plant in Canada was in shutdown condition when a maintenance cooling system pump (P1) tripped. Operators tried to manually start pumps P1 and P2 but both failed to start due to the electrical protection schemes. Field operators identified a loss-of-phase condition caused by a break in one of the 3 phases of the 230 kV overhead line connection.

2. On May 30, 2013, Forsmark Unit 3 in Sweden reported an event resulting from human error. The plant was in a refueling outage with one of the two 400-kV offsite power circuit breakers and a 70-kV back-up power supply breaker open due to maintenance work. While testing the protective relaying for the main generator, an erroneous trip signal was sent to the remaining 400-kV offsite power source circuit breaker. One of the three phases in the circuit breaker failed to open, resulting in a double open phase condition in the power circuit (i.e., two open phases). Some of the operating loads tripped due to phase unbalance, while some safety-related and nonsafety-related loads overheated and failed. The undervoltage relays on the

.4 - Technical Concepts documented in NRC/Industry documents CNL-17-034 A1.4 - 5 safety buses did not detect the degraded voltage conditions because the induced voltage was higher than the trip setpoint of the relays.

3. On April 27, 2014, the Dungeness B power plant in United Kingdom experienced random tripping of large loads resulting from the loss of one of three phases in the 400kV electrical supply to the site. The open phase condition was the result of inadequate contact in one pole of the circuit breaker.

In the events discussed above, the protective relaying schemes did not detect the open phase(s) conditions due to inadequate detection schemes. As a result, degraded power sources continued to supply plant safety-related and non safety-related loads. In addition, the emergency diesel generators (onsite power system) did not automatically connect to the safety buses because the plant design did not have features to detect and automatically isolate the open phase conditions in the offsite power source.

Based on the Byron Station operating event, the staff issued NRC IN 2012-03, Design Vulnerability in Electric Power System, dated March 1, 2012 (Reference 10). On July 27, 2012, the staff issued NRC Bulletin 2012-01, Design Vulnerability in Electric Power System, (Reference 1) to confirm that licensees comply with Title 10 of the Code of Federal Regulations (10 CFR) 50.55a(h)(2), 10 CFR 50.55a(h)(3), and Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, GDC)17, Electric Power Systems, or principal design criteria specified in the updated final safety analysis report. Specifically, the NRC requested licensees to provide information by October 25, 2012, regarding (1) the protection scheme to detect and automatically respond to a single phase open circuit condition or high impedance ground fault condition on GDC 17 power circuits, and (2) the operating configuration of engineered safety features buses at power. The Electrical Engineering Branch staff has reviewed the information that NRC licensees provided and the details of this review are documented in a NRC Bulletin 2012-01, Design Vulnerability in Electric Power System, Summary Report dated February 26, 2013 (Reference 13).

The purpose of this BTP is to provide guidance to the staff in reviewing various licensing actions related to electric power system design vulnerability due to open phase conditions in offsite electric power systems in accordance with Appendix A to 10 CFR Part 50, GDC 17 or principal design criteria specified in the updated final safety analysis report, 10 CFR 50.55a(h)(2), 10 CFR 50.55a(h)(3), and 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

.1 - BFN Electrical Distribution System Diagram CNL-17-034 A2.1 - 1

4KV CT SWGR F 4KV CT SWGR E 4KV START BD 1 1412 1414 5201G 5221G 5231G 5251G 5281G 5291G 5255 5253 5275 NC 5285 NC 500 KV BUS 2 - SECTION 1 500 KV BUS 1 - SECTION 1 500 KV BUS 2 - SECTION 2 500 KV BUS 1 - SECTION 2 5250 5240 WEST POINT MADISON 1 TRINITY 1 MAURY UNION LIMESTONE TRINITY 2 TRICO MAIN XFMR UNIT 1 MAIN XFMR UNIT 2 MAIN XFMR UNIT 3 5297 5293 5299 5287 5289 5283 5273 5279 5277 5267 5269 5265 5263 5257 5259 5247 5249 5245 5243 5237 5225 5223 5217 5219 5215 5213 5207 5205 5203 NC NC NC NC NC NC NC NC NC NC NC 5209 5229 NC 4KV START BUS 2A 4KV START BUS 2B INFORMATION ONLY NC NC NC NC 5208 5204 NC NC NC NC 5214 5218 NC NC NC NC NC NC NC 5224 5228 NC NC NO 5234 5235 5233 NC NC NC NC 5244 5248 NC NO NC NC NC 5254 5258 NC NC NC NC 5268 5264 NC NC NC NC 5274 5278 NC NC NC NC 5284 5288 NO NC NC 5298 USST 1B USST 1A X

Y X

Y USST 2B USST 2A X

Y X

Y USST 3B USST 3A X

Y X

Y USST 1A 4KV RECIRC BD 1 1122 1436 1124 1534 NC NC NO NO NC NC NO NO USST 2A 4KV RECIRC BD 2 1222 1438 1224 1536 NC NC NO NO USST 3A 4KV RECIRC BD 3 1322 1324 1538 1442 1934 UP INV RPS ALT 4KV UB 1A 4KV COM BD A 4KV START BUS 1A 4KV START BUS 1B 480V UB 1A 480V UB 1B 4KV SD BUS 1 4KV SD BUS 2 4KV COM BD B 480V UB 2A 480V UB 2B 480V UB 3A 480V UB 3B 4KV START BUS 1A 4KV START BUS 1B 4KV SD BUS 1 4KV SD BUS 2 4KV SD BD A 4KV SD BD B 4KV SD BD C 4KV SD BD D 480V SD BD 1A 480V SD BD 1B 480V RMOV BD 1A 480V RMOV BD 1B 480V RMOV BD 1C 480V CONT BAY VENT BD A TS1A TS1E TS2A TS2E 480V DSL AUX BD A 480V DSL AUX BD B TS2B 480V SD BD 2A 480V SD BD 2B 480V RMOV BD 2A 480V RMOV BD 2B 480V RMOV BD 2C 480V RMOV BD 2D 480V RMOV BD 2E 480V COM BD 1 BUS B 4KV SD BD 3EA 4KV SD BD 3EB 4KV SD BD 3EC 4KV SD BD 3ED 480V SD BD 3B 480V RMOV BD 3A 480V RMOV BD 3C 480V RMOV BD 3D 480V RMOV BD 3E 480V CONT BAY VENT BD B 480V DSL AUX BD 3EA 480V DSL AUX BD 3EB 4KV SD BD 3EA 4KV SD BD 3EB 4KV SD BD 3EC 4KV SD BD 3ED 4KV SD BD A 4KV SD BD B 4KV SD BD C 4KV SD BD D 4KV RECIRC BD 1 1522 1424 1114 1524 1116 1118 1422 1212 1428 1214 1526 1216 1426 1232 1132 1312 1326 1332 1314 1316 1434 480V COM BD 3 BUS A 1614 1716 1818 1824 1616 1714 1822 1828 1718 1624 1812 1814 1724 1618 1816 1826 1334 1726 1838 1844 1728 1842 1848 1626 1832 1834 1628 1836 1846 4KV BUS TIE BD 1632 1732 1742 1642 1712 1722 1622 I&C BUS 1A RPS 1A MG RPS 1B MG I&C BUS 1B UP MMG AC FEED I&C BUS 2A UP ALT RPS ALT RPS 2A MG RPS 2B MG UP ALT I&C BUS 3B RPS 3A MG RPS 3B MG RPS ALT TU1A TU1B TU2A TU2 B

TU3A TU3B TEA TEB 480V HVAC BD B (ON 4KV SD BD B)

(ON 4KV SD BD A)

(ON 4KV SD BD C)

(ON 4KV SD BD D)

CREV A SBGT A SBGT B CREV B

4KV UB 2A 4KV UB 3A 4KV UB 1B 4KV UB 3B 4KV UB 2B 4KV UB 1C 4KV UB 2C 4KV UB 3C NC NC NC NC NC NO NC NC NO NC NO NO NC NC NO NO NC NC NC NC NC NC 4KV RECIRC BD 2 4KV RECIRC BD 3 NO NC NO DG A

NO NO NC NC NC NC NC NO NO NO NO NC NC NC NC NC NO NO NC NC NO NC NC NC NC NO NO NC NO DG B

NO NO NO NC NC NC NC NO DG C

NO NO NC NO DG D

NO NO NC NC NC NC NC NC NC NO NO NC NO NO NC NC NC NC NO NO NC NC NC NC NC NC NO NO NO NC NC REFERENCE DRAWINGS Unit Drawing Sheet Description 0

0 0

1, 2, 3 1, 2, 3 1, 2, 3 3

0 0

3 0

0 3

3 0

1, 2, 3 1, 2, 3 1, 2, 3 0

0 0

0, 3 TPS 75E701 45E1506 45E1504 45E751 45E749 45E747 45E736 45E736 45E733 45E732 45E732 45E729 45E724 45E724 45E724 45E721 45E719 45E718 45E1505 45E715 45E506 35E713 35E713 15E500 DSL-6055 Series Series 1, 2 6

1, 2 1

5, 6 1, 2, 3, 4 1, 2, 3 6, 7, 8, 9 5

1, 2, 3, 4 Series 2

1, 3, 4, 5 Series 1, 2 480V Transformer Yard Distribution Cabinet 1, 2, 3 Main Generator 3 and 500kV Main Single Line Main Generator 1 and 500kV Main Single Line 480V RMOV Board 1A to 3E 480V Shutdown Board 1A to 3B 480V Unit Board 1A to 3B 480V HVAC Board B 480V Control Bay Vent Board A, B 480V Standby Gas Treatment Board 480V Diesel Generator Auxiliary Board 3EA, 3EB 480V Diesel Generator Auxiliary Board A, B 480V Common Board 1, 2, 3 4kV Shutdown Board 3EA to 3ED 4kV Bus Tie Board 4kV Shutdown Board A to D 4kV Unit Board 1A to 3C 4kV Reactor Recirc RPT Board 1A to 3B 4kV Reactor Recirc Board A, B; 4kV Start Board 2 Main Generator 2 and 500kV Main Single Line 4kV Common Board A, B; 4kV Start Board 1 161kV Main Single Line 4kV Outside and Construction Loops 4kV Cooling Tower Switchgear A, B, C, D Normal/Standby Auxiliary Power Dispatching Single Line, Browns Ferry TRANSFORMER LOAD TAP CHANGER POWER Normal Auto Transfer To USST 1B USST 2B USST 3B CSST B CSST A 480V Common Bd 2, Bus B 480V Common Bd 2, Bus B 480V Unit Bd 1B 480V Unit Bd 2B 480V Unit Bd 3B 480V Common Bd 2, Bus B 480V Common Bd 2, Bus A 480V Common Bd 2, Bus A 480V Unit Bd 1B 480V Unit Bd 1B PIP-02-03 AC ELECTRICAL DISTRIBUTION SYSTEM BROWNS FERRY NUCLEAR PLANT REVISION DRAFT NO NC NO NC NC NO NO NC NO NO NC NO NC NO NC NO NC NC NC NC NC NC NC NO NO NC NC NO NC NC NO NC NO NC NO NC NC NO NO NO NO NC COND DEMIN BD 3 ALT 480V SGT BD SBGT C NC NC NO XS-S-1 POLE 1B ATHENS Y

X Y

X TRINITY 4KV CT SWGR A 4KV CT SWGR B PUMPS 2B, 3A, 3B 4KV CT SWGR C PUMPS 5A, 6A, 6B 4KV CT SWGR D PUMPS 4A, 4B, 5B COOLING TOWER XFMR 2 COOLING TOWER XFMR 1 1922 1916 1918 1924 1912 1926 1928 1914 C7 D7 SOUTH OUTSIDE LOOP B14 CONSTRUCTION LINE B13 NORTH SOUTH ADMIN BUILDINGS SOUTH NORTH ADHR BFTVC NODE 2 BLDG TELCOM (HYPOCHLORITE) BLDG ECOLOCHEM HWC MPC 1 2 3 MAINTENANCE BLDG PUMPS 1A, 1B, 2A NO NO NO NO NO DG 3A DG 3B NO NO NO DG 3C NO NO NO DG 3D NO NO NO NC SHUNT REACTOR 33 MVAR 5271G NO 6271R GEN 3

234 NC NC NO NO 52 57-2 57-1 89 GEN 2

224 NC NO NO 52 57-2 57-1 89 NC NO/AUTO 892 902 CAP BANK NO.2 46 MVAR NO/AUTO CAP BANK NO.1 38 MVAR NC NC 8989 9089 89G 90G NO NO NC NC 91G1 93G1 ATHENS 161 KV TRINITY 161 KV 919 927 929 925 923 NC NC NC NC NC NC 161KV BUS 2 91G2 93G2 NC NC NO NO 935 924 928 161KV BUS 1 CSST A CSST B Y

X Y

X LEGEND 161 KV SYSTEM 22 KV MAIN GENERATOR 4KV NON-DIVISIONAL 4KV START BUS 1A 4KV START BUS 2A OR 4KV & 480V DIV II 4KV START BUS 2B OR 480V NON-DIVISIONAL 500 KV SYSTEM 4KV START BUS 1B OR 4KV & 480V DIV I ALTERNATE FEED NORMAL FEED 4KV START BD 2 1416 1418 1512 1514 NC NO NO NO NC NC COND DEMIN BD 1 NC 1112 NC 1126 NC 1612 NC NO TG1A NC NC NC TG2A TG3A NC RHRSW A1, A2 RHRSW C1, C2 NC NC NC TDE TS1B CON DEMIN BD1 ALT NC NC TDA COND DEMIN BD 2 NC NO NC TC3B NC NC NC TC2B TC1B NC NC 5227 NO NO NO NO COND DEMIN BD 3 NC NO RHRSW B2, B3 RHRSW D2, D3 CON DEMIN BD2 ALT NC I&C BUS 2B NC NO NO NO NO NC TDB RHRSW A3 RHRSW C3 RHRSW D1 RHRSW B1 NC NC NC NC TS3A THB TSG1A 480V SD BD 3A UP MMG AC FEED I&C BUS 3A 480V RMOV BD 3B NC NC NO NO NC NC NO NC NC NC NC NO NO NO NC NC NO NC NC NC NO NO NC XS-N-1 POLE 1A XS-N-2 POLE 6 XS-N-0 POLE 1 XS-S-3 POLE 13 XS-N-3 POLE 16 XS-N-4 POLE 11 NORTH OUTSIDE LOOP NC CABLES LIFTED 1930 1920 SPARE ON 4KV CT SWGR A NO NO NC NO NC NO NC NO NC NO NC NC RECIRC PUMP 1A RECIRC PUMP 2A RECIRC PUMP 2B RECIRC PUMP 3A RECIRC PUMP 3B RECIRC PUMP 1B NC NC NC NC NC NC NC NC NC NC NC NC RECIRC VFD 3A RECIRC VFD 3B RECIRC VFD 2A RECIRC VFD 2B RECIRC VFD 1A RECIRC VFD 1B RPT BD 3-I RPT BD 3-II RPT BD 1-I RPT BD 1-II RPT BD 2-I RPT BD 2-II 1544 1554 1440 1450 1540 1550 1442 1542 1452 1552 1444 1454 TS3B CABLES LIFTED ABANDONED 133 6

NC 1432 NO 1528 NO NC NC NO NC 1532 NO 1218 NC NC NO NO NC NC TS3E NO NO NC NC NO NC 1342 NC 4KV START BUS 1A 4KV START BUS 1B NC NO NO NC NO TC2A TC2B TC1A TC1B 480V CONT BAY VENT BD A BUS A BUS B 480V COM BD 1 TC3A TC3B 480V CONT BAY VENT BD B ALT BUS A BUS B 480V COM BD 2 BUS A BUS B 480V COM BD 3 NC NC ALT NC NC NO NC NC NO NC NC NO 1017 1027 NC NC NOTE: See reference drawings for all loads on a board.

1338 NC NO NO GEN 1

214 NC NO NO 52 57-2 57-1 89 NC 1516 NC 1518 NO 101 102 103 121 132 10 201 202 221 232 203 20 301 302 303 321 332 16 17 14 379 270 260 150 140 370 360 350 340 390 371 372 380 381 391 392 382 393 384 395 394 271 293 282 292 291 281 280 290 270 370 360 260 350 150 340 140 180 190 181 191 192 183 142 ETAP NODE NUMBERS XXX

.2 - Proposed TS Changes (Mark-Ups) for BFN, Units 1, 2, and 3 CNL-17-034 A2.2 - 1

LOP Instrumentation 3.3.8.1 BFN-UNIT 1 3.3-72 Amendment No. 234 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. Required Action and associated Completion Time not met.

E.1 Declare associated diesel generator (DG) inoperable.

Immediately E. One or more unbalanced voltage relays inoperable on one shutdown board.

F F.1 E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip Immediately 5 days

LOP Instrumentation 3.3.8.1 BFN-UNIT 1 3.3-74 Amendment No. 234 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE

1. 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

a. Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V

b. Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

a. Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 1.5V at 3 seconds (Permissive Alarm)

SR 3.3.8.1.3 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

LOP Instrumentation 3.3.8.1 BFN-UNIT 2 3.3-73 Amendment No. 253 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. Required Action and associated Completion Time not met.

E.1 Declare associated diesel generator (DG) inoperable.

Immediately E. One or more unbalanced voltage relays inoperable on one shutdown board.

F F.1 E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip Immediately 5 days

LOP Instrumentation 3.3.8.1 BFN-UNIT 2 3.3-75 Amendment No. 253 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE 1.

4.16 kV Shutdown Board Undervoltage (Loss of Voltage) a.

Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V b.

Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds 2.

4.16 kV Shutdown Board Undervoltage (Degraded Voltage) a.

Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 1.5V at 3 seconds (Permissive Alarm)

SR 3.3.8.1.3 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

LOP Instrumentation 3.3.8.1 BFN-UNIT 3 3.3-73 Amendment No. 213 September 03, 1998 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. Required Action and associated Completion Time not met.

E.1 Declare associated diesel generator (DG) inoperable.

Immediately E. One or more unbalanced voltage relays inoperable on one shutdown board.

E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip Immediately 5 days F

F.1

LOP Instrumentation 3.3.8.1 BFN-UNIT 3 3.3-75 Amendment No. 213 September 03, 1998 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE

1. 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

a. Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V

b. Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

a. Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 1.5V at 3 seconds (Permissive Alarm)

SR 3.3.8.1.3 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

.3 - Proposed TS Bases Changes (Mark-Ups) for BFN, Units 1, 2, and 3 CNL-17-034 A2.3 - 1

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 1 B 3.3-253 Revision 0 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV shutdown boards. Offsite power is the preferred source of power for the 4.16 kV shutdown boards. If the monitors determine that insufficient power is available, the boards are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV shutdown board has its own independent LOP instrumentation and associated trip logic. The voltage for each board is monitored at two levels, which can be considered as two different undervoltage Functions: Loss of Voltage and 4.16 kV Shutdown Board Undervoltage Degraded Voltage.

Each Function causes various board transfers and disconnects.

The Degraded Voltage Function is monitored by three undervoltage relay channels for each shutdown board, whose outputs are arranged in a two-out-of-three logic configuration (Ref. 1). The channels compare measured input signals with pre-established setpoints. When the setpoint is exceeded for two-of-three degraded voltage channels, the logic energizes timers which provides a LOP trip signal to the shutdown board logic.

three three

, Unbalanced Voltage The unbalanced voltage function is monitored by three unbalanced voltage relays (UVRs) for each shutdown board, whose outputs are arranged in a permissive one-out-of-two logic configuration. The UVRs operate on an unbalanced voltage detection signal dependent on the length of time the signal is detected. If the permissive one-out-of-two logic is met, the relays energize aux relays to provide the trip signal to the shutdown board logic. A permissive one-out-of-two trip logic is defined as a trip of the "Alarm" relay and either the "High" or "Low" relay.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 1 B 3.3-257 Revision 0 BASES APPLICABLE

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

SAFETY ANALYSES, LCO, and A reduced voltage condition on a 4.16 kV shutdown board APPLICABILITY indicates that, while offsite power may not be completely lost (continued) to the respective shutdown board, available power maybe insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function.

Therefore, power supply to the board is transferred from offsite power to onsite DG power when the voltage on the board drops below the Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.

The Board Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Three channels of 4.16 kV Shutdown Board Undervoltage (Degraded Voltage) Function per associated board are required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

3. 4.16 kV Shutdown Board Voltage Unbalance (Unbalanced Voltage Relay)

An unbalanced voltage condition on a 4.16kV shutdown board indicates that, while offsite power may not be completely degraded to the board undervoltage level, available power may be insufficient for starting and running ECCS motors without risking damage to the motors that could disable the ECCS function. Therefore, power supply to the board is transferred from offsite power to onsite DG power when the unbalanced voltage level increases above the Unbalanced Voltage Function Allowable Values (unbalanced voltage level with an associated time delay). This ensures adequate power will be available to the required equipment. The Board Unbalanced Voltage Allowable Values are high enough to prevent inadvertent power supply transfer, but low enough to ensure that sufficient power is available to the required equipment. The time delay allowable values are long enough to provide time for the offsite power supply to recover to normal voltage balance, but short enough to ensure power is available to the required equipment.

Three UVRs are provided on each 4.16 kV Shutdown Board for detecting an unbalanced voltage condition. The relays are combined in a permissive one-out-of-two logic configuration to generate a supply breaker trip. Three UVRs are required to be OPERABLE when the associated DG is require to be OPERABLE to ensure that no single instrument failure can preclude a DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 1 B 3.3-259 Revision 0 BASES ACTIONS A.1 and A.2 (continued)

Condition C or D, as applicable, must be entered immediately.

The 15 day allowable out of service time is justified based on the two-out-of-three permissive logic scheme provided for these relays. If the inoperable relay channel cannot be restored to OPERABLE status within the allowable out of service time, the degraded voltage relay channel must be placed in the tripped condition per Required Action A.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

B.1 With two or more degraded voltage relay channels or one or more associated timers inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action B.1 provides a 10 day allowable out of service time provided the loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

The 10 day allowable out of service time is justified since the loss of voltage relay channels on the same shutdown board are independent of the degraded voltage relay channel(s) and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channel(s) cannot F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 1 B 3.3-260 Revision 0 BASES ACTIONS B.1 (continued) be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action B.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

C.1 With one or more loss of voltage relay channels inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action C.1 provides a 10 day allowable out of service time provided two or more degraded voltage relay channels and associated timers on the affected shutdown board(s) are OPERABLE. The 10 day allowable out of service time is justified since the degraded voltage relay channels on the same shutdown board are independent of the loss of voltage relay channels and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channels cannot be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action C.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 1 B 3.3-261 Revision 0 BASES ACTIONS D.1 and D.2 (continued)

With two or more degraded voltage relay channels or one or more associated timers and the loss of voltage relay channel(s) inoperable on the same shutdown board, the associated diesel generator will not automatically start upon degraded voltage or complete loss of voltage on that shutdown board. In this situation, Required Action D.2 provides a 5 day allowable out of service time provided the other shutdown boards and undervoltage relay channels are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and undervoltage relay channels is therefore required (Required Action D.1). This may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition E must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV Shutdown Boards. The 4.16 kV Shutdown Boards have a similar allowable out of service time.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation),

and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F F

Insert E.1 and E2

E.1 and E.2 The Unbalanced Voltage function generates an LOP signal if the permissive alarm relay and either the Low or High relay actuates to the predetermined unbalanced voltage setting. With one or more UVRs inoperable, the associated diesel generator will not automatically start upon an Unbalanced Voltage signal. In this situation, Required Action E.2 provides a 5 day allowable out of service time provided the other shutdown boards and Unbalanced Voltage relays are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and UVRs is required (Required Action E.1). This action may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition F must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV shutdown boards.

The 4.16kV shutdown boards have a similar allowable out of service time. If the inoperable relay cannot be restored to OPERABLE status within the allowable out of service time, the relay must be placed in the tripped condition. Placing the inoperable relay in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the relay in trip (e.g., as in the case where placing the relay in trip would result in a DG initiation), Condition F must be entered and its Required Action taken.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 1 B 3.3-263 Amendment No. 235 November 30, 1998 BASES SURVEILLANCE SR 3.3.8.1.3 REQUIREMENTS (continued)

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience with these components supports performance of the Surveillance at the 24 month Frequency.

REFERENCES

1. FSAR, Figure 8.4-4.

2. FSAR, Section 6.5.

3. FSAR, Section 8.5.4.

4. FSAR, Chapter 14.

5. NRC No.93-102, "Final Policy Statement on Technical Specification Improvements," July 23, 1993.

6. EDQ0000002016000556, "Determination of Unbalance Voltage Relay Analytical Limits."

7. EDQ0009992016000564, "Evaluation of 60Q Voltage Unbalance Relays for Class 1E 4kV Shutdown Boards A, B, C, D, 3EA, 3EB, 3EC, and 3ED."

LOP Instrumentation B 3.3.8.1 BFN-UNIT 1 B 3.3-264 Revision 0 Table B 3.3.8.1-1 (Page 1 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board A (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SA A and 27SA C (27-211-000A/12E & /12F) 27DA A and 27DA C (27-211-000A/12A & /12B) 27-211-1A, 27-211-1B, and 27-211-1C (27-211-000A/23A, /23B, & /23C) 2-211-1A (02-211-0001A) 2-211-2A (02-211-0002A) 2-211-3A (02-211-0003A) 2-211-4A (02-211-0004A) 4.16 kV Shutdown Board B (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SB A and 27SB C (27-211-000B/12E & /12F) 27DB A and 27DB C (27-211-000B/12A & /12B) 27-211-2A, 27-211-2B, and 27-211-2C (27-211-000B/21A, /21B, /21C) 2-211-1B (02-211-0001B) 2-211-2B (02-211-0002B) 2-211-3B (02-211-0003B) 2-211-4B (02-211-0004B) 4.16 kV Shutdown Board C (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SC A and 27SC C (27-211-000C/11E & /11F) 27DC A and 27DC C (27-211-000C/11A & /11B) 27-211-3A, 27-211-3B, and 27-211-3C (27-211-000C/25A, /25B, /25C) 2-211-1C (02-211-0001C) 2-211-2C (02-211-0002C) 2-211-3C (02-211-0003C) 2-211-4C (02-211-0004C)

(Unbalanced Voltage) See next page.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 1 B 3.3-265 Revision 0 Table B 3.3.8.1-1 (Page 2 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board D (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SD A and 27SD C (27-211-000D/11E & /11F) 27DD A and 27DD C (27-211-000D/11A & /11B) 27-211-4A, 27-211-4B, and 27-211-4C (27-211-000D/21A, /21B, /21C) 2-211-1D (02-211-0001D) 2-211-2D (02-211-0002D) 2-211-3D (02-211-0003D) 2-211-4D (02-211-0004D)

(Unbalanced Voltage) See below.

4.16 kV Shutdown Board A (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay RLY-211-60A1 RLY-211-60A2 RLY-211-60A3 RLY-211-A60A1 RLY-211-A60A2 4.16 kV Shutdown Board B (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay RLY-211-60B1 RLY-211-60B2 RLY-211-60B3 RLY-211-A60B1 RLY-211-A60B2 4.16 kV Shutdown Board C (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay RLY-211-60C1 RLY-211-60C2 RLY-211-60C3 RLY-211-A60C1 RLY-211-A60C2 4.16 kV Shutdown Board D (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay RLY-211-60D1 RLY-211-60D2 RLY-211-60D3 RLY-211-A60D1 RLY-211-A60D2

AC Sources - Operating B 3.8.1 (continued)

BFN-UNIT 1 B 3.8-3a Revision 42 November 16, 2006 BASES BACKGROUND sufficient capacity to support the automatic transfer of all Unit 1 (continued) non-safety related loads when there are existing loads aligned to the CSSTs from Units 2 or 3.

This is addressed by manually disabling the automatic transfer of selected 4.16 kV Unit Boards and/or 4.16 kV Common Boards. With the most restrictive manual actions in place, upon a loss of the normal 500 kV offsite circuit coincident with a LOCA, the diesel generators would supply the associated safety-related ESF loads in both divisions needed to mitigate the immediate consequences of a LOCA.

The 161 kV supplied CSSTs can still be credited as part of a qualified alternate offsite circuit for Unit 1. However, access to the 161 kV circuit will require a delayed manual transfer when operators can manually control the loads on the 4.16 kV Start Buses to support long term post accident recovery and shutdown. Operators can restore the de-energized 4.16 kV Unit Boards by manually transferring them to the CSST supplied 4.16 kV Start Buses as desired. The 4.16 kV Shutdown Boards could then be manually transferred from the diesel generators to the CSST supplied 4.16 kV Unit Boards as desired.

The onsite standby power source for 4.16 kV shutdown boards A, B, C, and D consists of four Unit 1 and 2 DGs, each dedicated to a shutdown board. Each DG starts automatically on a LOCA signal (i.e., low reactor water level signal or high drywell pressure signal), or on its respective 4.16 kV shutdown board degraded voltage or undervoltage signal. In addition to starting all diesel generators, the CAS logic trips the alternate feeder breakers to 4.16 kV Shutdown Boards A, B, C, D. After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of 4.16 kV shutdown board undervoltage or degraded voltage, independent of or coincident with a LOCA signal. The DGs also start and operate in the standby mode without tying to the 4.16 kV shutdown board on a LOCA signal alone. Following

, unbalanced voltage

AC Sources - Operating B 3.8.1 (continued)

BFN-UNIT 1 B 3.8-4 Revision 0, 10, 30, 42 47 March 22, 2007 BASES BACKGROUND the trip of offsite power, an under or degraded voltage activated (continued) load shed logic strips all loads from the 4.16 kV Shutdown Board. Feeder breakers to transformers supplying auxiliary power system distribution boards are not load shed on undervoltage. When the DG is tied to the 4.16 kV shutdown board, large loads are then sequentially connected to its respective 4.16 kV shutdown board by individual pump timers.

The individual pump timers control the permissive and starting signals to motor breakers to prevent overloading the DG.

In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading of the DGs in the process. Within 40 seconds after the initiating signal (DG breaker closure with accident signal) is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service.

In the event that the DGs were already running and loaded on the receipt of a spurious or real common accident signal (CAS A/CAS B) from Unit 3, any diesel generator output breakers which are closed are signaled to open to load shed the running loads off of the DG. After the DG breaker closing springs recharge, the DG breakers will reclose and tie the DG to the 4.16 kV shutdown board. Loads are then sequentially connected to its respective 4.16 kV shutdown board by individual pump timers as described above. Any subsequent common accident signal DG breaker trip signals are blocked.

Should a second RHR initiation signal be received (i.e., from a spurious or real accident signal from Unit 1), the Unit 1/2 diesel generator output breakers will be reopened on a unit priority undervoltage, unbalanced voltage

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 2 B 3.3-256 Revision 0 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV shutdown boards. Offsite power is the preferred source of power for the 4.16 kV shutdown boards. If the monitors determine that insufficient power is available, the boards are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV shutdown board has its own independent LOP instrumentation and associated trip logic. The voltage for each board is monitored at two levels, which can be considered as two different undervoltage Functions: Loss of Voltage and 4.16 kV Shutdown Board Undervoltage Degraded Voltage.

Each Function causes various board transfers and disconnects.

The Degraded Voltage Function is monitored by three undervoltage relay channels for each shutdown board, whose outputs are arranged in a two-out-of-three logic configuration (Ref. 1). The channels compare measured input signals with pre-established setpoints. When the setpoint is exceeded for two-of-three degraded voltage channels, the logic energizes timers which provides a LOP trip signal to the shutdown board logic.

three three

, Unbalanced Voltage The unbalanced voltage function is monitored by three unbalanced voltage relays (UVRs) for each shutdown board, whose outputs are arranged in a permissive one-out-of-two logic configuration. The UVRs operate on an unbalanced voltage detection signal dependent on the length of time the signal is detected. If the permissive one-out-of-two logic is met, the relays energize aux relays to provide the trip signal to the shutdown board logic. A permissive one-out-of-two trip logic is defined as a trip of the "Alarm" relay and either the "High" or "Low" relay.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 2 B 3.3-260 Revision 0 BASES APPLICABLE

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

SAFETY ANALYSES, LCO, and A reduced voltage condition on a 4.16 kV shutdown board APPLICABILITY indicates that, while offsite power may not be completely lost (continued) to the respective shutdown board, available power maybe insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function.

Therefore, power supply to the board is transferred from offsite power to onsite DG power when the voltage on the board drops below the Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.

The Board Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Three channels of 4.16 kV Shutdown Board Undervoltage (Degraded Voltage) Function per associated board are required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

3. 4.16 kV Shutdown Board Voltage Unbalance (Unbalanced Voltage Relay)

An unbalanced voltage condition on a 4.16kV shutdown board indicates that, while offsite power may not be completely degraded to the board undervoltage level, available power may be insufficient for starting and running ECCS motors without risking damage to the motors that could disable the ECCS function. Therefore, power supply to the board is transferred from offsite power to onsite DG power when the unbalanced voltage level increases above the Unbalanced Voltage Function Allowable Values (unbalanced voltage level with an associated time delay). This ensures adequate power will be available to the required equipment. The Board Unbalanced Voltage Allowable Values are high enough to prevent inadvertent power supply transfer, but low enough to ensure that sufficient power is available to the required equipment. The time delay allowable values are long enough to provide time for the offsite power supply to recover to normal voltage balance, but short enough to ensure power is available to the required equipment.

Three UVRs are provided on each 4.16 kV Shutdown Board for detecting an unbalanced voltage condition. The relays are combined in a permissive one-out-of-two logic configuration to generate a supply breaker trip. Three UVRs are required to be OPERABLE when the associated DG is require to be OPERABLE to ensure that no single instrument failure can preclude a DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 2 B 3.3-262 Revision 0 BASES ACTIONS A.1 and A.2 (continued)

Condition C or D, as applicable, must be entered immediately.

The 15 day allowable out of service time is justified based on the two-out-of-three permissive logic scheme provided for these relays. If the inoperable relay channel cannot be restored to OPERABLE status within the allowable out of service time, the degraded voltage relay channel must be placed in the tripped condition per Required Action A.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

B.1 With two or more degraded voltage relay channels or one or more associated timers inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action B.1 provides a 10 day allowable out of service time provided the loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

The 10 day allowable out of service time is justified since the loss of voltage relay channels on the same shutdown board are independent of the degraded voltage relay channel(s) and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channel(s) cannot F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 2 B 3.3-263 Revision 0 BASES ACTIONS B.1 (continued) be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action B.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

C.1 With one or more loss of voltage relay channels inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action C.1 provides a 10 day allowable out of service time provided two or more degraded voltage relay channels and associated timers on the affected shutdown board(s) are OPERABLE. The 10 day allowable out of service time is justified since the degraded voltage relay channels on the same shutdown board are independent of the loss of voltage relay channels and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channels cannot be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action C.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 2 B 3.3-264 Revision 0 BASES ACTIONS D.1 and D.2 (continued)

With two or more degraded voltage relay channels or one or more associated timers and the loss of voltage relay channel(s) inoperable on the same shutdown board, the associated diesel generator will not automatically start upon degraded voltage or complete loss of voltage on that shutdown board. In this situation, Required Action D.2 provides a 5 day allowable out of service time provided the other shutdown boards and undervoltage relay channels are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and undervoltage relay channels is therefore required (Required Action D.1). This may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition E must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV Shutdown Boards. The 4.16 kV Shutdown Boards have a similar allowable out of service time.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation),

and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F Insert E.1 and E.2 F

E.1 and E.2 The Unbalanced Voltage function generates an LOP signal if the permissive alarm relay and either the Low or High relay actuates to the predetermined unbalanced voltage setting. With one or more UVRs inoperable, the associated diesel generator will not automatically start upon an Unbalanced Voltage signal. In this situation, Required Action E.2 provides a 5 day allowable out of service time provided the other shutdown boards and Unbalanced Voltage relays are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and UVRs is required (Required Action E.1). This action may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition F must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV shutdown boards.

The 4.16kV shutdown boards have a similar allowable out of service time. If the inoperable relay cannot be restored to OPERABLE status within the allowable out of service time, the relay must be placed in the tripped condition. Placing the inoperable relay in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the relay in trip (e.g., as in the case where placing the relay in trip would result in a DG initiation), Condition F must be entered and its Required Action taken.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 2 B 3.3-266 Amendment No. 255 November 30, 1998 BASES SURVEILLANCE SR 3.3.8.1.3 REQUIREMENTS (continued)

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience with these components supports performance of the Surveillance at the 24 month Frequency.

REFERENCES

1. FSAR, Figure 8.4-4.

2. FSAR, Section 6.5.

3. FSAR, Section 8.5.4.

4. FSAR, Chapter 14.

5. NRC No.93-102, "Final Policy Statement on Technical Specification Improvements," July 23, 1993.

6. EDQ0000002016000556, "Determination of Unbalance Voltage Relay Analytical Limits."

7. EDQ0009992016000564, "Evaluation of 60Q Voltage Unbalance Relays for Class 1E 4kV Shutdown Boards A, B, C, D, 3EA, 3EB, 3EC, and 3ED."

LOP Instrumentation B 3.3.8.1 BFN-UNIT 2 B 3.3-267 Revision 0 Table B 3.3.8.1-1 (Page 1 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board A (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SA A and 27SA C (27-211-000A/12E & /12F) 27DA A and 27DA C (27-211-000A/12A & /12B) 27-211-1A, 27-211-1B, and 27-211-1C (27-211-000A/23A, /23B, & /23C) 2-211-1A (02-211-0001A) 2-211-2A (02-211-0002A) 2-211-3A (02-211-0003A) 2-211-4A (02-211-0004A) 4.16 kV Shutdown Board B (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SB A and 27SB C (27-211-000B/12E & /12F) 27DB A and 27DB C (27-211-000B/12A & /12B) 27-211-2A, 27-211-2B, and 27-211-2C (27-211-000B/21A, /21B, /21C) 2-211-1B (02-211-0001B) 2-211-2B (02-211-0002B) 2-211-3B (02-211-0003B) 2-211-4B (02-211-0004B) 4.16 kV Shutdown Board C (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SC A and 27SC C (27-211-000C/11E & /11F) 27DC A and 27DC C (27-211-000C/11A & /11B) 27-211-3A, 27-211-3B, and 27-211-3C (27-211-000C/25A, /25B, /25C) 2-211-1C (02-211-0001C) 2-211-2C (02-211-0002C) 2-211-3C (02-211-0003C) 2-211-4C (02-211-0004C)

(Unbalanced Voltage) See next page.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 2 B 3.3-268 Revision 0 Table B 3.3.8.1-1 (Page 2 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board D (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27SD A and 27SD C (27-211-000D/11E & /11F) 27DD A and 27DD C (27-211-000D/11A & /11B) 27-211-4A, 27-211-4B, and 27-211-4C (27-211-000D/21A, /21B, /21C) 2-211-1D (02-211-0001D) 2-211-2D (02-211-0002D) 2-211-3D (02-211-0003D) 2-211-4D (02-211-0004D)

(Unbalanced Voltage) See below.

4.16 kV Shutdown Board A (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board B (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board C (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board D (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay RLY-211-60D1 RLY-211-60D2 RLY-211-60D3 RLY-211-A60D1 RLY-211-A60D2 RLY-211-60C1 RLY-211-60C2 RLY-211-60C3 RLY-211-A60C1 RLY-211-A60C2 RLY-211-60B1 RLY-211-60B2 RLY-211-60B3 RLY-211-A60B1 RLY-211-A60B2 RLY-211-60A1 RLY-211-60A2 RLY-211-60A3 RLY-211-A60A1 RLY-211-A60A2

AC Sources - Operating B 3.8.1 (continued)

BFN-UNIT 2 B 3.8-3a Revision 42 November 16, 2006 BASES BACKGROUND sufficient capacity to support the automatic transfer of all Unit 2 (continued) non-safety related loads when there are existing loads aligned to the CSSTs from Units 1 or 3.

This is addressed by manually disabling the automatic transfer of selected 4.16 kV Unit Boards and/or 4.16 kV Common Boards. With the most restrictive manual actions in place, upon a loss of the normal 500 kV offsite circuit coincident with a LOCA, the diesel generators would supply the associated safety-related ESF loads in both divisions needed to mitigate the immediate consequences of a LOCA.

The 161 kV supplied CSSTs can still be credited as part of a qualified alternate offsite circuit for Unit 2. However, access to the 161 kV circuit will require a delayed manual transfer when operators can manually control the loads on the 4.16 kV Start Buses to support long term post accident recovery and shutdown. Operators can restore the de-energized 4.16 kV Unit Boards by manually transferring them to the CSST supplied 4.16 kV Start Buses as desired. The 4.16 kV Shutdown Boards could then be manually transferred from the diesel generators to the CSST supplied 4.16 kV Unit Boards as desired.

The onsite standby power source for 4.16 kV shutdown boards A, B, C, and D consists of four Unit 1 and 2 DGs, each dedicated to a shutdown board. Each DG starts automatically on a LOCA signal (i.e., low reactor water level signal or high drywell pressure signal), or on its respective 4.16 kV shutdown board degraded voltage or undervoltage signal. In addition to starting all diesel generators, the CAS logic trips the alternate feeder breakers to 4.16 kV Shutdown Boards A, B, C, D. After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of 4.16 kV shutdown board undervoltage or degraded voltage, independent of or coincident with a LOCA signal. The DGs also start and operate in the standby mode without tying to the 4.16 kV shutdown board on a LOCA signal alone. Following

, unbalanced voltage

AC Sources - Operating B 3.8.1 (continued)

BFN-UNIT 2 B 3.8-4 Revision 0, 10, 30, 42 47 March 22, 2007 BASES BACKGROUND the trip of offsite power, an under or degraded voltage activated (continued) load shed logic strips all loads from the 4.16 kV Shutdown Board. Feeder breakers to transformers supplying auxiliary power system distribution boards are not load shed on undervoltage. When the DG is tied to the 4.16 kV shutdown board, large loads are then sequentially connected to its respective 4.16 kV shutdown board by individual pump timers.

The individual pump timers control the permissive and starting signals to motor breakers to prevent overloading the DG In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

Certain required plant loads are returned to service in a predetermined sequence in order to prevent overloading of the DGs in the process. Within 40 seconds after the initiating signal (DG breaker closure with accident signal) is received, all automatic and permanently connected loads needed to recover the unit or maintain it in a safe condition are returned to service.

In the event that the DGs were already running and loaded on the receipt of a spurious or real common accident signal (CAS A/CAS B) from Unit 3, any diesel generator output breakers which are closed are signaled to open to load shed the running loads off of the DG. After the DG breaker closing springs recharge, the DG breakers will reclose and tie the DG to the 4.16 kV shutdown board. Loads are then sequentially connected to its respective 4.16 kV shutdown board by individual pump timers as described above. Any subsequent common accident signal DG breaker trip signals are blocked.

Should a second RHR initiation signal be received (i.e., from a spurious or real accident signal from Unit 2), the Unit 1/2 diesel generator output breakers will be reopened on a unit priority undervoltage, unbalanced voltage

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 3 B 3.3-256 Amendment No. 213 September 03, 1998 B 3.3 INSTRUMENTATION B 3.3.8.1 Loss of Power (LOP) Instrumentation BASES BACKGROUND Successful operation of the required safety functions of the Emergency Core Cooling Systems (ECCS) is dependent upon the availability of adequate power sources for energizing the various components such as pump motors, motor operated valves, and the associated control components. The LOP instrumentation monitors the 4.16 kV shutdown boards. Offsite power is the preferred source of power for the 4.16 kV shutdown boards. If the monitors determine that insufficient power is available, the boards are disconnected from the offsite power sources and connected to the onsite diesel generator (DG) power sources.

Each 4.16 kV shutdown board has its own independent LOP instrumentation and associated trip logic. The voltage for each board is monitored at two levels, which can be considered as two different undervoltage Functions: Loss of Voltage and 4.16 kV Shutdown Board Undervoltage Degraded Voltage.

Each Function causes various board transfers and disconnects.

The Degraded Voltage Function is monitored by three undervoltage relay channels for each shutdown board, whose outputs are arranged in a two-out-of-three logic configuration (Ref. 1). The channels compare measured input signals with pre-established setpoints. When the setpoint is exceeded for two-of-three degraded voltage channels, the logic energizes timers which provides a LOP trip signal to the shutdown board logic.

three three

, Unbalanced Voltage The unbalanced voltage function is monitored by three unbalanced voltage relays (UVRs) for each shutdown board, whose outputs are arranged in a permissive one-out-of-two logic configuration. The UVRs operate on an unbalanced voltage detection signal dependent on the length of time the signal is detected. If the permissive one-out-of-two logic is met, the relays energize aux relays to provide the trip signal to the shutdown board logic. A permissive one-out-of-two trip logic is defined as a trip of the "Alarm" relay and either the "High" or "Low" relay.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 3 B 3.3-260 Amendment No. 213 September 03, 1998 BASES APPLICABLE

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

SAFETY ANALYSES, LCO, and A reduced voltage condition on a 4.16 kV shutdown board APPLICABILITY indicates that, while offsite power may not be completely lost (continued) to the respective shutdown board, available power maybe insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function.

Therefore, power supply to the board is transferred from offsite power to onsite DG power when the voltage on the board drops below the Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.

The Board Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Three channels of 4.16 kV Shutdown Board Undervoltage (Degraded Voltage) Function per associated board are required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

3. 4.16 kV Shutdown Board Voltage Unbalance (Unbalanced Voltage Relay)

An unbalanced voltage condition on a 4.16kV shutdown board indicates that, while offsite power may not be completely degraded to the board undervoltage level, available power may be insufficient for starting and running ECCS motors without risking damage to the motors that could disable the ECCS function. Therefore, power supply to the board is transferred from offsite power to onsite DG power when the unbalanced voltage level increases above the Unbalanced Voltage Function Allowable Values (unbalanced voltage level with an associated time delay). This ensures adequate power will be available to the required equipment. The Board Unbalanced Voltage Allowable Values are high enough to prevent inadvertent power supply transfer, but low enough to ensure that sufficient power is available to the required equipment. The time delay allowable values are long enough to provide time for the offsite power supply to recover to normal voltage balance, but short enough to ensure power is available to the required equipment.

Three UVRs are provided on each 4.16 kV Shutdown Board for detecting an unbalanced voltage condition. The relays are combined in a permissive one-out-of-two logic configuration to generate a supply breaker trip. Three UVRs are required to be OPERABLE when the associated DG is require to be OPERABLE to ensure that no single instrument failure can preclude a DG function. Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 3 B 3.3-262 Amendment No. 213 September 03, 1998 BASES ACTIONS A.1 and A.2 (continued)

Condition C or D, as applicable, must be entered immediately.

The 15 day allowable out of service time is justified based on the two-out-of-three permissive logic scheme provided for these relays. If the inoperable relay channel cannot be restored to OPERABLE status within the allowable out of service time, the degraded voltage relay channel must be placed in the tripped condition per Required Action A.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

B.1 With two or more degraded voltage relay channels or one or more associated timers inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action B.1 provides a 10 day allowable out of service time provided the loss of voltage relay channels on the affected shutdown board(s) are OPERABLE.

The 10 day allowable out of service time is justified since the loss of voltage relay channels on the same shutdown board are independent of the degraded voltage relay channel(s) and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channel(s) cannot F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 3 B 3.3-263 Amendment No. 213 September 03, 1998 BASES ACTIONS B.1 (continued) be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action B.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

C.1 With one or more loss of voltage relay channels inoperable on one or more shutdown boards, the Function is not capable of performing the intended function. Required Action C.1 provides a 10 day allowable out of service time provided two or more degraded voltage relay channels and associated timers on the affected shutdown board(s) are OPERABLE. The 10 day allowable out of service time is justified since the degraded voltage relay channels on the same shutdown board are independent of the loss of voltage relay channels and will continue to function and start the diesel generators on a complete loss of voltage. If the inoperable channels cannot be restored to OPERABLE status within the allowable out of service time, the channel(s) must be placed in the tripped condition per Required Action C.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the channel(s) in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F F

LOP Instrumentation B 3.3.8.1 (continued)

BFN-UNIT 3 B 3.3-264 Amendment No. 213 September 03, 1998 BASES ACTIONS D.1 and D.2 (continued)

With two or more degraded voltage relay channels or one or more associated timers and the loss of voltage relay channel(s) inoperable on the same shutdown board, the associated diesel generator will not automatically start upon degraded voltage or complete loss of voltage on that shutdown board. In this situation, Required Action D.2 provides a 5 day allowable out of service time provided the other shutdown boards and undervoltage relay channels are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and undervoltage relay channels is therefore required (Required Action D.1). This may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition E must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV Shutdown Boards. The 4.16 kV Shutdown Boards have a similar allowable out of service time.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation),

and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the channel in trip would result in a DG initiation), Condition E must be entered and its Required Action taken.

F Insert E.1 and E.2 F

E.1 and E.2 The Unbalanced Voltage function generates an LOP signal if the permissive alarm relay and either the Low or High relay actuates to the predetermined unbalanced voltage setting. With one or more UVRs inoperable, the associated diesel generator will not automatically start upon an Unbalanced Voltage signal. In this situation, Required Action E.2 provides a 5 day allowable out of service time provided the other shutdown boards and Unbalanced Voltage relays are OPERABLE. Immediate verification of the OPERABILITY of the other shutdown boards and UVRs is required (Required Action E.1). This action may be performed as an administrative check by examining logs or other information to determine if this equipment is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of this equipment. If the OPERABILITY of this equipment cannot be verified, however, Condition F must be entered immediately. The 5 day allowable out of service time is justified based on the remaining redundancy of the 4.16 kV shutdown boards.

The 4.16kV shutdown boards have a similar allowable out of service time. If the inoperable relay cannot be restored to OPERABLE status within the allowable out of service time, the relay must be placed in the tripped condition. Placing the inoperable relay in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure (within the LOP instrumentation), and allow operation to continue. Alternately, if it is not desired to place the relay in trip (e.g., as in the case where placing the relay in trip would result in a DG initiation), Condition F must be entered and its Required Action taken.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 3 B 3.3-266 Amendment No. 215 November 30, 1998 BASES SURVEILLANCE SR 3.3.8.1.3 REQUIREMENTS (continued)

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience with these components supports performance of the Surveillance of the 24 month Frequency.

REFERENCES

1. FSAR, Figure 8.4-4.

2. FSAR, Section 6.5.

3. FSAR, Section 8.5.4.

4. FSAR, Chapter 14.

5. NRC No.93-102, "Final Policy Statement on Technical Specification Improvements," July 23, 1993.

6. EDQ0000002016000556, "Determination of Unbalance Voltage Relay Analytical Limits."

7. EDQ0009992016000564, "Evaluation of 60Q Voltage Unbalance Relays for Class 1E 4kV Shutdown Boards A, B, C, D, 3EA, 3EB, 3EC, and 3ED."

LOP Instrumentation B 3.3.8.1 BFN-UNIT 3 B 3.3-267 Amendment No. 213 September 03, 1998 Table B 3.3.8.1-1 (Page 1 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board 3EA (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27S3A A and 27S3A C (27-211-03EA/08E & /08F) 27D3A A and 27D3A C (27-211-03EA/08A & 08B) 27-211-1A3, 27-211-1B3, and 27-211-1C3 (27-211-03EA/03A, /03B, & /03C) 2-211-1A3 (02-211-03EA/03A) 2-211-2A3 (02-211-03EA/03B) 2-211-3A3 (02-211-03EA/03C) 2-211-4A3 (02-211-03EA/03D) 4.16 kV Shutdown Board 3EB (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27S3B A and 27S3B C (27-211-03EB/07E & /07F) 27D3B A and 27D3B C (27-211-03EB/07A & /07B) 27-211-2A3, 27-211-2B3, and 27-211-2C3 (27-211-03EB/12A, /12B, & /12C) 2-211-1B3 (02-211-03EB/12A) 2-211-2B3 (02-211-03EB/12B) 2-211-3B3 (02-211-03EB/12C) 2-211-4B3 (02-211-03EB/12D) 4.16 kV Shutdown Board 3EC (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27S3C A and 27S3C C (27-211-03EC/11E & /11F) 27D3C A and 27D3C C (27-211-03EC/11A & /11B) 27-211-3A3, 27-211-3B3, and 27-211-3C3 (27-211-03EC/05A, /05B, & /05C) 2-211-1C3 (02-211-03EC/05A) 2-211-2C3 (02-211-03EC/05B) 2-211-3C3 (02-211-03EC/05C) 2-211-4C3 (02-211-03EC/05D)

(Unbalanced Voltage) See next page.

LOP Instrumentation B 3.3.8.1 BFN-UNIT 3 B 3.3-268 Amendment No. 213 September 03, 1998 Table B 3.3.8.1-1 (Page 2 of 2)

Loss of Power Instrumentation Channel Device Identification BOARD AND FUNCTIONS CHANNEL DEVICES (UNIDs) 4.16 kV Shutdown Board 3ED (Loss of Voltage) 1.a Board Undervoltage - Board Load Shedding 1.b Board Undervoltage - Diesel Start Time Delay (Degraded Voltage) 2.a Board Undervoltage 2.b.1 Initial Diesel Start and Load Shedding Time Delay 2.b.2 Diesel Start Time Delay 2.b.3 Board Load Shedding Time Delay 2.b.4 Diesel Generator Breaker Closure Time Delay 27S3D A and 27S3D C (27-211-03ED/09E & /09F) 27D3D A and 27D3D C (27-211-03ED/09A & /09B) 27-211-4A3, 27-211-4B3, and 27-211-4C3 (27-211-03ED/03A, /03B, & /03C) 2-211-1D3 (02-211-03ED/03A) 2-211-2D3 (02-211-03ED/03B) 2-211-3D3 (02-211-03ED/03C) 2-211-4D3 (02-211-03ED/03D)

(Unbalanced Voltage) See below.

4.16 kV Shutdown Board 3EA (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board 3EB (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board 3EC (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 4.16 kV Shutdown Board 3ED (Unbalanced Voltage) 3.a Board Voltage Unbalance - Board Load Shedding 3.b Board Voltage Unbalance - Diesel Start Time Delay 3-RLY-211-603ED1 3-RLY-211-603ED2 3-RLY-211-603ED3 3-RLY-211-A603ED1 3-RLY-211-A603ED2 3-RLY-211-603EC1 3-RLY-211-603EC2 3-RLY-211-603EC3 3-RLY-211-A603EC1 3-RLY-211-A603EC2 3-RLY-211-603EB1 3-RLY-211-603EB2 3-RLY-211-603EB3 3-RLY-211-A603EB1 3-RLY-211-A603EB2 3-RLY-211-603EA1 3-RLY-211-603EA2 3-RLY-211-603EA3 3-RLY-211-A603EA1 3-RLY-211-A603EA2

AC Sources - Operating B 3.8.1 (continued)

BFN-UNIT 3 B 3.8-3 Revision 0 BASES BACKGROUND The onsite standby power source for 4.16 kV shutdown boards (continued) 3EA, 3EB, 3EC, and 3ED consists of four Unit 3 DGs, each dedicated to a shutdown board. Each DG starts automatically on a loss of coolant accident (LOCA) signal (i.e., low reactor water level signal or high drywell pressure signal), or on its respective 4.16 kV shutdown board degraded voltage or undervoltage signal. Common Accident Signal Logic (CAS A/CAS B) actuates on high drywell pressure with low reactor pressure, or low water level.

After the DG has started, it automatically ties to its respective bus after offsite power is tripped as a consequence of 4.16 kV shutdown board undervoltage or degraded voltage, independent of or coincident with a LOCA signal. The DGs also start and operate in the standby mode without tying to the 4.16 kV shutdown board on a LOCA signal alone. Following the trip of offsite power, an under or degraded voltage activated load shed logic strips all loads from the 4.16 kV Shutdown Board except transformer feeds. When the DG is tied to the 4.16 kV shutdown board, large loads are then sequentially connected to its respective 4.16 kV shutdown board by individual pump timers. The individual pump timers control the permissive and starting signals to motor breakers to prevent overloading the DG.

In the event of a loss of offsite power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

, unbalanced voltage

, unbalanced voltage undervoltage, unbalanced voltage

.4 - Proposed TS Changes (Clean) for BFN, Units 1, 2, and 3 CNL-17-034 A2.4 - 1

LOP Instrumentation 3.3.8.1 BFN-UNIT 1 3.3-72 Amendment No. 234, 000 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. One or more unbalanced voltage relays inoperable on one shutdown board.

E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip.

Immediately 5 days F. Required Action and associated Completion Time not met.

F.1 Declare associated diesel generator (DG) inoperable.

Immediately

LOP Instrumentation 3.3.8.1 BFN-UNIT 1 3.3-74 Amendment No. 234, 000 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE

1. 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

a. Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V

b. Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

a. Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16 kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 SR 3.3.8.1.3 1.5V at 3 seconds (Permissive Alarm) 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

LOP Instrumentation 3.3.8.1 BFN-UNIT 2 3.3-73 Amendment No. 253, 000 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. One or more unbalanced voltage relays inoperable on one shutdown board.

E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip.

Immediately 5 days F. Required Action and associated Completion Time not met.

F.1 Declare associated diesel generator (DG) inoperable.

Immediately

LOP Instrumentation 3.3.8.1 BFN-UNIT 2 3.3-75 Amendment No. 253, 000 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE

1. 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

a. Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V

b. Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

a. Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16 kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 SR 3.3.8.1.3 1.5V at 3 seconds (Permissive Alarm) 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

LOP Instrumentation 3.3.8.1 BFN-UNIT 3 3.3-73 Amendment No. 213, 000 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Two or more degraded voltage relay channels or one or more associated timers inoperable on one shutdown board.

AND The loss of voltage relay channel(s) inoperable on the same shutdown board.

D.1 Verify by administrative means that the other shutdown boards and undervoltage relay channels and associated timers are OPERABLE.

AND D.2 Place the inoperable channels in trip.

Immediately 5 days E. One or more unbalanced voltage relays inoperable on one shutdown board.

E.1 Verify by administrative means that the other shutdown boards and unbalanced voltage relays are OPERABLE.

AND E.2 Place the inoperable channels in trip.

Immediately 5 days F. Required Action and associated Completion Time not met.

F.1 Declare associated diesel generator (DG) inoperable.

Immediately

LOP Instrumentation 3.3.8.1 BFN-UNIT 3 3.3-75 Amendment No. 213, 000 Table 3.3.8.1-1 (page 1 of 1)

Loss of Power Instrumentation FUNCTION REQUIRED CHANNELS PER BOARD SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE

1. 4.16 kV Shutdown Board Undervoltage (Loss of Voltage)

a. Board Undervoltage 2

SR 3.3.8.1.2 SR 3.3.8.1.3 Reset at 2813 V and 2927 V

b. Diesel Start Initiation Time Delay 2

SR 3.3.8.1.2 SR 3.3.8.1.3 1.4 seconds and 1.6 seconds

2. 4.16 kV Shutdown Board Undervoltage (Degraded Voltage)

a. Board Undervoltage 3

SR 3.3.8.1.1 SR 3.3.8.1.3 3900 V and 3940 V b.1 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.2 seconds and 0.4 seconds b.2 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 3 seconds and 5 seconds b.3 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 5.15 seconds and 8.65 seconds b.4 Time Delay 1

SR 3.3.8.1.2 SR 3.3.8.1.3 0.9 seconds and 1.7 seconds

3. 4.16 kV Shutdown Board Undervoltage (Unbalanced Voltage Relay) 3 SR 3.3.8.1.2 SR 3.3.8.1.3 1.5V at 3 seconds (Permissive Alarm) 3.4V at 8.65 seconds (Lo) 20V at 3.5 seconds (High)

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 1 Per BFN UFSAR Section 8.4.1:

The plant electric power system consists of the main generators, the main step-up transformers, the unit station service transformers (USSTs), the common station service transformers (CSSTs), the cooling tower transformers (CTTs), the batteries, and the electric distribution system as shown on existing UFSAR Figures 8.4-1a, 8.4-1b, and 8.4-2. Under normal plant operating conditions, the main generators supply electrical power through isolated-phase buses to the main step-up transformers and the unit station service transformers which are physically located adjacent to the Turbine Building. The primaries of the unit station service transformers are connected to the isolated-phase bus at a point between the load side of the generator breaker terminals and the low-voltage connection of the main transformers. The generator breaker is used to isolate the main generator from the 500-kV system and the Normal Auxiliary Power System during startup and shutdown.

During normal operation, station auxiliary power is taken from the main generator through the unit station service transformers. During startup and shutdown, auxiliary power is supplied from the 500-kV system through the main transformers to the unit station service transformer with the main generators isolated by the main generator breakers. Auxiliary power is also available through the two common station service transformers (CSSTs) which are fed from the 161-kV system. Standby (onsite) power is supplied by eight diesel generator units (four for Units 1 and 2, and four for Unit 3).

Automatic high-speed transfers of the 4-kV unit boards to the CSST supplied 4-kV start buses are initiated by the generator or switchyard breaker failure relaying, USST protective relaying, main transformer protective relaying, or generator backup protection relaying. Automatic delayed under voltage transfer of the 4-kV unit boards (except for 1A, 1B, 2A, and 2B) to the CSST supplied 4-kV start buses are initiated by time delay voltage relays. The automatic delayed under voltage transfer of 4-kV unit boards 1A, 1B, 2A, and 2B has been disabled.

In the event of a main generator trip during normal operation, the generator breaker opens and auxiliary power is supplied from the 500-kV system through the main transformer. Failure of a preferred offsite circuit from the 500-kV switchyard for Unit 1 or 2 brings about an automatic transfer for both safety-and non-safety-related buses. The non-safety-related buses will be automatically transferred to the CSSTs. The 4-kV shutdown buses for Units 1 and 2 transfer to the alternate units' 4-kV unit boards supplied from the opposite units unit station service transformers (USSTs) if voltage is available. If this supply is not available, only the safety-related 4-kV shutdown boards (Class 1E system) are automatically transferred to the standby onsite electric power sources.

The offsite power circuits through the CSSTs have sufficient capacity to support the automatic transfer of the Unit 1 or 2 non-safety-related loads when there are no loads from the other units already aligned to the 4-kV start buses. However, the CSST powered 4-kV start buses do not have sufficient capacity to also support the automatic transfer of the Unit 1 or 2 safety-related loads. Therefore, during plant conditions where the alternate 500-kV offsite circuit from the alternate supply 4-kV unit board is not available to power the 4-kV shutdown bus, the automatic transfer of the normal supply 4-kV unit board to the 4-kV start bus is disabled by operator action to prevent overloading the 4-kV start buses.

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 2 If there are loads pre-aligned to the 4-kV start buses from the other units, the offsite power circuits through the CSSTs do not have sufficient capacity to support the automatic transfer of the Unit 1 or 2 non-safety-related loads. Similarly, if a CSST was out of service, the automatic transfer of the Unit 1 or 2 non-safety-related loads would over load the remaining in-service CSST. This is addressed by manually disabling the automatic transfer of selected 4-kV unit boards and/or 4-kV common boards to the 4-kV start buses.

With the most limiting actions in place, upon a loss of the normal 500-kV offsite circuit coincident with a LOCA, the affected non-safety-related 4-kV unit boards would be de-energized. The 4-kV shutdown boards would automatically load onto the diesel generators and would supply the safety-related loads needed to mitigate the consequences of the LOCA.

Because the Unit 1 or 2 safety-related loads are not allowed to automatically transfer to the CSSTs, the 161-kV offsite circuits via the CSSTs are not available to mitigate the immediate consequences of a LOCA on Unit 1 or 2. The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuits for Unit 1 or 2. However, access to the alternate 161-kV offsite circuits will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown. To support long term post accident recovery and shutdown of the non-accident units, operators can restore the de-energized 4-kV unit boards by manually transferring them to the CSST supplied 4-kV start buses as desired.

The 4-kV shutdown boards could then be manually transferred from the diesel generators to the CSST supplied 4-kV unit boards as loads will allow.

Concerning Unit 3, failure of the preferred offsite circuit from the 500-kV switchyard to the main power transformer brings about an automatic transfer of the 4-kV unit boards with their connected shutdown boards to the CSSTs. If this supply is unavailable, the safety-related 4-kV shutdown boards are automatically transferred to the standby (onsite) electric power sources. For Unit 3, the 161-kV offsite circuits via the CSSTs are the only alternate offsite sources.

The CSSTs are sized to accommodate all required safety-related and non-safety-related loads on receipt of an accident signal on Unit 3 when there are no loads from the other units already aligned to the 4-kV start buses. However, if there are loads pre-aligned to the 4-kV start buses from the other units, the offsite power circuits through the CSSTs do not have sufficient capacity to support the automatic transfer of the Unit 3 non-safety and safety-related loads. Similarly, if a CSST was out of service, the automatic transfer of the Unit 3 non-safety and safety-related loads would over load the remaining in-service CSST. This is addressed by manually disabling the automatic transfer of selected 4-kV unit boards and/or 4-kV common boards.

With the most limiting actions in place, upon a loss of the normal 500-kV offsite circuit coincident with a LOCA, the affected non-safety-related 4-kV unit boards would be de-energized. The 4-kV shutdown boards would automatically load onto the diesel generators and would supply the safety-related loads needed to mitigate the consequences of the LOCA.

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 3 The 161-kV supplied CSSTs can still be credited as qualified alternate offsite circuits for Unit 3. However, access to the alternate 161-kV offsite circuits will require a delayed manual transfer when operators can manually control the loads on the 4-kV start buses to support long term post accident recovery and shutdown. To support long term post accident recovery and shutdown of the non-accident units, operators can restore the de-energized 4-kV unit boards by manually transferring them to the CSST supplied 4-kV start buses as desired. The 4-kV shutdown boards could then be manually transferred from the diesel generators to the CSST supplied 4-kV unit boards as loads will allow.

Per BFN UFSAR, Section 8.4.2 Axillary Power System Objective. The basic function of the normal auxiliary electrical power system is to provide power for plant auxiliaries during startup, operation, and shutdown, and to provide highly reliable power sources for plant loads which are important to its safety. The Normal Auxiliary Power System is to furnish power to start up and operate all the station auxiliary loads necessary for plant operation, and to furnish normal and alternate sources of power for safe shutdown. The emergency sources of power for safe shutdown will be provided by the standby (onsite) diesel generators in the Standby Auxiliary Power System.

Per BFN UFSAR, Sections 8.4.3 and 8.4.4:

8.4.3 Power Generation Design Basis

1. The Normal Auxiliary Power System shall be designed to furnish adequate sources and distribution of power to station auxiliaries required for the normal station power-producing function, and for the station common functions necessary to support plant operation in a safe and efficient manner.

2. Two preferred offsite power circuits, and standby (onsite) power sources shall be available to serve these loads when required.

3. The system shall have a high degree of reliability.

8.4.4 Safety Design Basis

1. The normal auxiliary power system shall be designed to provide sufficient normal and alternate offsite power circuits to ensure a capability for prompt shutdown and continued maintenance of the plant in a safe condition.

2. The offsite power circuits and standby auxiliary power sources shall be sufficient in number and of such electrical and physical independence that no single event, as a minimum requirement, can negate all auxiliary power at one time.

3. The normal and alternate offsite power circuits for each unit shall each be sufficient to supply the power to shut down the unit and maintain it in a safe condition under normal or accident situations. One of these circuits shall be available within a few seconds following a loss of coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained. The other circuit shall be available in sufficient time to assure that plant safety design limits are not exceeded.

Only one unit is assumed to be in an accident condition.

4. The buses shall be arranged so that essential loads can be easily transferred to the standby onsite diesel generators.

5. Buses and service components shall be physically separated to limit or localize the consequences of electrical faults or mechanical accidents occurring at any point in the system.

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 4 Per BFN UFSAR, Section 8.4.8:

8.4.8.1 Upper and Lower Degraded Voltage Sensing Systems In response to 1977 NRC Guidelines Position 1 - Second Level of Under or Over Voltage Protection with a Time Delay, both upper and lower degraded voltage relaying systems have been installed on each 4-kV shutdown board. The 4-kV shutdown board A degraded voltage scheme, along with associated voltage monitoring relays, is shown on Figure 8.4-4. The degraded voltage relaying of the remaining seven (7) shutdown boards is identical to that of shutdown board A. Setpoints mentioned in Section 8.4.8 are nominal values.

8.4.8.1.2 Undervoltage Sensing System Refer to Figure 8.4-4. The three (3) lower degraded voltage relays sense each of the three (3) phase-to-phase voltages on the shutdown board potential transformer secondaries. If two (2) of the three (3) relays sense a shutdown board voltage below their setpoint (3920-V), approximately 0.3 seconds, time delay relay will initiate timing.

Should a degraded voltage exist for approximately 4 seconds, the diesel generator will start.

Two other methods for starting the diesel generator are as follows:

a. For a loss of shutdown board voltage of greater than 1.5 seconds, relays will drop out and start the diesel generator. This transfer from offsite power to diesel generator power will not occur if voltage recovers to the reset setpoint (2870-V) within 1.5 seconds.

b. An accident signal (low reactor vessel water level or high drywell pressure coincident with low reactor pressure) or a pre-accident signal (low reactor vessel water level or high drywell pressure) for either Unit 1, 2, or 3 starts all eight diesel generator units with no time delay.

Should a degraded voltage exist for 6.9 seconds, time delay relays will pickup and initiate shutdown board A power system isolation, load shedding, and eventual closing of the diesel generator breaker when the diesel is up to normal speed and voltage. This initiation is inhibited if either diesel generator breaker 1818 or intertie breaker 1824 is closed. The closing of either of these breakers is referred to as "diesel generator voltage available signal" in Figure 8.5-4a. Time delay pickup relay (set at 1.3 seconds), allows time for shutdown board power system isolation and subsequent voltage decay before the diesel generator breaker 1818 close signal is issued.

For a sustained degraded voltage the diesel generator start signal is issued at approximately 4 seconds; the shutdown board power system isolation and load shedding signal is issued at approximately 6.9 seconds; and the diesel generator breaker 1818 close signal is issued at approximately 8.2 seconds. The setpoints of the timers has been determined by analysis and includes, among other attributes, 5 percent repeatability.

For a loss of 4-kV shutdown board A voltage, the diesel generator breaker 1818 close signal is issued immediately provided the diesel generator is up to normal speed and voltage, shutdown board A power system isolation and load shedding has been initiated,

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 5 and breakers 1716, 1614, and 1824 are tripped. This initiation is inhibited if there is an accident signal from any unit and either breaker 1818 or 1824 is closed.

Loss of voltage relays can initiate diesel generator start, shutdown board A power system isolation, load shedding, and connection of the diesel generator independent of the degraded voltage sensing system. Except for diesel generator start, this initiation is inhibited for an accident signal in conjunction with either diesel generator breaker 1818 or intertie breaker 1824 being closed.

8.4.8.1.3 Degraded Voltage Sensing System Conformance to NRC Requirements (Maintained for Historical Reference)

The degraded voltage sensing system design requirements are given in 1977 NRC Guidelines Position 1 - Second Level of Under or Over Voltage Protection with a Time Delay; sections (a), (b), (c), (d), and (e).

Section(a) Requirements are as follows:

a. The selection of voltage and time set points shall be determined from an analysis of the voltage requirements of the safety-related loads at all onsite systems distribution levels.

Response

The results of the original analysis performed in response to section (a) is presented in FSAR Section 8.4.8.1.4. To support the restart of Units 1, 2, and 3, another voltage drop analysis has been performed. This new analysis specifies transformer tap settings which ensure that voltage levels at the 4160V and 480V buses are adequate without transfer to onsite (diesel) power under normal operating, accident, and refueling conditions, with maximum and minimum voltage levels at the 500 kV and 161 kV buses.

Section b) Requirements as follows:

b. The voltage protection shall include coincidence logic to preclude spurious trips of the offsite power source.

Response

The relay logic for each shutdown board is arranged in a two-out-of-three logic scheme, thereby satisfying this criterion.

Section c) Requirements are as follows:

c. The time delay selected shall be based on the following conditions:

1. The allowable time delay, including margin, shall not exceed the maximum time delay that is assumed in the FSAR accident analysis,

2. The time delay shall minimize the effect of short duration disturbances from reducing the availability of the offsite power source(s), and

3. The allowable time duration of a degraded voltage condition at all distribution system levels shall not result in failure of safety systems or components.

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 6

Response

The diesel generators and their operational sequence of core standby cooling systems is analyzed in FSAR Section 6.5 to ensure that the maximum time delay that is assumed in the accident analysis is not exceeded. The shutdown board voltage dips below the lower degraded voltage setpoint (3920-V) for less than three seconds during the start of its largest motor (RHR), therefore a 4 second lower degraded voltage time delay prior to issuing the diesel generator start signal will minimize the effects of short duration disturbances.

The effects of short term degraded voltage on downstream electrical equipment have been analyzed and will not result in failure of safety systems and components.

Section d) Requirement is as follows:

d. The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded.

Response

This is the case of our design, refer to Figure 8.4-4.

Section e) Requirement is as follows:

e. The voltage relays are designed to satisfy the requirements of IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations."

Response

How the voltage relays satisfy the requirements of IEEE-279-1971 is discussed as follows:

Requirements of IEEE-279-1971 Seismic and Environmental Qualifications The voltage relays will be operable under seismic conditions.

a. These relays have been seismically qualified to a more severe seismic level at the other plants than that required for the Browns Ferry Nuclear Plant.

b. The associated time delay relays are seismically qualified for these specific applications by combinations of seismic and circuit analyses. The analysis compared the most severe seismic requirement imposed on the relay at its mounting locations with the relay seismic capability established by vendor supplied test data.

c. All equipment is located above probable maximum flood level. Monitors are mounted inside switchgear and are designed to operate under accident conditions.

Class 1E Qualifications All equipment is Class 1E. The relays are arranged in a two-out-of-three logic for each voltage condition; therefore, the failure of a single voltage monitor will not cause spurious system operation or cause the system to be inoperative. All voltage relays will

.5 - Excerpts from BFN UFSAR CNL-17-034 A2.5 - 7 be mounted in the shutdown system switchgear which is of compatible classifications.

Time delay relays are located in 4kV logic panels for Units 1 and 2 and in the shutdown system switchgear for Unit 3. 4kV logic panels have compatible classification.

Independence Overvoltage relays and undervoltage relays are independent of each other. These conditions apply to each of the four shutdown boards associated with Units 1 and 2, and also to each of the four boards for Unit 3.

Redundancy of Equipment and Controls Each 4-kV shutdown board is supplied with three overvoltage and three undervoltage monitors. Each system of three monitors is connected so that a single failure will not result in the loss of the appropriate tripping function.

Reliability of Components Components used to monitor degraded grid voltage conditions have been selected to ensure voltage monitored system operation. These components comply with the quality control and quality assurance requirements as set forth in 10 CFR Part 50.

Testability The voltage monitors in each 4-kV shutdown board have the capability of being tested during normal operation. Provisions are made for periodic testing of voltage monitors and timing relays.

.1 - SQN Electrical Distribution System Diagram CNL-17-034 A3.1 - 1

1716NO NO 1A-A NC NC 1A2-A NC NC 480V SD BD 1A2-A 480V SD BD 1A1-A NO 1A1-A NC NC NC NC NC NC NC NO NO NC C&A VENT BD 1A1-A NO NC NC NO NC NO NC NO NC NO DSL AUX BD 1A1-A DSL AUX BD 1A2-A C&A VENT BD 1A2-A RMOV BD 1A2-A R VENT BD 1A-A 1718 NC 6.9KV SD BD 1A-A 1912NO DG 1A-A NO NC 1B-B NC NC 1B2-B NC 480V SD BD 1B2-B 480V SD BD 1B1-B NO 1B1-B NC NO NC NC NC NC NC NC NO NC C&A VENT BD 1B1-B NO NC NC NO NC NO NC NO NC NO DSL AUX BD 1B1-B DSL AUX BD 1B2-B C&A VENT BD 1B2-B RMOV BD 1B2-B R VENT BD 1B-B 1914 NO 1728 NO DG 1B-B NC RMOV BD 1B1-B NO 2A-A NC NC 2A2-A NC NC 480V SD BD 2A2-A 480V SD BD 2A1-A NO 2A1-A NC NC NC NC NC NC NC NO NO NC C&A VENT BD 2A1-A NO NC NC NO NC NO NC NO NC NO DSL AUX BD 2A1-A DSL AUX BD 2A2-A C&A VENT BD 2A2-A RMOV BD 2A2-A R VENT BD 2A-A 1818NC 6.9KV SD BD 2A-A 1922 1816 NO DG 2A-A 1828 NO NO 2B-B NC NC 2B2-B NC NC 480V SD BD 2B2-B 480V SD BD 2B1-B NO 2B1-B NC NO NC NC NC NC NC NC NC NO NC NO C&A VENT BD 2B1-B NO NC NC NO NC NC NO NC NO NC NO DSL AUX BD 2B1-B DSL AUX BD 2B2-B C&A VENT BD 2B2-B RMOV BD 2B2-B VPS IV R VENT BD 2B-B 1826 NC 6.9KV SD BD 2B-B 1924 NO NC RMOV BD 2A1-A RMOV BD 1A1-A NC 1726 NC NO NC NC NC NC NC NC NC NC X

Y NC NC 1514 1512 CSST A 1626 NC GENERATOR 2 1224 NC 6.9KV UNIT BD 2D 1222 NC 6.9KV UNIT BD 2C 1634 NO 1214 NC 1534 NO 1532 NO 1212 NC 6.9KV UNIT BD 2A 1632 NO MAIN 2 NC NC NC 1822 1814 START BUS 1A START BUS 1B 1126 NO GENERATOR 1 1112 NC 6.9KV UNIT BD 1A 1114 NC 6.9KV UNIT BD 1B 1522 NO 1122 NC 1622 NO 1526 NC 6.9KV UNIT BD 1C 1124 NC 6.9KV UNIT BD 1D 1524 NO MAIN 1 NC NC NC 1714 1722 1B START BUS 2B START BUS 2A X

Y NO NO NO NO 1412 1614 1612 1416 CSST B 1216 NO 1624 NO 480V UNIT BD 2B NC 480V UNIT BD 1A NC NC 1A 6.9KV COMMON BD B NC 480V UNIT BD 2A NC 2A 480V UNIT BD 1B NC 2B VPS III VPS IV VPS III VPS II VPS I VPS II VPS I A

B C

D E

F G

H I

1 2

3 4

5 6

7 8

9 1

2 3

4 5

6 7

8 9

10 10 DG 2B-B 6.9KV COMMON BD A NO NC NO NC NO NC 6.9KV SD BD 1B-B Sequoyah Nuclear Plant Electrical Distribution System 480V-500KV 6.9KV UNIT BD 2B CAD MAINTAINED DRAWING Engineer: Mark D. Bowman Reference Drawings LEGEND SAFETY RELATED - TRAIN A SAFETY RELATED - TRAIN B OFFSITE POWER CKT 1 OFFSITE POWER CKT 2 NON-SAFETY B.O.P.

4 8-7-2015 SQN Electrical Distribution System DATE FILE NAME REVISION LEVEL INFORMATION ONLY NC ERCW 2B-B NC NO ERCW MCC 2B-B ERCW MCC 1B-B 1824 NO NC 1712 1812 480V UNIT BD UTILITY BUS 1724 X

Y NC NC 1414 1418 CSST C 915 984 983 917 918 919 985 989 887 888 889 897 898 899 907 908 909 994 993 995 997 998 999 924 923 925 927 928 929 934 933 935 920 938 939 1004 1003 1009 877 878 879 161 KV BUS 2 990 20 19 18 13 12 910 11 10 9

8 7

937 MOCCASIN 975 979 954 953 955 959 17 16 15 14 HIWASSEE 2 EAST CLEVELAND VW CHATTANOOGA 944 943 945 947 948 949 964 963 965 969 974 973 CONCORD WATTS BAR HYDRO CHICKAMAUGA 1 HIWASSEE 1 1005 940 1032 1012 CAP BANK 3 84 MVR CAP BANK 1 84 MVR 1007 1008 5075 7

5074 5073 5048 5079 5047 5045 4

WIDOWS CREEK 5049 5065 6

5054 5053 5069 HIWASSEE 5058 5057 5055 5

5059 5064 5063 5061G 5071G 5028 5027 5025 2

FRANKLIN 5029 5034 5033 5038 5037 5035 5039 1

WATTS BAR NUCLEAR 1 5040 5050 500KV BUS 2 500KV BUS 1 5019 5015 5017 5018 3

BRADLEY INTERTIE BANK 5 161 KV SWITCHYARD 500 KV SWITCHYARD 875 873 874 885 895 905 NC NO NC NO NO NC NO NC ERCW 2A-A NC NO ERCW MCC 2A-A ERCW MCC 1A-A NC ERCW 1B-B NC NO ERCW MCC 1B-B ERCW MCC 2B-B NC ERCW 1A-A NC NO ERCW MCC 1A-A ERCW MCC 2A-A COM EMERG 161 KV BUS 1 HIGH VOLTAGE TO CSST D TO CTT B TO CTT A NC NC NC NC 5041G 5021G 5011G NC NC 1934 NO 1936 NO 1938 NO 1932 NO 1934 NO 1936 NO 1938 NO NC 324 NC GCB314 SHUTDOWN UTILITY BUS 1-15E500-1 1-15E500-1-29 1-15E500-2 1-15E500-2-35 1-75W500 1-75W500-16 45N502 45N504 45N505 402 403 19 18 139,140 17 16 6

137,138 5

15 14 135,136 13 12 133,134 8

9 10 11 120 119 247 203 255 218 219 230 232 231 229 122 121 249 205 256 220 221 126 125 124 123 229 231 230 232 251 253 209 258 224 225 207 257 222 223 USST 1B USST 1A USST 2A USST 2B RMOV BD 2B1-B 210 254 208 252 206 250 204 248 ETAP NODE NUMBERS XXX

.2 - Proposed TS Changes (Mark-Ups) for SQN, Units 1 and 2 CNL-17-034 A3.2 - 1

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 1 3.3.5-1 Amendment 334 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG start instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

According to Table 3.3.5-1.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one voltage sensor channel inoperable.

A.1 Restore the inoperable channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions with two or more voltage sensor channels inoperable.

OR One or more Functions with one required timer inoperable.

B.1.1 Restore all but one voltage sensor channel to OPERABLE status.

AND B.1.2 Restore required timer to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 hour C. Required Action and associated Completion Time not met.

C.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately D.

D.1 C. One or more unbalanced voltage relays inoperable.

C.1 Restore unbalanced voltage relays to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 1 3.3.5-3 Amendment 334 Table 3.3.5-1 (page 1 of 1)

Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation FUNCTION APPLICABLE MODES OR OTHER SPECIFIED CONDITIONS REQUIRED CHANNELS SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE NOMINAL TRIP SETPOINT

1. 6.9 kV Shutdown Board -

Loss of Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 5331 V and 5688 V 5520 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 1.00 sec and 1.50 sec 1.25 sec

2. 6.9 kV Shutdown Board -

Degraded Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 6403.5 V and 6522.5 V 6456 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 218.6 sec and 370 sec 300 sec

c. SI/Degraded Voltage Logic Enable Timer 1,2,3,4 1 per Shutdown Board SR 3.3.5.2 7.5 sec and 11.5 sec 9.5 sec (a)

When the associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

3. 6.9 kV Shutdown Board - 1,2,3,4, (a) 3 per SR 3.3.5.1 1.5 V at 3 sec (Permissive Alarm) 1.30 V at 2.95 sec (Permissive Alarm)

Unbalanced Voltage Relay Shutdown SR 3.3.5.2 3.3 V at 10 sec (Low) 2.96 V at 9.95 sec (Low)

Board 20.0 V at 4 sec (High) 18.13 V at 3.95 sec (High)

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 2 3.3.5-1 Amendment 327 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG start instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

According to Table 3.3.5-1.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one voltage sensor channel inoperable.

A.1 Restore the inoperable channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions with two or more voltage sensor channels inoperable.

OR One or more Functions with one required timer inoperable.

B.1.1 Restore all but one voltage sensor channel to OPERABLE status.

AND B.1.2 Restore required timer to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 hour C. Required Action and associated Completion Time not met.

C.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately D.

D.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months C.1 Restore unbalanced voltage relays to OPERABLE status.

C. One or more unbalanced voltage relays inoperable.

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 2 3.3.5-3 Amendment 327 Table 3.3.5-1 (page 1 of 1)

Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation FUNCTION APPLICABLE MODES OR OTHER SPECIFIED CONDITIONS REQUIRED CHANNELS SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE NOMINAL TRIP SETPOINT

1. 6.9 kV Shutdown Board -

Loss of Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 5331 V and 5688 V 5520 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 1.00 sec and 1.50 sec 1.25 sec

2. 6.9 kV Shutdown Board -

Degraded Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 6403.5 V and 6522.5 V 6456 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 218.6 sec and 370 sec 300 sec

c. SI/Degraded Voltage Logic Enable Timer 1,2,3,4 1 per Shutdown Board SR 3.3.5.2 7.5 sec and 11.5 sec 9.5 sec (a)

When the associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

3. 6.9 kV Shutdown Board - 1,2,3,4, (a) 3 per SR 3.3.5.1 1.5 V at 3 sec (Permissive Alarm) 1.30 V at 2.95 sec (Permissive Alarm)

Unbalanced Voltage Relay Shutdown SR 3.3.5.2 3.3 V at 10 sec (Low) 2.96 V at 9.95 sec (Low)

Board 20.0 V at 4 sec (High) 18.13 V at 3.95 sec (High)

.3 - Proposed TS Bases Changes (Mark-Ups) for SQN, Units 1 and 2 CNL-17-034 A3.3 - 1

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-1 Revision 45 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.

Undervoltage protection will generate a LOP start if a loss of voltage or degraded voltage condition occurs in the switchyard. There are two LOP start signals for each 6.9 kV Shutdown Board.

Six undervoltage relays (two per phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained degraded voltage condition or a loss of bus voltage. The relays are combined into two different two-out-of-three logic circuits; Loss of Voltage Function and Degraded Voltage Function. The Loss of Voltage Function (Function 1.a) logic generates a LOP signal if the voltage is below a nominal 80% for a short time while the Degraded Voltage Function (Function 2.a) logic generates a LOP signal if the voltage is below a nominal 93.5% for a longer time.

Six timers are provided on each 6.9 kV Shutdown Board, two timers associated with the Loss of Voltage Function logic and four timers associated with the Degraded Voltage Function logic. The two Loss of Voltage timers (Diesel Start and Load Shed Timers, Function 1.b) are arranged in a one-out-of-two logic with each timer set at a nominal 1.25 seconds. The Degraded Voltage timers are arranged in two sets of two; each set in a one-out-of-two logic. One set of Degraded Voltage timers (Diesel Start and Load Shed Timers, Function 2.b) are set at a nominal 300 seconds. The other set of Degraded Voltage timers (SI/Degraded Voltage Logic Enable Timers, Function 2.c) are set at a nominal 9.5 seconds. These timers along with the under voltage relays, ensure adequate voltage is available to the safety related loads and that unintended actuations from degraded voltage or voltage perturbations will not occur.

The Loss of Voltage Function voltage sensors monitor 6.9kV Shutdown Board voltage and actuate if voltage drops below 5520 volts. If two-out-of-three Loss of Voltage, Voltage Sensors detect less than 5520 volts, a signal is sent to the Diesel Generator Start and Load Shed Timers starting the 1.25 second timer. If Shutdown Board voltage increases to above the Loss of Voltage, Voltage Sensors setpoint before the Diesel Generator Start and Load Shed Timers reach their set time, the circuit returns to normal and the timers reset. If Shutdown Board voltage does not increase above the Loss of Voltage, Voltage Sensor setpoint within 1.25 seconds, a LOP signal is generated that trips the normal and alternate feeder breakers, starts the diesel generator, and trips major 6.9kV and 480V Shutdown Board loads.

three

, unbalanced voltage, or The timing functions for the Unbalanced Voltage relays are internal to the relays and set accordingly.

Six undervoltage relays (two per phase) and three unbalanced voltage relays (each three phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained degraded voltage condition, unbalanced voltage condition, or a loss of bus voltage.

The relays are combined in different logic configurations.

Loss of Voltage Function and Degraded Voltage Functions are both two-out-of-three logic circuits.

Unbalanced Voltage Relay is a permissive one-out-of-two logic circuit.

The Unbalanced Voltage Function generates a LOP signal if the alarm relay (1.30 V at 2.95 sec) and either the Low (2.96 V at 9.95 sec) or High (18.13 V at 3.95 sec) relay actuate to the determined voltage unbalance settings.

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-2 Revision 45 BASES BACKGROUND (continued)

The Degraded Voltage Function voltage sensors monitor 6.9kV Shutdown Board voltage and actuate if voltage drops below 6456 volts. If two-out-of-three Degraded Voltage, Voltage Sensors detect less than 6456 volts, a signal is sent to the Diesel Generator Start and Load Shed Timers starting their 300 second timer and to the SI/Degraded Voltage Logic Enable Timers starting their 9.5 second timer. If Shutdown Board voltage increases to above the Degraded Voltage, Voltage Sensors setpoint before the Diesel Generator Start and Load Shed Timers or the SI/Degraded Voltage Logic Enable Timers reach their set time, the circuit returns to normal and the timers reset. If Shutdown Board voltage does not increase above the Degraded Voltage, Voltage Sensor setpoint within 300 seconds a LOP signal is generated that trips the normal and alternate feeder breakers, starts the Diesel Generator, and trips major 6.9kV and 480V Shutdown Board loads. If Shutdown Board voltage does not increase above the Degraded Voltage, Voltage Sensor setpoint within 9.5 seconds and a safety injection signal is present or if a safety injection signal is generated after 9.5 seconds, a signal is generated that trips major 6.9kV and 480V Shutdown Board loads. The LOP start actuation is described in UFSAR, Section 8.3 (Ref. 1).

The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for Engineered Safety Features Actuation System (ESFAS) action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable.

The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the setpoint in accordance with uncertainty assumptions stated in the referenced setpoint methodology, (as-left-criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

Allowable Values and LOP DG Start Instrumentation Setpoints The Trip Setpoints used in the relays are based on the analytical limits presented in the associated setpoint scaling document. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account.

Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

The Unbalanced Voltage Relay Function monitors 6.9 kV Shutdown Board voltage and actuates if the alarm relay (1.30 V unbalance) and either the Low (2.96 V unbalance) or High (18.13 V unbalance) Relays have actuated. If the voltage unbalance levels drop below setpoint values before the relays time settings are met, the circuit returns to normal and timers reset. If Shutdown Board voltage unbalance remains following the pre-determined time settings, a LOP signal is generated that is sent to the Degraded Voltage trip circuitry and trips the normal and alternate feeder breakers, starts the diesel generator, and trips major 6.9 kV and 480 V Shutdown Board loads.

document/calculation.

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-3 Revision 45 BASES BACKGROUND (continued)

Allowable Values and/or Nominal Trip Setpoints are specified for each Function in Table 3.3.5-1. Nominal Trip Setpoints are also specified in the unit specific setpoint calculations. The trip setpoints are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a trip setpoint less conservative than the nominal Trip Setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation (Refs. 2, 3, and 4).

APPLICABLE The LOP DG start instrumentation is required for the Engineered Safety SAFETY Features (ESF) Systems to function in any accident with a loss of offsite ANALYSES power. Its design basis is that of the ESF Actuation System (ESFAS).

Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual DG start has historically been associated with the ESFAS actuation. The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.

The analyses assume a non-mechanistic DG loading, which does not explicitly account for each individual component of loss of power detection and subsequent actions.

The required channels of LOP DG start instrumentation, in conjunction with the ESF systems powered from the DGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 5, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," include the appropriate DG loading and sequencing delay.

The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

, 6, and 7.

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-4 Revision 45 BASES LCO The LCO for LOP DG start instrumentation requires that the loss of voltage and degraded voltage Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG start instrumentation supports safety systems associated with the ESFAS, as required by Table 3.3.5-1.

In MODES 5 and 6, the Functions must be OPERABLE, as required by Table 3.3.5-1, whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on a LOP or degraded power to the associated 6.9 kV Shutdown Boards.

ACTIONS In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per shutdown board basis, the Condition may be entered separately for each shutdown board as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

, unbalanced voltage

relay,

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-5 Revision 45 BASES ACTIONS (continued)

A.1 Condition A applies to the LOP DG start Functions with one or more Functions with one voltage sensor channel inoperable.

If one channel of the voltage sensors is inoperable, Required Action A.1 requires that channel to be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The specified Completion Time is reasonable considering the Function remains fully OPERABLE and the low probability of an event occurring during these intervals.

B.1 Condition B applies when one or more Functions have two or more voltage sensor channels inoperable or one or more Functions have one required timer inoperable.

Required Action B.1.1 requires restoring all but one voltage sensor channel to OPERABLE status. Required Action B.1.2 requires restoring the required load shed timer to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

C.1 Condition C applies when one or more unbalanced voltage relays are inoperable.

Required Action C.1 requires restoring all unbalanced voltage relays to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occuring during this interval.

D.1 D

, B, or C

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-6 Revision 45 BASES SURVEILLANCE SR 3.3.5.1 REQUIREMENTS SR 3.3.5.1 is the performance of a TADOT. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment. The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION.

There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

, unbalanced voltage,

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 1 B 3.3.5-7 Revision 45 BASES REFERENCES

1.

UFSAR, Section 8.3.

2.

TVA Calculation 27 DAT, Demonstrated Accuracy Calculation 27 DAT."

3.

TVA Calculation DS1-2, "Demonstrated Accuracy Calculation DS1-2."

4.

TVA Calculation SQN-EEB-MS-TI06-0008, "Degraded Voltage Analysis."

5.

UFSAR, Chapter 15.

6. TVA Calculation EDQ0002022016000331, "Determination of Unbalance Voltage Relay Analytical Limits"

7. TVA Calculation EDQ0002022016000329, "Demonstrated Accuracy Calculation for Voltage Unbalance Relays"

AC Sources - Operating B 3.8.1 SEQUOYAH - UNIT 1 B 3.8.1-2 Revision 45 BASES BACKGROUND (continued) supplying power to an offsite circuit (via the Unit Station Service Transformers (USSTs)) with a Generator Circuit Breaker (GCB) providing isolation between the main generator and the main bank transformers.

When the main generator is not operating, the main bank transformers function as step down transformers and supply electrical power from the grid to the USSTs.

Offsite power can also be supplied by the Common Station Service Transformers (CSSTs) via the 6.9 kV Start Buses and 6.9 kV Unit Boards.

Offsite power will normally be supplied from the USSTs to the 6.9 kV Shutdown Boards via the 6.9 kV Unit Boards, and will automatically transfer at least one power supply to an alternate power supply (CSST A or CSST C) on a trip of the Power Circuit Breakers (PCBs). CSST C is the alternate power source for 6.9 kV Shutdown Boards 1A-A and 2A-A, and CSST A is the alternate power source for 6.9 kV Shutdown Boards 1B-B and 2B-B. (CSST B is a spare transformer with two sets of secondary windings that can be used to supply a total of two Start Buses for CSST A and/or CSST C, with each Start Bus on a separate CSST B secondary winding.) Therefore, two electrically and physically separated circuits provide AC power through a combination of the USSTs and/or CSSTs to the 6.9 kV Shutdown Boards. Each offsite circuit is capable of providing power to one train of ESF loads. A detailed description of the offsite power network and the circuits to the Class 1E 6.9 kV Shutdown Boards is found in UFSAR, Chapter 8 (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network (beginning at the switchyard) to one load group of Class 1E 6.9 kV Shutdown Boards (ending at the supply side of the normal or alternate supply circuit breaker).

The onsite standby power source for each 6.9 kV Shutdown Board is a dedicated DG. DGs 1A-A, 1B-B, 2A-A, and 2B-B are separate and independent and are dedicated to 6.9 kV Shutdown Boards 1A-A, 1B-B, 2A-A, and 2B-B, respectively. Each diesel generator set consists of two diesel engines in tandem driving a common generator with a normal synchronous speed of approximately 900 rpm. A DG starts automatically on a safety injection (SI) signal (i.e., low pressurizer pressure, high containment pressure, or low steam line pressure signals) or on a 6.9 kV Shutdown Board degraded voltage or loss-of-voltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it will automatically tie to its respective 6.9 kV Shutdown Board after offsite power is tripped as a consequence of a 6.9 kV Shutdown Board degraded voltage or loss-of-voltage signal, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without tying to the 6.9 kV

, unbalanced voltage,

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-1 Revision 45 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.

Undervoltage protection will generate a LOP start if a loss of voltage or degraded voltage condition occurs in the switchyard. There are two LOP start signals for each 6.9 kV Shutdown Board.

Six undervoltage relays (two per phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained degraded voltage condition or a loss of bus voltage. The relays are combined into two different two-out-of-three logic circuits; Loss of Voltage Function and Degraded Voltage Function. The Loss of Voltage Function (Function 1.a) logic generates a LOP signal if the voltage is below a nominal 80% for a short time while the Degraded Voltage Function (Function 2.a) logic generates a LOP signal if the voltage is below a nominal 93.5% for a longer time.

Six timers are provided on each 6.9 kV Shutdown Board, two timers associated with the Loss of Voltage Function logic and four timers associated with the Degraded Voltage Function logic. The two Loss of Voltage timers (Diesel Start and Load Shed Timers, Function 1.b) are arranged in a one-out-of-two logic with each timer set at a nominal 1.25 seconds. The Degraded Voltage timers are arranged in two sets of two; each set in a one-out-of-two logic. One set of Degraded Voltage timers (Diesel Start and Load Shed Timers, Function 2.b) are set at a nominal 300 seconds. The other set of Degraded Voltage timers (SI/Degraded Voltage Logic Enable Timers, Function 2.c) are set at a nominal 9.5 seconds. These timers along with the under voltage relays, ensure adequate voltage is available to the safety related loads and that unintended actuations from degraded voltage or voltage perturbations will not occur.

The Loss of Voltage Function voltage sensors monitor 6.9kV Shutdown Board voltage and actuate if voltage drops below 5520 volts. If two-out-of-three Loss of Voltage, Voltage Sensors detect less than 5520 volts, a signal is sent to the Diesel Generator Start and Load Shed Timers starting the 1.25 second timer. If Shutdown Board voltage increases to above the Loss of Voltage, Voltage Sensors setpoint before the Diesel Generator Start and Load Shed Timers reach their set time, the circuit returns to normal and the timers reset. If Shutdown Board voltage does not increase above the Loss of Voltage, Voltage Sensor setpoint within 1.25 seconds, a LOP signal is generated that trips the normal and alternate feeder breakers, starts the diesel generator, and trips major 6.9kV and 480V Shutdown Board loads.

The timing functions for the Unbalanced Voltage relays are internal to the relays and set accordingly.

The Unbalanced Voltage Relay Function generates a LOP signal if the alarm relay (1.30 V at 2.95 sec) and either the Low (2.96 V at 9.95 sec) or High (18.13 V at 3.95 sec) relay actuate to the determined voltage unbalance settings.

Six undervoltage relays (two per phase) and three unbalanced voltage relays (each three phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained degraded voltage condition, unbalanced voltage condition, or a loss of bus voltage.

The relays are combined in different logic configurations.

Loss of Voltage Function and Degraded Voltage Functions are both two-out-of-three logic circuits. Unbalanced Voltage Relay is a permissive one-out-of-two logic circuit.

, unbalanced voltage, or three

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-2 Revision 45 BASES BACKGROUND (continued)

The Degraded Voltage Function voltage sensors monitor 6.9kV Shutdown Board voltage and actuate if voltage drops below 6456 volts. If two-out-of-three Degraded Voltage, Voltage Sensors detect less than 6456 volts, a signal is sent to the Diesel Generator Start and Load Shed Timers starting their 300 second timer and to the SI/Degraded Voltage Logic Enable Timers starting their 9.5 second timer. If Shutdown Board voltage increases to above the Degraded Voltage, Voltage Sensors setpoint before the Diesel Generator Start and Load Shed Timers or the SI/Degraded Voltage Logic Enable Timers reach their set time, the circuit returns to normal and the timers reset. If Shutdown Board voltage does not increase above the Degraded Voltage, Voltage Sensor setpoint within 300 seconds a LOP signal is generated that trips the normal and alternate feeder breakers, starts the Diesel Generator, and trips major 6.9kV and 480V Shutdown Board loads. If Shutdown Board voltage does not increase above the Degraded Voltage, Voltage Sensor setpoint within 9.5 seconds and a safety injection signal is present or if a safety injection signal is generated after 9.5 seconds, a signal is generated that trips major 6.9kV and 480V Shutdown Board loads. The LOP start actuation is described in UFSAR, Section 8.3 (Ref. 1).

The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for Engineered Safety Features Actuation System (ESFAS) action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable.

The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL CALIBRATION. Note that although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the setpoint in accordance with uncertainty assumptions stated in the referenced setpoint methodology, (as-left-criteria) and confirmed to be operating within the statistical allowances of the uncertainty terms assigned.

Allowable Values and LOP DG Start Instrumentation Setpoints The Trip Setpoints used in the relays are based on the analytical limits presented in the associated setpoint scaling document. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account.

Setpoints adjusted consistent with the requirements of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

The Unbalanced Voltage Relay Function monitors 6.9 kV Shutdown Board voltage and actuates if the alarm relay (1.30 V unbalance) and either the Low (2.96 V unbalance) or High (18.13 V unbalance) Relays have actuated. If the voltage unbalance levels drop below setpoint values before the relays time settings are met, the circuit returns to normal and timers reset. If Shutdown Board voltage unbalance remains following the pre-determined time settings, a LOP signal is generated that is sent to the Degraded Voltage trip circuitry and trips the normal and alternate feeder breakers, starts the diesel generator, and trips major 6.9 kV and 480 V Shutdown Board loads.

document/calculation.

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-3 Revision 45 BASES BACKGROUND (continued)

Allowable Values and/or Nominal Trip Setpoints are specified for each Function in Table 3.3.5-1. Nominal Trip Setpoints are also specified in the unit specific setpoint calculations. The trip setpoints are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE. Operation with a trip setpoint less conservative than the nominal Trip Setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation (Refs. 2, 3, and 4).

APPLICABLE The LOP DG start instrumentation is required for the Engineered Safety SAFETY Features (ESF) Systems to function in any accident with a loss of offsite ANALYSES power. Its design basis is that of the ESF Actuation System (ESFAS).

Accident analyses credit the loading of the DG based on the loss of offsite power during a loss of coolant accident (LOCA). The actual DG start has historically been associated with the ESFAS actuation. The DG loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power.

The analyses assume a non-mechanistic DG loading, which does not explicitly account for each individual component of loss of power detection and subsequent actions.

The required channels of LOP DG start instrumentation, in conjunction with the ESF systems powered from the DGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 5, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," include the appropriate DG loading and sequencing delay.

The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

, 6, and 7.

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-4 Revision 45 BASES LCO The LCO for LOP DG start instrumentation requires that the loss of voltage and degraded voltage Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG start instrumentation supports safety systems associated with the ESFAS, as required by Table 3.3.5-1.

In MODES 5 and 6, the Functions must be OPERABLE, as required by Table 3.3.5-1, whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the Nominal Trip Setpoint. A trip setpoint may be set more conservative than the Nominal Trip Setpoint as necessary in response to plant conditions. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on a LOP or degraded power to the associated 6.9 kV Shutdown Boards.

ACTIONS In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per shutdown board basis, the Condition may be entered separately for each shutdown board as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

, unbalanced voltage

relay,

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-5 Revision 45 BASES ACTIONS (continued)

A.1 Condition A applies to the LOP DG start Functions with one or more Functions with one voltage sensor channel inoperable.

If one channel of the voltage sensors is inoperable, Required Action A.1 requires that channel to be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The specified Completion Time is reasonable considering the Function remains fully OPERABLE and the low probability of an event occurring during these intervals.

B.1 Condition B applies when one or more Functions have two or more voltage sensor channels inoperable or one or more Functions have one required timer inoperable.

Required Action B.1.1 requires restoring all but one voltage sensor channel to OPERABLE status. Required Action B.1.2 requires restoring the required load shed timer to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

Condition C applies when one or more unbalanced voltage relays are inoperable.

Required Action C.1 requires restoring all unbalanced voltage relays to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occuring during this interval.

C.1 D

, B, or C D.1

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-6 Revision 45 BASES SURVEILLANCE SR 3.3.5.1 REQUIREMENTS SR 3.3.5.1 is the performance of a TADOT. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment. The SR is modified by a Note that excludes verification of setpoints for relays. Relay setpoints require elaborate bench calibration and are verified during CHANNEL CALIBRATION.

There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as-left and as-found setting are consistent with those established by the setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

, unbalanced voltage,

LOP DG Start Instrumentation B 3.3.5 SEQUOYAH - UNIT 2 B 3.3.5-7 Revision 45 BASES REFERENCES

1.

UFSAR, Section 8.3.

2.

TVA Calculation 27 DAT, Demonstrated Accuracy Calculation 27 DAT."

3.

TVA Calculation DS1-2, "Demonstrated Accuracy Calculation DS1-2."

4.

TVA Calculation SQN-EEB-MS-TI06-0008, "Degraded Voltage Analysis."

5.

UFSAR, Chapter 15.

6. TVA Calculation EDQ0002022016000331, "Determination of Unbalance Voltage Relay Analytical Limits"

7. TVA Calculation EDQ0002022016000329, "Demonstrated Accuracy Calculation for Voltage Unbalance Relays"

AC Sources - Operating B 3.8.1 SEQUOYAH - UNIT 2 B 3.8.1-2 Revision 45 BASES BACKGROUND (continued) supplying power to an offsite circuit (via the Unit Station Service Transformers (USSTs)) with a Generator Circuit Breaker (GCB) providing isolation between the main generator and the main bank transformers.

When the main generator is not operating, the main bank transformers function as step down transformers and supply electrical power from the grid to the USSTs.

Offsite power can also be supplied by the Common Station Service Transformers (CSSTs) via the 6.9 kV Start Buses and 6.9 kV Unit Boards.

Offsite power will normally be supplied from the USSTs to the 6.9 kV Shutdown Boards via the 6.9 kV Unit Boards, and will automatically transfer at least one power supply to an alternate power supply (CSST A or CSST C) on a trip of the Power Circuit Breakers (PCBs). CSST C is the alternate power source for 6.9 kV Shutdown Boards 1A-A and 2A-A, and CSST A is the alternate power source for 6.9 kV Shutdown Boards 1B-B and 2B-B. (CSST B is a spare transformer with two sets of secondary windings that can be used to supply a total of two Start Buses for CSST A and/or CSST C, with each Start Bus on a separate CSST B secondary winding.) Therefore, two electrically and physically separated circuits provide AC power through a combination of the USSTs and/or CSSTs to the 6.9 kV Shutdown Boards. Each offsite circuit is capable of providing power to one train of ESF loads. A detailed description of the offsite power network and the circuits to the Class 1E 6.9 kV Shutdown Boards is found in UFSAR, Chapter 8 (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network (beginning at the switchyard) to one load group of Class 1E 6.9 kV Shutdown Boards (ending at the supply side of the normal or alternate supply circuit breaker).

The onsite standby power source for each 6.9 kV Shutdown Board is a dedicated DG. DGs 1A-A, 1B-B, 2A-A, and 2B-B are separate and independent and are dedicated to 6.9 kV Shutdown Boards 1A-A, 1B-B, 2A-A, and 2B-B, respectively. Each diesel generator set consists of two diesel engines in tandem driving a common generator with a normal synchronous speed of approximately 900 rpm. A DG starts automatically on a safety injection (SI) signal (i.e., low pressurizer pressure, high containment pressure, or low steam line pressure signals) or on a 6.9 kV Shutdown Board degraded voltage or loss-of-voltage signal (refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation"). After the DG has started, it will automatically tie to its respective 6.9 kV Shutdown Board after offsite power is tripped as a consequence of a 6.9 kV Shutdown Board degraded voltage or loss-of-voltage signal, independent of or coincident with an SI signal. The DGs will also start and operate in the standby mode without tying to the 6.9 kV

, unbalanced voltage,

.4 - Proposed TS Changes (Clean) for SQN, Units 1 and 2 CNL-17-034 A3.4 - 1

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 1 3.3.5-1 Amendment XXX 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG start instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

According to Table 3.3.5-1.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one voltage sensor channel inoperable.

A.1 Restore the inoperable channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions with two or more voltage sensor channels inoperable.

OR One or more Functions with one required timer inoperable.

B.1.1 Restore all but one voltage sensor channel to OPERABLE status.

AND B.1.2 Restore required timer to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 hour C. One or more unbalanced voltage relays inoperable.

C.1 Restore unbalanced voltage relays to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 1 3.3.5-2 Amendment XXX ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and associated Completion Time not met.

D.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately SURVEILLANCE REQUIREMENTS

NOTE-----------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP DG Start Instrumentation Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE----------------------------

Verification of relay setpoints not required.

Perform TADOT.

In accordance with the Surveillance Frequency Control Program SR 3.3.5.2 Perform CHANNEL CALIBRATION.

In accordance with the Surveillance Frequency Control Program

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 1 3.3.5-3 Amendment XXX Table 3.3.5-1 (page 1 of 1)

Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation FUNCTION APPLICABLE MODES OR OTHER SPECIFIED CONDITIONS REQUIRED CHANNELS SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE NOMINAL TRIP SETPOINT

1. 6.9 kV Shutdown Board -

Loss of Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 5331 V and 5688 V 5520 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 1.00 sec and 1.50 sec 1.25 sec

2. 6.9 kV Shutdown Board -

Degraded Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 6403.5 V and 6522.5 V 6456 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 218.6 sec and 370 sec 300 sec

c. SI/Degraded Voltage Logic Enable Timer 1,2,3,4 1 per Shutdown Board SR 3.3.5.2 7.5 sec and 11.5 sec 9.5 sec

3. 6.9 kV Shutdown Board -

Unbalanced Voltage Relay 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 1.5 V at 3 sec (Permissive Alarm) 3.3 V at 10 sec (Low) 20.0 V at 4 sec (High) 1.30 V at 2.95 sec (Permissive Alarm) 2.96 V at 9.95 sec (Low) 18.13 V at 3.95 sec (High)

(a)

When the associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 2 3.3.5-1 Amendment XXX 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG start instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

According to Table 3.3.5-1.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one voltage sensor channel inoperable.

A.1 Restore the inoperable channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions with two or more voltage sensor channels inoperable.

OR One or more Functions with one required timer inoperable.

B.1.1 Restore all but one voltage sensor channel to OPERABLE status.

AND B.1.2 Restore required timer to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 hour C. One or more unbalanced voltage relays inoperable.

C.1 Restore unbalanced voltage relays to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 2 3.3.5-2 Amendment XXX ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and associated Completion Time not met.

D.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately SURVEILLANCE REQUIREMENTS

NOTE-----------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP DG Start Instrumentation Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE----------------------------

Verification of relay setpoints not required.

Perform TADOT.

In accordance with the Surveillance Frequency Control Program SR 3.3.5.2 Perform CHANNEL CALIBRATION.

In accordance with the Surveillance Frequency Control Program

LOP DG Start Instrumentation 3.3.5 SEQUOYAH - UNIT 2 3.3.5-3 Amendment XXX Table 3.3.5-1 (page 1 of 1)

Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation FUNCTION APPLICABLE MODES OR OTHER SPECIFIED CONDITIONS REQUIRED CHANNELS SURVEILLANCE REQUIREMENTS ALLOWABLE VALUE NOMINAL TRIP SETPOINT

1. 6.9 kV Shutdown Board -

Loss of Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 5331 V and 5688 V 5520 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 1.00 sec and 1.50 sec 1.25 sec

2. 6.9 kV Shutdown Board -

Degraded Voltage

a. Voltage Sensors 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 6403.5 V and 6522.5 V 6456 V

b. Diesel Generator Start and Load Shed Timer 1,2,3,4, (a) 1 per Shutdown Board SR 3.3.5.2 218.6 sec and 370 sec 300 sec

c. SI/Degraded Voltage Logic Enable Timer 1,2,3,4 1 per Shutdown Board SR 3.3.5.2 7.5 sec and 11.5 sec 9.5 sec

3. 6.9 kV Shutdown Board -

Unbalanced Voltage Relay 1,2,3,4, (a) 3 per Shutdown Board SR 3.3.5.1 SR 3.3.5.2 1.5 V at 3 sec (Permissive Alarm) 3.3 V at 10 sec (Low) 20.0 V at 4 sec (High) 1.30 V at 2.95 sec (Permissive Alarm) 2.96 V at 9.95 sec (Low) 18.13 V at 3.95 sec (High)

(a)

When the associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

.5 - Excerpts from SQN UFSAR CNL-17-034 A3.5 - 1 Per SQN UFSAR Section 8.1.2 8.1.2 Plant Electrical Power System For Unit 1and 2, the plant electric power system consists of the main generator, the generator circuit Breaker (GCB), the unit station service transformers, the common station service transformers, the main bank transformers, the diesel generators, the batteries, and the electric distribution system as shown in Figures 8.1.2-1 and 8.1.2-2.

The main generator supplies electrical power through isolated phase buses to the main bank transformers and the unit station service transformers. During normal operations the auxiliary power is typically supplied by unit power through the unit station service transformers. During startup and shutdown the auxiliary power is typically supplied by the 500-kV system through the main bank and unit station service transformers for Unit 1 and the 161-kV system through the main bank and unit station service transformers for Unit 2. During startup, shutdown, and normal operations auxiliary power may be supplied by the 161-kV system through the common station service transformers.

The standby onsite power is supplied by four diesel generators. The power to the 6.9-kV common boards is supplied by the 161-kV system through the common station service transformers.

The safety objective for the power system is to furnish adequate electric power to ensure that safety loads function in conformance with design criteria and bases.

The safety objective has been accomplished by: (1) establishing design criteria and bases that conform to regulatory documents and accepted design practice, and (2) implementation of these criteria and bases in a manner that assures a system design and a constructed plant which satisfies safety requirements. The applicable documents governing the design are shown in Subsection 8.1.5.

Figure 8.1.2-1 depicts the plant auxiliary power distribution system that receives AC power from either the Unit 1 or 2 nuclear power unit, the two independent preferred (offsite) power circuits, and four diesel-generator standby (onsite) power sources and distributes it to both safety-related and nonsafety-related loads in the plant. The two preferred circuits have access to the TVA transmission network which in turn has multiple interties with other transmission networks.

The major safety-related loads for each nuclear unit are divided electrically into two redundant load groups. Each redundant load group of each unit has access to a standby (onsite) source and to each of the two preferred (offsite) sources. Due to a number of shared systems, two (must be the same train) out of four diesels and load groups are required to provide all safety functions for each unit. The offsite and onsite power systems are described in Sections 8.2 and 8.3.

Per SQN UFSAR Section 8.2.1 8.2.1 Transmission Network Description The Sequoyah Nuclear Plant is connected into a strong existing transmission network supplying large load centers. One unit is connected into the 500-kV transmission network and the other unit is connected into the 161-kV transmission system. The two

.5 - Excerpts from SQN UFSAR CNL-17-034 A3.5 - 2 systems are interconnected at Sequoyah through a 1200-MVA, 500-161-kV intertie transformer bank. Preferred electric power to the emergency buses and to start up and shut down the generating units at the Sequoyah Nuclear Plant is supplied by two physically and electrically independent circuits from the Sequoyah 161-kV or 500-kV switchyard through separate transformers to the onsite electrical distribution system, (refer to Figure 8.2.1-1).

For Unit 1 and 2, the normal power supply to the emergency buses is typically supplied by unit power through the unit station service transformers (USSTs). For Unit 1, the normal power supply to start up and shut down the generator is typically supplied by the 500-kV system through the main bank transformers and USSTs. For Unit 2, the normal power supply to start up and shut down the generator is typically supplied by the 161-kV system through the main bank transformers and unit station service transformers.

Power to the emergency buses and to start up or shut down the generating unit may be supplied by the common station service transformers (CSSTRs).

Five 500-kV transmission lines connect one generating unit into the 500-kV system.

Except in the vicinity of Sequoyah Nuclear Plant, the lines are on rights of way which are sufficiently wide to preclude the likelihood of failure of one line causing failure of another.

The 161-kV switchyard is the terminus for the second nuclear unit, the 500-kV intertie transformer bank and eight 161-kV transmission lines. Four 161-kV transmission lines terminate on each bus section. Two fuseless 84 MVAR 161-kV capacitor banks are tied to the 161-kV switchyard through double bus-tie breakers. Each bank is independently switched. These capacitors provide reactive voltage support for the 161-kV offsite system. Of the eight 161-kV transmission lines emanating from the Sequoyah 161-kV switchyard, one connects to TVA's Chickamauga Hydro Plant; one connects to TVA's Watts Bar Hydro Plant; and six connect to 161-kV substations that are an integral part of the 161-kV transmission network. Nine hydro plants, one fossil-fueled plant, and one nuclear plant are located within a sixty-mile radius from the Sequoyah Nuclear Plant.

These plants are strongly connected through the 161-kV and 500-kV transmission networks to Sequoyah and have an installed capacity of more than 4000 MVA.

8.2.1.1 Preferred Power System The intent of GDC 17 has been implemented in the design of the Preferred Power System by providing two physically and functionally independent circuits for energizing safety related load groups. This section identifies these two circuits and describes the general provisions made to achieve functional independence between them.

Paragraphs 8.2.1.2 through 8.2.1.4 describe measures taken to provide physical independence between them. The Preferred Power System can be identified by reference to Figures 8.1.2-1, 8.2.1-1, and 8.2.1-2. The Preferred Power System consists of: two main bank transformers; six 24-kV isolated phase buses; four 24-6.9-kV unit station service transformers; four 6.9-kV unit station service transformer buses; three 161-6.9-kV CSSTRs (A and C, energized spare B); a 6.9-kv start board; four 6.9-kV start buses; eight 6.9-kV unit boards; four 6.9-kV shutdown boards; and all overhead conductors, buses, cable, and distribution equipment that interconnect the off-site power circuits with the 6.9-kV shutdown boards. The Preferred Power System is supplied power by way of either the plant 161-kV or 500-kV switchyard. The combination of Unit 1 and 2 main bank transformers, USSTs, 24-kV isolated phase buses, and 6.9-kV unit

.5 - Excerpts from SQN UFSAR CNL-17-034 A3.5 - 3 station service transformer buses comprise one qualified independent off-site power circuit.

Figures 8.1.2-1 and 8.2.1-1 indicate the functional arrangement of the two independent circuits which derive power from either the 161-kV or 500-kV switchyard and deliver it to the individual 6.9-kV Unit Boards. Power is then routed by two independent circuits from the 6.9-kV Unit Boards to the 6.9-kV Shutdown Boards within each unit.

The components comprising the Preferred Power System have been arranged to provide sufficient independence (both physical and functional) to minimize the likelihood of simultaneous outage of both preferred circuits.

Functional independence has been achieved by providing separate control circuits, powered by separate DC sources. The single line diagrams of these non-safety related 250V DC Systems are included as Figures 8.2.1-3 and 8.2.1-4.

8.2.1.8 Conformance with Standards This section discusses provisions included in the design of the offsite power system to achieve a system design in conformance with applicable requirements of GDC 17, Regulatory Guides 1.6 Rev. 0, and 1.32, Rev. 2.

Functional Measures The rest of the discussion deals mainly with the manner in which GDC 17 has been implemented.

Refer to section 8.2.1.1 for the components that comprise the preferred power system.

Analysis to show that GDC 17 is satisfied consists of two parts: (1) a qualitative analysis to show that the loss of any one of the components will not cause loss of availability of offsite power to the 6900-volt shutdown boards, and (2) a quantitative analysis to show that the capacity of each of the components is such that it will carry its required load in the event of a simultaneous LOCA of one unit and orderly safe shutdown of the other unit with any of the other components out of service.

In the event of a LOCA on one generating unit and a orderly safe shutdown on the other generating unit when unit boards are aligned to CSSTRs and one CSSTR is out of service, the two remaining CSSTRs will supply power to the emergency loads on the LOCA unit and to those loads on both units associated with normal operation which are not automatically tripped. These normal operation loads are subsequently reduced by action of the unit operators. However, no operator action is assumed during the first 10 minutes following a LOCA. All loads on both 6900-volt shutdown boards which start automatically are assumed to start simultaneously. All unit normal running loads are assumed to remain without reduction following the accident signals, except those loads automatically tripped.

.1 - WBN Electrical Distribution System Diagram CNL-17-034 A4.1 - 1

1716NC NO 1A-A NC NC 1A2-A NC NC 480V SD BD 1A2-A 480V SD BD 1A1-A NO 1A1-A NC NO NC NC NO NC NC NO NC NC NO NC C&A VENT BD 1A1-A NO NC NC NO NC NO NC NO NC NO DSL AUX BD 1A1-A DSL AUX BD 1A2-A C&A VENT BD 1A2-A RMOV BD 1A2-A R VENT BD 1A-A 1718NO 6.9KV SD BD 1A-A 1912NO 1932 NO DG 1A-A 1934NO NO NC 1B-B NC NC 1B2-B NC 480V SD BD 1B2-B 480V SD BD 1B1-B NO 1B1-B NC NO NO NC NC NO NC NC NO NC NO NC C&A VENT BD 1B1-B NO NC NC NO NC NO NC NO NC NO DSL AUX BD 1B1-B DSL AUX BD 1B2-B C&A VENT BD 1B2-B RMOV BD 1B2-B R VENT BD 1B-B 1914NO 1728 NC DG 1B-B NO RMOV BD 1B1-B 1936NO NO 2A-A NC NC 2A2-A NC NC 480V SD BD 2A2-A 480V SD BD 2A1-A NO 2A1-A NC NO NC NC NO NC NC NO NC NC NO NC C&A VENT BD 2A1-A NO NC NC NO NC NO NC NO NC NO DSL AUX BD 2A1-A DSL AUX BD 2A2-A C&A VENT BD 2A2-A RMOV BD 2A2-A R VENT BD 2A-A 1818NO 6.9KV SD BD 2A-A 1922 1816 NC DG 2A-A 1828 NC NO 2B-B NC NC 2B2-B NC NC 480V SD BD 2B2-B 480V SD BD 2B1-B NO 2B1-B NC NO NO NC NC NO NC NC NO NC NC NO NC NO C&A VENT BD 2B1-B NO NC NC NO NC NC NO NC NO NC NO DSL AUX BD 2B1-B DSL AUX BD 2B2-B C&A VENT BD 2B2-B RMOV BD 2B2-B VPS IV R VENT BD 2B-B 1826 NO 6.9KV SD BD 2B-B 1924 NO 1938 NO N0 RMOV BD 2B1-B RMOV BD 2A1-A RMOV BD 1A1-A NC 1726 NO NO NC 1812 NC 2814 Y

X 161 KV BUS 865 CSST C COM STA SWGR C X

Y NC 1712 NC 2714 161 KV BUS 815 COM STA SWGR D CSST D NC NC NC NC NC NC NC NC 5039 5034 5033 2

BULL RUN 5099 5044 5043 5024 5023 5050 5049 5045 5035 HIWASSEE ROANE 5029 5025 BUS 1 5089 VOLUNTEER 5109 SEQUOYAH 1 5119 8

5117 5118 5087 5088 5097 5098 5107 5108 500KV SWITCHYARD 5080 6127 869 X

Y NO NC NO NC 2514 2512 1514 1512 CSST A 2634 NO RCP BD 2D 1626 NC Y

X USST 2B GENERATOR 2 2222 NC RCP BD 2C 2534 NO 2224 NC 1224 NC 6.9KV UNIT BD 2D 1222 NC 6.9KV UNIT BD 2C 1634 NO 2632 NO RCP BD 2B Y

X USST 2A 2212 NC RCP BD 2A 2532 NO 2214 NC 1214 NC 1534 NO 1532 NO 1212 NC 6.9KV UNIT BD 2A 1632 NO MAIN 2 NC NC NC 1822 1814 6.9KV START BUS A 6.9KV START BUS B 2522 NO RCP BD 1A 1126 NO Y

X USST 1A GENERATOR 1 2114 NC RCP BD 1B 2622 NO 2112 NC 1112 NC 6.9KV UNIT BD 1A 1114 NC 6.9KV UNIT BD 1B 1522 NO 2524 NO RCP BD 1C Y

X USST 1B 2124 NC RCP BD 1D 2624 NO 2122 NC 1122 NC 1622 NO 1526 NC 6.9KV UNIT BD 1C 1124 NC 6.9KV UNIT BD 1D 1524 NO MAIN 1 NC NC NC 1714 1722 1B 6.9KV RCP START BUS B 6.9KV RCP START BUS A 819 X

Y NC NO NC NO 2612 2614 1612 1614 CSST B 1216 NO 1624 NO 480V UNIT BD 2B NC 480V UNIT BD 1A NC NC 1A 6.9KV COMMON BD B NC 480V UNIT BD 2A NC 2A 480V UNIT BD 1B NC 2B VPS III VPS III VPS IV VPS II VPS I VPS I VPS II A

B C

D E

F G

H I

1 2

3 4

5 6

7 8

9 1

2 3

4 5

6 7

8 9

10 10 DG 2B-B 6.9KV COMMON BD A NO NC NO NC NO NC 6.9KV SD BD 1B-B Watts Bar Nuclear Plant Electrical Distribution System 480V-500KV 6.9KV UNIT BD 2B CAD MAINTAINED DRAWING Engineer: Mark D. Bowman Reference Drawings LEGEND SAFETY RELATED - TRAIN A SAFETY RELATED - TRAIN B 6.9KV START BUS A RCP START BUSES 6.9KV START BUS B OFFSITE POWER CKT R OFFSITE POWER CKT P NON-SAFETY B.O.P.

1-15E500-1-29 1-15E500-2-35 1-75W500-16 4

8/28/2015 WBN Electrical Distribution System DATE FILE NAME REVISION LEVEL INFORMATION ONLY 500KV BUS 500KV BUS NO 480V UNIT BD UTILITY BUS NO NO NO NO EU NC ATHENS 905 909 1

6 903 904 161KV SWITCHYARD @ WBH 4

3 953 954 955 959 958 957 SEQUOYAH 925 929 923 924 WBH UNIT A&B 920 933 934 935 939 938 937 5

GREAT FALLS 969 967 965 968 7

8 970 9

983 984 985 989 988 987 WBH UNIT 3 980 10 2

913 914 915 919 918 917 WBH UNIT 1&2 11 SPRING CITY 805 809 803 804 15 ROCKWOOD 16 WINCHESTER 12 813 814 815 819 818 817 WBH UNIT C&D 13 823 824 825 829 828 827 14 833 834 835 839 838 837 WBH UNIT 4&5 820 830 849 847 845 848 859 857 855 858 161KV BUS2 161KV BUS1 5028 5038 5048 6117 5027 5037 5047 5084 5083 5094 5093 5095 5085 5104 5103 5114 5113 5115 5105 BUS 2 3

4 9

10 11 HYDRO LINE B HYDRO LINE A 50 60 11 10 9

8 23 22 21 20 2

151,152 149,150 147,148 145,146 1

19 18 17 16 4

5 6

7 15 139,140 137,138 14 135,136 133,134 13 131,132 129,130 12 125,126 127,128 241 239 237 235 242 210 209 246 223 224 240 238 236 208 207 245 221 222 206 205 244 219 220 204 203 243 217 218 ETAP NODE NUMBERS XXX

.2 - Proposed TS Changes (Mark-Ups) for WBN, Units 1 and 2 CNL-17-034 A4.2 - 1

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-49 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG Start Instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

NOTE------------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A.

One or more Functions with one channel per bus inoperable.

NOTE--------------------

Enter applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for Auxiliary Feedwater Start Instrumentation made inoperable by LOP DG Start Instrumentation.

A.1 Restore channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.

One or more Functions with two or more channels per bus inoperable.

B.1 Restore all but one channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

NOTE------------

Not applicable to Function 5.

NOTE------------

Not applicable to Function 5.

NOTE------------

Only applicable to Function 5.

C. One or more Functions with one channel per bus inoperable C.1 Restore channel to OPERABLE status 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-50 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C.

Required Action and associated Completion Time not met.

C.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately SURVEILLANCE REQUIREMENTS

NOTE------------------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE---------------------------

Verification of relay setpoints not required.

Perform TADOT.

92 days SR 3.3.5.2 Perform CHANNEL CALIBRATION.

6 months SR 3.3.5.3 Perform CHANNEL CALIBRATION.

18 months D.1 D.

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-51 Amendment 36 Table 3.3.5-1 (page 1 of 1)

LOP DG Start Instrumentation FUNCTION REQUIRED CHANNELS PER BUS SURVEILLANCE REQUIREMENTS TRIP SETPOINT ALLOWABLE VALUE 1.

6.9 kV Emergency Bus Undervoltage (Loss of Voltage)

a. Bus Undervoltage

b. Time Delay 3

2 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 5994 V and 6006 V 0.73 sec and 0.77 sec 5967.6 V 0.58 sec and 0.94 sec 2.

6.9 kV Emergency Bus Undervoltage (Degraded Voltage)

a. Bus Undervoltage

b. Time Delay 3.

Diesel Generator Start 4.

Load Shed 3

2 2

4 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.1 SR 3.3.5.2 6593.4 V and 6606.6 V 9.73 sec and 10.27 sec 4733.4 V and 4926.6 V with an internal time delay of 0.46 sec and 0.54 sec 4733.4 V and 4926.6 V with an internal time delay of 2.79 sec and 3.21 sec 6570 V 9.42 sec and 10.49 sec 2295.6 V with an internal time delay of 0.56 sec at zero volts.

2295.6 V with an internal time delay of 3.3 sec at zero volts.

5. 6.9 kV Emergency Bus 3 SR 3.3.5.1 1.30 V at 2.95 sec (Permissive Alarm) 1.5 V at 3 sec (Permissive Alarm)

Undervoltage (Unbalanced Voltage) SR 3.3.5.2 2.96 V at 9.95 sec (Lo) 3.3 V at 10 sec (Lo)

SR 3.3.5.3 18.13 V at 3.95 sec (High) 20.0 V at 4 sec (High)

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-51 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG Start Instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

NOTE-------------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one channel per bus inoperable.

NOTE-------------------

Enter applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for Auxiliary Feedwater Start Instrumentation made inoperable by LOP DG Start Instrumentation.

A.1 Restore channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B. One or more Functions with two or more channels per bus inoperable.

B.1 Restore all but one channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

NOTE------------

Not applicable to Function 5.

NOTE------------

Not applicable to Function 5.

NOTE------------

Only applicable to Function 5.

C. One or more Functions with one channel per bus inoperable C.1 Restore channel to OPERABLE status 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-52 ACTIONS continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion Time not met.

C.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately SURVEILLANCE REQUIREMENTS

NOTE-------------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE------------------------------

Verification of relay setpoints not required.

Perform TADOT.

92 days SR 3.3.5.2 Perform CHANNEL CALIBRATION.

6 months SR 3.3.5.3 Perform CHANNEL CALIBRATION.

18 months D.

D.1

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-53 Table 3.3.5-1 (page 1 of 1)

LOP DG Start Instrumentation FUNCTION REQUIRED CHANNELS PER BUS SURVEILLANCE REQUIREMENTS TRIP SETPOINT ALLOWABLE VALUE 1.

6.9 kV Emergency Bus Undervoltage (Loss of Voltage) a.

Bus Undervoltage 3

SR 3.3.5.1 SR 3.3.5.2 5994 V and 6006 V 5967.6 V b.

Time Delay 2

SR 3.3.5.3 0.73 sec and 0.77 sec 0.58 sec and 0.94 sec 2.

6.9 kV Emergency Bus Undervoltage (Degraded Voltage) a.

Bus Undervoltage 3

SR 3.3.5.1 SR 3.3.5.2 6593.4 V and 6606.6 V 6570 V b.

Time Delay 2

SR 3.3.5.3 9.73 sec and 10.27 sec 9.42 sec and 10.49 sec 3.

Diesel Generator Start 2

SR 3.3.5.1 SR 3.3.5.2 4733.4 V and 4926.6 V with an internal time delay of 0.46 sec and 0.54 sec 2295.6 V with an internal time delay of 0.56 sec at zero volts 4.

Load Shed 4

SR 3.3.5.1 SR 3.3.5.2 4733.4 V and 4926.6 V with an internal time delay of 2.79 sec and 3.21 sec 2295.6 V with an internal time delay of 3.3 sec at zero volts.

5. 6.9 kV Emergency Bus 3 SR 3.3.5.1 1.30 V at 2.95 sec (Permissive Alarm) 1.5 V at 3 sec (Permissive Alarm)

Undervoltage (Unbalanced Voltage) SR 3.3.5.2 2.96 V at 9.95 sec (Lo) 3.3 V at 10 sec (Lo)

SR 3.3.5.3 18.13 V at 3.95 sec (High) 20.0 V at 4 sec (High)

.3 - Proposed TS Bases Changes (Mark-Ups) for WBN, Units 1 and 2 CNL-17-034 A4.3 - 1

LOP DG Start Instrumentation B 3.3.5 (continued)

Watts Bar-Unit 1 B 3.3-147 Amendment 36 Revision 48 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs in the switchyard. There are four LOP start signals, one for each 6.9 kV shutdown board.

Three degraded voltage relays (one per phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained undervoltage condition. The relays are combined in a two-out-of-three logic configuration to generate a supply breaker trip signal if the voltage is below 96% for 10 seconds (nominal). Additionally, three undervoltage relays (one per phase) are provided on each 6.9 kV Shutdown Board for the purpose of detecting a loss of voltage condition. These relays are combined in a two-out-of-three logic to generate a supply breaker trip signal if the voltage is below 87% for 0.75 seconds (nominal).

Once the supply breakers have been opened, either one of two induction disk type relays, which have a voltage setpoint of 70% of 6.9 kV (nominal, decreasing) and an internal time delay of 0.5 seconds (nominal) at zero volts, will start the diesel generators. Four additional induction disk type relays, in a logic configuration of one-of-two taken twice which have a voltage setpoint of 70% of 6.9 kV (nominal, decreasing) and an internal time delay of 3 seconds (nominal), at zero volts, will initiate load shedding of the 6.9 kV shutdown board loads and selected loads on the 480 V shutdown boards and close the 480 V shutdown boards' current limiting reactor bypass breaker. The LOP start actuation is described in FSAR Section 8.3, "Onsite (Standby) Power System" (Ref. 1).

Trip Setpoints and Allowable Values The Trip Setpoints used in the relays and timers are based on the analytical limits presented in TVA calculations, References 3, 5, and 6. The selection of these Trip Setpoints is such that adequate protection is provided when all sensor and time delays are taken into account.

Three unbalanced voltage relays are provided on each 6.9 kV Shutdown Board for detecting an unbalanced voltage condition which could signal an open phase condition is present. The relays are combined in a permissive one-out-of-two logic configuration to generate a supply breaker trip (Ref. 7). A permissive one-out-of-two trip logic is defined as a trip of the "Alarm" relay and either the "High" or "Low" relay.

6, 7, and 8.

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar-Unit 1 B 3.3-149 APPLICABLE The channels of LOP DG start instrumentation, in conjunction with the ESF SAFETY ANALYSES systems powered from the DGs, provide unit protection in the event of any of the (continued) analyzed accidents discussed in Reference 2, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," include the appropriate DG loading and sequencing delay.

The LOP DG start instrumentation channels satisfy Criterion 3 of the NRC Policy Statement.

LCO The LCO for LOP DG Start Instrumentation requires that the loss of voltage, degraded voltage, load shed, and DG Start Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG Start Instrumentation supports safety systems associated with the ESFAS. In MODES 5 and 6, the Functions must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents.

During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.

unbalanced voltage,

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar-Unit 1 B 3.3-150 APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES.

Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an LOP or a degraded voltage condition on the 6.9 kV Shutdown Board.

ACTIONS In the event a channel's Trip Setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the Function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection Function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the LOP DG start Function with one channel per bus inoperable.

If one channel is inoperable, Required Action A.1 requires the channel to be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The specified Completion Time is reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.

A Note has been added to Required Action A.1 to direct entry into the applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for inoperable Auxiliary Feedwater start instrumentation. The load shed relays required by this LCO also generate the start signal for the LOP start of the A Note has been added to Condition A which states that this Condition is not applicable to Function 5 of Table 3.3.5-1.

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar-Unit 1 B 3.3-151 ACTIONS A.1 (continued) turbine driven auxiliary feedwater pump required in LCO 3.3.2. The Required Actions of LCO 3.3.2 are entered in addition to the requirements of this LCO.

B.1 Condition B applies when more than one channel on a single bus is inoperable.

Required Action B.1 requires restoring all but one channel to OPERABLE status.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources Operating," or LCO 3.8.2, "AC SourcesShutdown," for the DG made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

SURVEILLANCE A Note has been added to refer to Table 3.3.5-1 to determine which Surveillance REQUIREMENTS Requirements apply for each LOP Function.

SR 3.3.5.1 SR 3.3.5.1 is the performance of a TADOT. This test is performed every 92 days.

The test checks operation of the undervoltage and degraded voltage relays that provide actuation signals. The Frequency is based on the known reliability of the relays and timers and the redundancy available, and has been shown to be acceptable through operating experience.

C.1 Condition C applies to the LOP Diesel Start function for unbalanced voltage with one channel per bus inoperable.

A note has been added which states that Condition C is only applicable to Function 5 of Table 3.3.5-1.

Required Action C.1 requires restoring all unbalanced voltage relays to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occurring during this interval.

, degraded voltage, and unbalanced voltage A Note has been added to Condition A which states that this Condition is not applicable to Function 5 of Table 3.3.5-1.

D.1 D

, B, or C

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar-Unit 1 B 3.3-152 SURVEILLANCE SR 3.3.5.1 (continued)

REQUIREMENTS This SR has been modified by a Note that excludes verification of setpoints for relays/timers. Relay/timer setpoints require elaborate bench calibration and are verified during a CHANNEL CALIBRATION.

SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

A CHANNEL CALIBRATION is performed every 6 months. CHANNEL CALIBRATION is a check of the four functions. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency of 6 months is based on operating experience and is justified by the assumption of a 6 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

, a degraded voltage, and an unbalanced voltage

LOP DG Start Instrumentation B 3.3.5 BASES Watts Bar-Unit 1 B 3.3-153 SURVEILLANCE SR 3.3.5.3 REQUIREMENTS (continued)

SR 3.3.5.3 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the four functions. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

The Frequency of 18 months is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

REFERENCES 1.

Watts Bar FSAR, Section 8.3, "Onsite (Standby) Power System."

2.

Watts Bar FSAR, Section 15.0, "Accident Analysis."

3.

TVA Calculation WPE2119202001, "6.9 kV Shutdown and Logic Boards Undervoltage Relays Requirements/Demonstrated Accuracy Calculation."

4.

Technical Requirements Manual, Section 3.3.2, "Engineered Safety Feature Response Times."

5.

TVA Calculation TDR SYS.211-LV1, "Demonstrated Accuracy Calculation TDR SYS.211-LV1."

6.

TVA Calculation TDR SYS.211-DS1, "Demonstrated Accuracy Calculation TDR SYS.211-DS1."

, a degraded voltage, and an unbalanced voltage

7. TVA Calculation IDQ0002112016000801, "Determination of Unbalance Voltage Relay Analytical Limits"

8. TVA Calculation IDQ0002112016000800, "Demonstrated Accuracy Calculation for Voltage Unbalance Relays"

LOP DG Start Instrumentation B 3.3.5 (continued)

Watts Bar - Unit 2 B 3.3-144 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation.

Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs in the switchyard. There are four LOP start signals, one for each 6.9 kV shutdown board.

Three degraded voltage relays (one per phase) are provided on each 6.9 kV Shutdown Board for detecting a sustained undervoltage condition.

The relays are combined in a two-out-of-three logic configuration to generate a supply breaker trip signal if the voltage is below 96% for 10 seconds (nominal). Additionally, three undervoltage relays (one per phase) are provided on each 6.9 kV Shutdown Board for the purpose of detecting a loss of voltage condition. These relays are combined in a two-out-of-three logic to generate a supply breaker trip signal if the voltage is below 87% for 0.75 seconds (nominal).

Once the supply breakers have been opened, either one of two induction disk type relays, which have a voltage setpoint of 70% of 6.9 kV (nominal, decreasing) and an internal time delay of 0.5 seconds (nominal) at zero volts, will start the diesel generators. Four additional induction disk type relays, in a logic configuration of one-of-two taken twice which have a voltage setpoint of 70% of 6.9 kV (nominal, decreasing) and an internal time delay of 3 seconds (nominal), at zero volts, will initiate load shedding of the 6.9 kV shutdown board loads and selected loads on the 480 V shutdown boards and close the 480 V shutdown boards' current limiting reactor bypass breaker. The LOP start actuation is described in FSAR Section 8.3, "Onsite (Standby) Power System" (Ref. 1).

Trip Setpoints and Allowable Values The Trip Setpoints used in the relays and timers are based on the analytical limits presented in TVA calculations (References 3, 4, and 5).

The selection of these Trip Setpoints is such that adequate protection is provided when all sensor and time delays are taken into account.

The actual nominal Trip Setpoint entered into the relays is more conservative than that required by the Allowable Value. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE.

Three unbalanced voltage relays are provided on each 6.9 kV Shutdown Board for detecting an unbalanced voltage condition which could signal an open phase condition is present. The relays are combined in a permissive one-out-of-two logic configuration to generate a supply breaker trip (Ref. 6). A permissive one-out-of-two trip logic is defined as a trip of the "Alarm" relay and either the "High" or "Low" relay.

5, 6, and 7

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar - Unit 2 B 3.3-146 APPLICABLE SAFETY ANALYSES (continued)

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," include the appropriate DG loading and sequencing delay.

The LOP DG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO for LOP DG Start Instrumentation requires that the loss of voltage, degraded voltage, load shed, and DG Start Functions shall be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG Start Instrumentation supports safety systems associated with the ESFAS. In MODES 5 and 6, the Functions must be OPERABLE whenever the associated DG is required to be OPERABLE to ensure that the automatic start of the DG is available when needed. Loss of the LOP DG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the DG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required DG must be OPERABLE so that it can perform its function on an LOP or a degraded voltage condition on the 6.9 kV Shutdown Board.

ACTIONS In the event a channel's Trip Setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the Function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection Function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

unbalanced voltage,

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar - Unit 2 B 3.3-147 ACTIONS (continued)

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies to the LOP DG start Function with one channel per bus inoperable.

If one channel is inoperable, Required Action A.1 requires the channel to be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The specified Completion Time is reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.

A Note has been added to Required Action A.1 to direct entry into the applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for inoperable Auxiliary Feedwater start instrumentation.

The load shed relays required by this LCO also generate the start signal for the LOP start of the turbine driven auxiliary feedwater pump required in LCO 3.3.2. The Required Actions of LCO 3.3.2 are entered in addition to the requirements of this LCO.

B.1 Condition B applies when more than one channel on a single bus is inoperable.

Required Action B.1 requires restoring all but one channel to OPERABLE status. The 1-hour Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.

C.1 Condition C applies to the LOP Diesel Start function for unbalanced voltage with one channel per bus inoperable.

A note has been added which states that Condition C is only applicable to Function 5 of Table 3.3.5-1.

Required Action C.1 requires restoring all unbalanced voltage relays to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time takes into account the low probability of an event requiring a LOP start occurring during this interval.

A Note has been added to Condition A which states that this Condition is not applicable to Function 5 of Table 3.3.5-1.

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar - Unit 2 B 3.3-148 ACTIONS (continued)

C.1 Condition C applies to each of the LOP DG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources

- Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG made inoperable by failure of the LOP DG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

SURVEILLANCE REQUIREMENTS A Note has been added to refer to Table 3.3.5-1 to determine which Surveillance Requirements apply for each LOP Function.

SR 3.3.5.1 SR 3.3.5.1 is the performance of a TADOT. This test is performed every 92 days. The test checks operation of the undervoltage and degraded voltage relays that provide actuation signals. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as left and as found setting are consistent with those established by the setpoint methodology. The Frequency is based on the known reliability of the relays and timers and the redundancy available, and has been shown to be acceptable through operating experience.

This SR has been modified by a Note that excludes verification of setpoints for relays/timers. Relay/timer setpoints require elaborate bench calibration and are verified during a CHANNEL CALIBRATION.

SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

, degraded voltage, and unbalanced voltage

, a degraded voltage, and an unbalanced voltage D.1 D

, B, or C

LOP DG Start Instrumentation B 3.3.5 BASES Watts Bar - Unit 2 B 3.3-149 (continued)

SURVEILLANCE REQUIREMENTS SR 3.3.5.2 (continued)

A CHANNEL CALIBRATION is performed every 6 months. CHANNEL CALIBRATION is a check of the four functions. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as left and as found setting are consistent with those established by the setpoint methodology.

The Frequency of 6 months is based on operating experience and is justified by the assumption of a 6-month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.5.3 SR 3.3.5.3 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the four functions. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. There is a plant specific program which verifies that the instrument channel functions as required by verifying the as left and as found setting are consistent with those established by the setpoint methodology.

The Frequency of 18 months is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18-month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

, a degraded voltage, and an unbalanced voltage

LOP DG Start Instrumentation B 3.3.5 BASES (continued)

Watts Bar - Unit 2 B 3.3-150 REFERENCES

1.

Watts Bar FSAR, Section 8.3, "Onsite (Standby) Power System."

2.

Watts Bar FSAR, Section 15.0, "Accident Analysis."

3.

TVA Calculation WBPE2119202001, "6.9 kV Shutdown & Logic Boards Undervoltage Relays Requirements / Demonstrated Accuracy Calculation."

4.

TVA Calculation TDR SYS.211-LV1, "Demonstrated Accuracy Calculation TDR SYS.211-LV1."

5.

TVA Calculation TDR SYS.211-DS1, "Demonstrated Accuracy Calculation TDR SYS.211-DS1."

6. TVA Calculation IDQ0002112016000801, "Determination of Unbalance Voltage Relay Analytical Limits"

7. TVA Calculation IDQ0002112016000800, "Demonstrated Accuracy Calculation for Voltage Unbalance Relays"

.4 - Proposed TS Changes (Clean) for WBN, Units 1 and 2 CNL-17-034 A4.4 - 1

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-49 Amendment XX 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG Start Instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

NOTE------------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE--------------

Not applicable to Function 5 A.

One or more Functions with one channel per bus inoperable.

NOTE--------------------

Enter applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for Auxiliary Feedwater Start Instrumentation made inoperable by LOP DG Start Instrumentation.

A.1 Restore channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

NOTE--------------

Not applicable to Function 5 B.

One or more Functions with two or more channels per bus inoperable.

B.1 Restore all but one channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-50 Amendment XX ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE--------------

Only applicable to Function 5 C. One or more Functions with one channel per bus inoperable.

C.1 Restore channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months D.

Required Action and associated Completion Time not met.

D.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately SURVEILLANCE REQUIREMENTS

NOTE------------------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE---------------------------

Verification of relay setpoints not required.

Perform TADOT.

92 days SR 3.3.5.2 Perform CHANNEL CALIBRATION.

6 months SR 3.3.5.3 Perform CHANNEL CALIBRATION.

18 months

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-51 Amendment XX Table 3.3.5-1 (page 1 of 2)

LOP DG Start Instrumentation FUNCTION REQUIRED CHANNELS PER BUS SURVEILLANCE REQUIREMENTS TRIP SETPOINT ALLOWABLE VALUE

1.

6.9 kV Emergency Bus Undervoltage (Loss of Voltage)

a. Bus Undervoltage

b. Time Delay 3

2 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 5994 V and 6006 V 0.73 sec and 0.77 sec 5967.6 V 0.58 sec and 0.94 sec

2.

6.9 kV Emergency Bus Undervoltage (Degraded Voltage)

a. Bus Undervoltage

b. Time Delay

3.

Diesel Generator Start

4.

Load Shed 3

2 2

4 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.1 SR 3.3.5.2 6593.4 V and 6606.6 V 9.73 sec and 10.27 sec 4733.4 V and 4926.6 V with an internal time delay of 0.46 sec and 0.54 sec 4733.4 V and 4926.6 V with an internal time delay of 2.79 sec and 3.21 sec 6570 V 9.42 sec and 10.49 sec 2295.6 V with an internal time delay of 0.56 sec at zero volts.

2295.6 V with an internal time delay of 3.3 sec at zero volts.

LOP DG Start Instrumentation 3.3.5 Watts Bar-Unit 1 3.3-51a Amendment 36, XX Table 3.3.5-1 (page 2 of 2)

LOP DG Start Instrumentation FUNCTION REQUIRED CHANNELS PER BUS SURVEILLANCE REQUIREMENTS TRIP SETPOINT ALLOWABLE VALUE

5.

6.9 kV Emergency Bus Undervoltage (Unbalanced Voltage) 3 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 1.30 V at 2.95 sec (Permissive Alarm) 2.96 V at 9.95 sec (Lo) 18.13 V at 3.95 sec (High) 1.5 V at 3 sec (Permissive Alarm) 3.35 V at 10 sec (Lo) 20.0 V at 4 sec (High)

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-51 Amendment XX 3.3 INSTRUMENTATION 3.3.5 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation LCO 3.3.5 The LOP DG Start Instrumentation for each Function in Table 3.3.5-1 shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4, When associated DG is required to be OPERABLE by LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS

NOTE-------------------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE--------------

Not applicable to Function 5 A. One or more Functions with one channel per bus inoperable.

NOTE-------------------

Enter applicable Conditions and Required Actions of LCO 3.3.2, "ESFAS Instrumentation," for Auxiliary Feedwater Start Instrumentation made inoperable by LOP DG Start Instrumentation.

A.1 Restore channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (continued)

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-52 Amendment XX ACTIONS continued)

CONDITION REQUIRED ACTION COMPLETION TIME

NOTE--------------

Not applicable to Function 5 B. One or more Functions with two or more channels per bus inoperable.

B.1 Restore all but one channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

NOTE--------------

Only applicable to Function 5 C. One or more Functions with one channel per bus inoperable.

C.1 Restore channel to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months D. Required Action and associated Completion Time not met.

D.1 Enter applicable Condition(s) and Required Action(s) for the associated DG made inoperable by LOP DG start instrumentation.

Immediately

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-52a Amendment XX SURVEILLANCE REQUIREMENTS

NOTE-------------------------------------------------------------

Refer to Table 3.3.5-1 to determine which SRs apply for each LOP Function.

SURVEILLANCE FREQUENCY SR 3.3.5.1

NOTE------------------------------

Verification of relay setpoints not required.

Perform TADOT.

92 days SR 3.3.5.2 Perform CHANNEL CALIBRATION.

6 months SR 3.3.5.3 Perform CHANNEL CALIBRATION.

18 months

LOP DG Start Instrumentation 3.3.5 Watts Bar - Unit 2 3.3-53 Amendment XX Table 3.3.5-1 (page 1 of 1)

LOP DG Start Instrumentation FUNCTION REQUIRED CHANNELS PER BUS SURVEILLANCE REQUIREMENTS TRIP SETPOINT ALLOWABLE VALUE

1.

6.9 kV Emergency Bus Undervoltage (Loss of Voltage)

a.

Bus Undervoltage 3

SR 3.3.5.1 SR 3.3.5.2 5994 V and 6006 V 5967.6 V

b.

Time Delay 2

SR 3.3.5.3 0.73 sec and 0.77 sec 0.58 sec and 0.94 sec

2.

6.9 kV Emergency Bus Undervoltage (Degraded Voltage)

a.

Bus Undervoltage 3

SR 3.3.5.1 SR 3.3.5.2 6593.4 V and 6606.6 V 6570 V

b.

Time Delay 2

SR 3.3.5.3 9.73 sec and 10.27 sec 9.42 sec and 10.49 sec

3.

Diesel Generator Start 2

SR 3.3.5.1 SR 3.3.5.2 4733.4 V and 4926.6 V with an internal time delay of 0.46 sec and 0.54 sec 2295.6 V with an internal time delay of 0.56 sec at zero volts

4.

Load Shed 4

SR 3.3.5.1 SR 3.3.5.2 4733.4 V and 4926.6 V with an internal time delay of 2.79 sec and 3.21 sec 2295.6 V with an internal time delay of 3.3 sec at zero volts.

5.

6.9 kV Emergency Bus Undervoltage (Unbalanced Voltage) 3 SR 3.3.5.1 SR 3.3.5.2 SR 3.3.5.3 1.30 V at 2.95 sec (Permissive Alarm) 2.96 V at 9.95 sec (Lo) 18.13 V at 3.95 sec (High) 1.5 V at 3 sec (Permissive Alarm) 3.35 V at 10 sec (Lo) 20.0 V at 4 sec (High)

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 1 Per WBN UFSAR Section 8.1.2:

8.1.2 Plant Electrical Power System The plant electric power system consists of the main generators, the unit station service transformers, the common station service transformers, the diesel generators, the batteries, and the electric distribution system as shown on Figures 8.1-2, 8.1-2A, 8.1-2B, and 8.1-3. Under normal operating conditions, the main generators supply electrical power through isolated-phase buses to the main step-up transformers and through the unit station service transformers (located adjacent to the Turbine Building) to the non-safety auxiliary power system. Offsite electrical power normally supplies Class 1E circuits through the 161-kV system via Common Station Service Transformers (CSSTs)

C and D. Alternatively, offsite power to the Class 1E system can also be supplied through CSSTs B or A, but not both simultaneously, if the normal CSST is unavailable.

The primaries of the unit station service transformers are connected to the isolated-phase bus at a point between the generator terminals and the low-voltage connection of the main transformers. During normal operation, station auxiliary power is taken from the main generator through the unit station service transformers and from the 161-kV system through the common station service transformers. During startup and shutdown, all auxiliary power is supplied from the 161-kV system through CSSTs A, B, C and D.

The standby (onsite) power is supplied by four diesel generators. Capability is also provided to supply the Class 1E circuits through the 161kV system via CSST A or B in the event CSST D or C, respectively, is unavailable.

The safety objective for the power system is to furnish adequate electric power to ensure that safety related loads function in conformance with design criteria and design bases.

Major loads on the electric power system having assigned safety related functions are shown in Table 8.1-1.

The safety objective has been accomplished by: (1) establishing design criteria and bases that conform to regulatory documents and accepted design practice, and (2) implementation of these criteria and bases in a manner that assures a system design and a constructed plant which satisfies all safety requirements. The applicable documents governing the design are shown in Section 8.1.5.

Figures 8.1-2 and 8.1-2A depict the plant distribution system that receives ac power from:

(a)

The two nuclear power units.

(b)

The two independent preferred (offsite) power circuits, which have access to the TVA transmission network, and in turn have multiple interties with other transmission networks.

(c)

The four 4400kW diesel generator standby (onsite) power sources.

The power received from the above sources is distributed to both safety related and non-safety related loads in the plant.

The safety related loads are arranged electrically into four power trains, two for each nuclear unit. Power trains 1A and 2A comprise load group A. Power trains 1B and 2B comprise load group B. Two diesel generators and one load group can provide all safety related functions to mitigate a LOCA in one unit and safely shutdown the other unit.

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 2 Each power train of each unit has access to a diesel generator (standby source) and each of the two preferred offsite sources.

Per WBN UFSAR Section 8.2.1 8.2.1 Description Preferred offsite power is supplied from TVA's 161kV transmission grid at Watts Bar Hydro Plant (WBH) switchyard over two separate transmission lines, each connecting to two 161-6.9-kV common station service transformers (CSSTs) at Watts Bar Nuclear Plant (WBN). The Class 1E power system is normally supplied from offsite power through CSSTs C and D. For flexibility, there is also a maintenance feed available from CSSTs A and B to the Class 1E power systems which can be used when CSST C or D is out of service during any operating mode.

The Class 1E power system can be transferred from the offsite normal power supply to the offsite alternate and maintenance power supply to demonstrate operability of the board transfer. Transfers from the normal supply to the alternate supply may be manual or automatic. Automatic transfers from the normal power supply to the alternate power supply are initiated by any transformer or line failure relays.

8.2.1.1 Preferred Power System The features of the offsite power system are shown in Figure 8.2-1, Development Single Line Diagram. Preferred power is supplied from the existing Watts Bar Hydro 161kV switchyard over two 161kV overhead lines approximately 1.5 miles long, located entirely on TVA property. These two transmission lines are supported on separate towers, and the separation of the two lines is sufficient to ensure that the failure of any tower in one line will not endanger the other line.

The Watts Bar Hydro 161kV switchyard bus arrangement is designed so that the loss of any one of the four main bus sections will not cause loss of power to either of the two preferred power source lines to the nuclear plant. The Watts Bar Hydro Plant switchyard is interconnected with the TVA power system through six 161kV transmission lines and the five Watts Bar Hydro generators, as shown on the development single line, Figure 8.2-1A. This switchyard also provides connections to the four inactive steam-driven generators in the Watts Bar Steam Plant.

8.2.1.3 Arrangement of the Start Boards, Unit Boards, Common Boards, and Reactor Coolant Pump (RCP) Boards From the low-voltage side of common station service transformers A and B, 6.9kV station service buses supply the 6.9kV common, unit, and RCP boards via the 6.9kV start boards. The station service (start) buses are outdoor, non-segregated, partially ventilated, metal-clad structures and are shown on Figure 8.2-5. At the 6.9kV starboard, these buses enter the outdoor metal-clad switchgear and connect to supply breakers.

The design of the 6.9kV start boards and RCP boards conforms to ANSI, C37.20 (Standard for Switchgear Assemblies including Metal-Enclosed Bus) and is classified as outdoor metal-clad switchgear. Section 20, 6.2.2 of this standard defines the requirements for barriers. The circuit breakers at the 6.9kV start boards are electrically operated, vertical lift drawout type, with stored energy mechanisms.

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 3 These circuit breakers have a continuous rating of 3,000 and 3,750 amperes for the RCP Start Bus breakers and Start Buses A and B breakers, respectively, an insulation system for 13.8kV, interrupting rating of 1,000 MVA, and a momentary rating of 80,000 amperes. The circuit breakers are utilized at 6.9kV. Therefore, there is sufficient margin between the application and the rating of these circuit breakers.

From the 6.9-kV start board the two 6.9kV start buses A and B and the two 6.9kV RCP start buses A and B run on separate support structures as outdoor, nonsegregated, partially ventilated metal-clad assemblies (Figure 8.2-5). The bus bars are fully insulated with flame-retardant material, bus supports are flame-retardant, and the metal enclosures are such that arcing faults in one bus will not endanger the other. The 6.9kV RCP start buses enter the RCP outdoor metal-clad switchgear and connect to supply breakers.

The four unit station service transformers are located in the transformer yard, south of the Turbine Building and directly under the delta section of the main generator isolated-phase bus. Location of the unit station service transformers is shown on Figure 8.2-5.

From each of the unit station service transformer low-voltage sides two 6.9kV buses originate, one running in the switchyard parallel to the south wall of the Turbine Building and connecting to the RCP switchgear, and the other entering the south Turbine Building wall for routing to the unit and common boards. The unit station service buses are outdoor, non-segregated, partially ventilated, metal-clad construction until they enter the Turbine Building, where the construction changes to indoor type. After entering the Turbine Building, the unit station service buses are routed to the appropriate supply breakers in the 6.9kV unit and 6.9kV common boards, entering through the tops of the 6.9kV unit boards and the bottoms of the 6.9kV common boards. The 6.9kV unit and common boards are indoor, metal-clad switchgear with electrically operated, vertical lift drawout breakers with stored energy mechanisms.

8.2.1.8 Conformance with Standards This section discusses provisions included in the design of the offsite (preferred) power system to achieve a system design in conformance with requirements of GDC 17, GDC 18, and NRC Regulatory Guides 1.6 and 1.32 Functional Measures Compliance with GDC 17 is discussed in the following paragraphs.

Each of the two 161kV circuits providing offsite power to Watts Bar Nuclear Plant is supplied through two power circuit breakers connecting with separate sections of the main bus in the WBH Plant switchyard. The two overhead transmission lines are routed to minimize the probability of their simultaneous failure. Each 161kV line terminates at a pair of 161 - 6.9-kV common station service transformers (A and D, and B and C, respectively). Each pair of transformers, as well as the buses and cables that are used to connect them to the onsite power (standby) distribution system at the 6.9kV shutdown boards are physically and electrically independent.

Each of the 6.9kV shutdown boards is connected to the offsite power circuits via common station service transformer (CSST) C or D through the 6.9-kV shutdown boards

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 4 normal or alternate supply breakers. For a loss of power from either CSST C or D not due to a fault in the CSST differential zone of protection, under this alignment, the affected 6.9kV shutdown board loads will be disconnected from offsite power and sequentially loaded onto their respective diesel generator.

For an acceptable range of 161-kV grid conditions, either offsite power circuit can start and supply all electrical equipment that would be supplied from the Class 1E distribution systems for a design basis accident in one unit and simultaneously orderly shutdown of the other unit, and a simultaneous single worst case transmission system contingency.

For this event, transformers C or D would be operating within its OA rating and transformers A or B within its FA rating and adequate voltage would be supplied to the safety-related buses.

CSST A or B may be used a replacement for CSSTs D or C, respectively, through the 6.9kV shutdown board maintenance supply breakers. CSST A and B each have sufficient rated capacity to maintain adequate voltage for one train of shutdown boards for each unit while supplying required BOP loads for a design basis accident in one unit and safe shutdown of the other unit. When USSTs are used the affected shutdown board maintenance feeders are supplied from the USSTs through the Unit Boards and are automatically transferred to CSST A or B in the event of a unit trip. Use of CSST A or B as an offsite source requires that CSST A and B both be available and that the associated power and control feeders be in their normal positions to ensure independence. Due to independence limitations, CSST A and B cannot be credited for supply of both offsite power sources simultaneously. Feeders for CSST A are independent of those for CSST C and feeders for CSST B are independent of those for CSST D. Supply of Class 1E power by CSST A or B requires manual breaker operations to align the CSST source to the applicable shutdown board maintenance feeders.

A load-shedding scheme is provided to reduce the BOP loads under certain conditions, but no credit is taken for load shedding in the TSS.

The BOP load-shedding scheme trips selected loads if both Unit 1 and 2 generators are tripped and either CSST A or B is out of service. Initiation of load shedding is accomplished automatically by undervoltage at transformer secondary Y-winding of either CSST A or B, and both Unit 1 and 2 generators tripped. Two reactor coolant pumps per unit are tripped when the above conditions exist. Tripping of these loads results in a significant reduction (50% of the reactor coolant pumps) of the station load.

The load-shedding scheme consists of two redundant trip and lockout circuits for each circuit breaker receiving a load-shed command. The redundant load-shedding circuits are located in different 6.9kV start boards. One load-shedding circuit associated with CSST A is in 6.9-kV start board A, and the other which is associated with CSST B is in 6.9kV start board B. Control power to the redundant auxiliary power system (APS) load-shedding circuits is provided from separated 250V dc batteries and battery boards. APS load-shedding circuit 1 receives control power from 250V DC Battery 1 via 250V Turbine Building Board 1, and APS circuit 2 from 250V DC Battery 2 via 250V Turbine Building Board 2. Loss of control power to either 250V Turbine Building Board initiates automatic transfer from the normal dc supply to the alternate dc supply with annunciation that auto transfer has occurred. This maximizes the ability of the load-shedding scheme to operate if grid and generator conditions warrant such operation.

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 5 The 6.9kV shutdown boards are provided with loss-of-voltage and degraded-voltage relays that initiate transfer from the normal supply, to the standby (diesel generator) power supply. If the standby supply is paralleled with one of the offsite supplies for testing, loss of the standby supply would cause reverse power relays to trip the standby circuit breaker.

For a loss of offsite power during diesel generator testing, the diesel generator will switch to the emergency mode of operation. If an accident signal is initiated during testing of the standby supply, the standby breaker is tripped and the emergency loads are automatically energized by the offsite power supply. Should a LOCA and a loss of offsite power occur when a diesel generator is paralleled with the grid under test, its 6.9kV shutdown board standby and supply breakers are tripped, load shedding occurs and the diesel generator sequencer will load the accident loads. Only one diesel generator will be in the test mode (i.e., operated in parallel with the offsite power supply) at any given time unless both units are in cold shutdown or not fueled; then, both diesels of the same train may be in test. Therefore, loss of any onsite power generation will not prevent the distribution system from being powered from the offsite circuits.

Common station service transformers C and D both have two 6.9kV secondary windings with automatic high-speed load-tap changer units. Each secondary of the transformer is the normal power supply for one 6.9kV shutdown board in each unit. Each secondary is also the alternate power supply for the opposite train, opposite unit 6.9kV shutdown board in each unit.

The impedance between the two 6.9kV secondary windings is more than 93% of the sum of the H to X and H to Y winding impedances, (H refers to the primary winding).

The loading on one 6.9kV winding has little effect on the voltage at the other winding, although this effect was considered in establishing grid interface requirements.

Overcurrent relaying and loss-of-voltage relaying for the shutdown boards are coordinated so that a faulted or overloaded bus will not be transferred from one preferred power circuit to another because of depressed voltage resulting from the fault or overload. For the range of grid conditions identified as acceptable, loss of power from one offsite power circuit, whether from failure at the transmission grid interface, failure of any part of the preferred power circuit itself, or failure of part of the onsite distribution system, will not cause loss or degradation of the other offsite power circuit. CSST A, B, C, and D trips are initiated by any transformer or line failure relay such as fault-pressure, transformer-overcurrent, ground-current, line-protection, or differential relaying. Initiation of a CSST trip by these protective devices also causes automatic fast transfer of the 6.9kV shutdown boards normally supplied from that CSST to their alternate supplies.

The design of the control power feeders to 6.9kV common switchgear C and D and to 6.9kV shutdown boards ensures compliance with GDC 17, i.e., a loss of control power will not result in a loss of power from CSSTs C and D which provide ac power to Train A and Train B shutdown boards respectively. Specifically, 6.9kV common switchgear C that normally provides ac power to Train A 6.9kV shutdown board receives control power from the vital battery that provides control power to the Train A 6.9kV shutdown board. Similarly, the control power to 6.9kV common switchgear D is from the vital battery that provides control power to Train B 6.9kV shutdown board.

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 6 The 6.9kV common switchgear C (circuit breakers 1712 and 2714) and 6.9kV shutdown board 1A-A feeder breakers 1716, 1718, and 1932 receive normal control power from 125VDC vital battery board (VBB)I. The 6.9kV common switchgear D (circuit breakers 1812 and 2814) and 6.9kV shutdown board 1B-B feeder breakers 1726, 1728, and 1934 receive normal control power from 125VDC VBBII. A design basis loss of VBBI and a single failure of VBBII (loss of control power) will result in the inability to automatically trip 6.9kV common switchgear C and D, respectively, and will inhibit the automatic transfer of the respective 6.9kV shutdown board until manual transfer to the alternate control power source is accomplished locally at the switchgear. However, this does not result in loss of offsite power; breakers 1712 and 2714 on 6.9kV common switchgear C or breakers 1812 and 2814 on 6.9kV common switchgear D will remain in their normally closed position.

The non-Class 1E control power circuits from the vital battery boards to 6.9kV common switchgear C and D have redundant protection (breaker and fuse) in the event of a failure. Selective coordination exists between the non-Class 1E and Class 1E circuits that are fed from each of the vital battery boards. Thus, failure of all of the non-Class 1E control power circuits on the vital battery boards will not have any effect on the Class 1E circuits or battery boards. WBNP is in full compliance with GDC 17.

Use of CSST B as a replacement for CSST C requires control of breakers on 6.9kV start board B and 6.9kV unit boards 1B and 2B. Similarly, use of CSST A as a replacement for CSST D requires control of breakers on 6.9kV start board A and 6.9kV unit boards 1C and 2C. These breakers are controlled with non-Class 1E 250Vdc supplied by 250Vdc Turbine Building Distribution Boards 1 and 2. The normally aligned 250Vdc power sources and control power feeders to the start boards and unit boards meet the requirements for independence of offsite sources in accordance with GDC -17.

Regulatory Guide 1.6 has been implemented by providing the two preferred source circuits are, however, shared between the two nuclear units each ac load group with a connection to each of the preferred source circuits. Figure 8.1-2 indicates that redundant power trains in each unit are fed from different preferred source circuits. The two preferred source circuits are, however, shared between the two nuclear units.

Regulatory Guide 1.32 has been implemented by providing two immediate access circuits from the transmission network. Under normal plant alignments and either two immediate access circuits or one immediate access circuit and one delayed access circuit under maintenance alignments. Figures 8.1-2, 8.1-2a, 8.1-2b, and 8.2-1 indicate the functional arrangement of these continuously energized circuits.

Normal power is supplied to the 6.9kV unit boards by the unit station service transformers; to the 6.9kV common boards A and B by CSSTs A and B, and to the 6.9kV shutdown boards by CSSTs A and B supply power to the 6.9kV unit boards and 6.9kV common boards A and B during startup or shutdown. Additionally CSST A or B may supply power to 6.9kV shutdown boards during maintenance of CSST D or C respectively in any operating mode.

Power continuity to the 6.9kV shutdown boards is normally provided from common station service transformers C and D. To provide a stable voltage these transformers have automatic load tap changers on each secondary which adjust voltage based on the normally connected shutdown boards.

.5 - Excerpts from WBN UFSAR CNL-17-034 A4.5 - 7 During maintenance of common station service transformer C or D, power continuity to the normally connected train of 6.9kV shutdown boards is provided by the boards' maintenance feeds which connect to unit boards with access to common station service transformers B or A respectively. Use of transformers A and B is restricted such that they are not simultaneously credited as an independent source of offsite power for the Class 1E power system. Common station service transformers A and B have automatic load tap changers on the primary winding which adjust voltage based on the normally connected start board.

The automatic load tap changers for all common station service transformers are normally controlled in the automatic mode with the capability for manual adjustment from the main control room.

In addition to compliance with the above standards for portions of the offsite power system, the 6.9kV start board, 6.9kV unit boards, 6.9kV RCP boards, and the associated 6.9kV buses were procured in accordance with certain TVA standards and industry standards. TVA specifications require conformance of this equipment to such standards as the following: the overall construction, ratings, tests, service conditions, etc. are required to be in conformance to ANSI C37.20 and NEMA SG-5; the power circuit breakers are referenced to ANSI C37.4 through C37.9 and NEMA SG-4; associated relays are specified to conform to ANSI C37.1, instrument transformers to ANSI C57.13 and NEMA EI-2, and wiring to IPCEA S-61-402 and NEMA WC5. The design of the equipment arrangement was also implemented to comply with GDC 3 for fire protection and with GDC 18 and Regulatory Guide 1.22 for each of periodic tests and inspections.

In accordance with GDC 18 requirements, the offsite power system has been designed to permit appropriate periodic inspection and testing. Transfers from the normal (offsite) supply to the alternate (offsite) supply, or from the normal or alternate supply to the standby supply, may be manual or automatic. Testing of these transfers while the nuclear unit is at power could result in transients that could cause tripping of the reactor or turbine. For this reason, testing of the manual and automatic sequence will be performed when the unit is shutdown. Provisions exist for individual testing of the BOP load-shedding circuits while maintaining the load-shedding capability of the circuit not being tested.

L-12-001, Application to Modify the Technical Specifications for Browns Ferry (TS-512), Sequoyah (TS-17-03), and Watts Bar (TS-17-20) to Resolve the Open Phase Issue Identified in NRC Bulletin 2012-01, Design Vulnerability in Electrical Power System

Contents

Text

Subject:

References:

Enclosure:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

Response

Response

Response

Response

Response

Navigation menu

L-12-001, Application to Modify the Technical Specifications for Browns Ferry (TS-512), Sequoyah (TS-17-03), and Watts Bar (TS-17-20) to Resolve the Open Phase Issue Identified in NRC Bulletin 2012-01, Design Vulnerability in Electrical Power System

Text

Subject:

References:

Enclosure:

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

Response

Response

Response

Response

Response

Navigation menu

Search