ML24114A137

Redacted Updated Safety Analysis Report (WCGS Usar), Revision 37, Chapter 8, Electric Power

ML24114A137
Person / Time
Site:	Wolf Creek
Issue date:	04/15/2024
From:	Wolf Creek
To:	Office of Nuclear Reactor Regulation
References
000347
Download: ML24114A137 (1)

Text

WOLF CREEK

CHAPTER 8.0

TABLE OF CONTENTS

ELECTRIC POWER

Section Title Page

8.1 INTRODUCTION

8.1-1

8.1.1 UTILITY GRID DESCRIPTION 8.1-1

8.1.2 ONSITE POWER SYSTEM DESCRIPTION 8.1-2

8.1.3 SAFETY-RELATED LOADS 8.1-3

8.1.4 DESIGN BASES 8.1-3 8.1.4.1 Offsite Power System 8.1-3 8.1.4.2 Onsite Power System 8.1-4 8.1.4.3 Design Criteria, Regulatory Guides, IEEE Standards and IE Bulletins 8.1-5 8.

1.5 REFERENCES

8.1-27

8.2 OFFSITE POWER SYSTEM 8.2-1

8.

2.1 DESCRIPTION

8.2-1 8.2.1.1 Transmission Network 8.2-2 8.2.1.2 Switchyard and Connection to the Onsite Distribution System 8.2-4 8.2.1.3 Compliance with Design Criteria and Standards 8.2-6

8.2.2 ANALYSIS 8.2-9

8.3 ONSITE POWER SYSTEMS 8.3-1

8.3.1 AC POWER SYSTEMS 8.3-1 8.3.1.1 Description 8.3-1 8.3.1.2 Analysis 8.3-25 8.3.1.3 Physical Identification of Safety-Related Equipment 8.3-25 8.3.1.4 Independence of Redundant Systems 8.3-27

8.3.2 DC POWER SYSTEMS 8.3-36 8.3.2.1 Description 8.3-36 8.3.2.2 Analysis 8.3-38

8.3.3 FIRE PROTECTION FOR CABLE SYSTEMS 8.3-45

8.

3.4 REFERENCES

8.3-45

8.0-i Rev. 29 WOLF CREEK

TABLE OF CONTENTS (Continued)

LIST OF TABLES

Table No. Title

App. 8.3A STATION BLACKOUT

8.3A.1 INTRODUCTION 8.3A-1 8.3A.2 STATION BLACKOUT GENERAL CRITERIA AND ASSUMPTION 8.3A-2 8.3A.3 WOLF CREEK BLACKOUT DURATION 8.3A-2 8.3A.4 Procedures for SBO 8.3A-5 8.3A.5 Summary for SBO Coping Assessment 8.3A-5 8.3A.6 REFERENCES 8.3A-7

8.3-1 Class IE DC System Loads

8.3-2 125 V DC Class IE Battery Loading Cycle (Amperes Required per Time Interval per Battery After Loss of AC Power) Subsystems 1 and 4

8.3-3 125 V DC Class IE Battery Loading Cycle (Amperes Required per Time Interval per Battery After Loss of AC Power) Subsystems 2 and 3

8.3-4 Failure Modes and Effects Analysis

8.3-5 Minimum Separation Distance Analysis Required by Regulatory Guide 1.75 and IEEE 384-74

8.0-ii Rev. 26 WOLF CREEK

CHAPTER 8 - LIST OF FIGURES

• Refer to Section 1.6 and Table 1.6-3. Controlled drawings wer e removed from the USAR at Revision 17 and are considered incorporated by reference.

Figure # Sheet Title Drawing #*

8.1-1 0 Southwest Power Pool Transmission System and MoKan Companies Service Area (Historical) 8.2-1 0 345 kV System 8.2-2 0 161 kV and Below KG&E Transmission System Near Wolf Creek Plant 8.2-3 0 Wolf Creek Substation General Plan KD-7750 8.2-4 0 One-Line Diagram KD-7496 8.2-5 0 Electrical One-Line Diagram of Wolf Creek 345 kV Switchyard and Adjacent Subs 8.3-1 1 Main Single Line Diagram E-11001 8.3-1 2 Single Line Diagram, Essential Service Water E-K1001 System 8.3-1 3 Single Line Diagram Site Area Loads E-1001 8.3-2 0 List of Loads Supplied by the Emergency Diesel E-11005 Generator 8.3-3 0 Logic Diagram Standby Generation Excitation E-12NE01 Control 8.3-4 0 Logic Diagram Standby Generator System E-12NE02 Protection 8.3-5 0 Logic Diagram Standby Generator Engine and E-12KJ01 Governor Control 8.3-6 1 DC Main Single Line Diagram E-11010 8.3-6 2 DC Auxiliary Power System 8.3-7 0 DC Main Single Line Diagram (PK03 and PK04 E-11010A Bus)

8.0-iii Rev.33 WOLF CREEK

CHAPTER 8.0

ELECTRIC POWER

8.1 INTRODUCTION

8.1.1 UTILITY GRID DESCRIPTION

The generator unit is connected to the respective transmission systems. The transmission system voltage is 345 kV for Wolf Creek. The utility has integrated transmission networks and interconnections with neighboring systems.

The Southwest Power Pool is the regional reliability council of which Kansas City Power & Light Company (KCPL) and Westar, Evergy companies are members. It is made up of 38 member systems, extending throughout an area covering the states of Arkansas, Louisiana, Kansas, Oklahoma and portions of Mississippi, Missouri, New Mexico and Texas. The Southwest Power Pool is highly interconnected with transmission lines of many voltages, including 345 and 500-kV. Figure 8.1-1 is a map of the Southwest Power Pool, showing its extensive transmission facilities as of January, 1979.

Kansas Electric Power Cooperative (KEPCo) is a member of the Southwest Power Pool with limited (peaking) generating capacity.

8.1-1 Rev. 32 WOLF CREEK

8.1.2 ONSITE POWER SYSTEM DESCRIPTION

The onsite power system is provided with preferred (offsite) power from the offsite system through two independent and redundant sources of power. One preferred circuit from the switchyard supplies power to a three-winding startup transformer. This startup transformer feeds two medium-voltage 13.8-kV busses and a 13.8/4.16-kV ESF transformer equipped with an automatic load tap charger (LTC). The second preferred (offsite) circuit is connected to the second 13.8/4.16-kV ESF transformer equipped with an automatic load tap changer (LTC).

Each transformer normally supplies its associated medium voltage 4.16-kV Class 1E bus. The automatic LTCs provide acceptable operating voltages to the safety related electrical distribution system under a wider range of offsite power system voltages. The onsite power system is shown in Figure 8.3-1.

The two 13.8-kV busses supply power to the nonsafety-related auxiliary loads of the unit. The 13.8-kV busses are also connected to a three-winding unit auxiliary transformer, in addition to the startup transformer. The unit auxiliary transformer is connected to the main generator through an isolated phase bus duct.

Two 4.16-kV non-Class 1E busses are supplied power from two 13.8-kV busses through two 13.8/4.16-kV station service transformers.

Non-Class 1E low-voltage 480-V loads are supplied power from two 13.8-kV busses through 480-V load centers and 480-V motor control centers.

The onsite power system is divided into two separate load groups, each load group consisting of an arrangement of busses, transformers, switching equipment, and loads fed from a common power supply. Power is supplied to auxiliaries at 13.8 kV, 4.16 kV, 480 V, 480/277 V, 208/120 V, 120 V ac, 250 V dc, and 125 V dc.

The onsite standby power system includes the Class 1E ac and dc power for equipment used to maintain a cold shutdown of the plant and to mitigate the consequences of a DBA.

Class 1E ac system loads are separated into two load groups which are powered from separate ESF transformers or two independent diesel generators (one per load group). Each load group distributes power by a 4.16-kV bus, 480-V load centers, and 480-V motor control centers.

The Class 1E dc system provides four separate 125-V dc battery supplies for Class 1E controls, instrumentation, power, and control inverters. Refer to Figure 8.3-6, sheet 1.

8.1-2 Rev. 36 WOLF CREEK

The Station Blackout Diesel Generator (SBO DG) system consists of three (3) non-safety related diesel generators that are capable of supplying essential loads on bus NB001 or bus NB002 required to reliably and safely shut down the unit following a station blackout event. The SBO DG system is also capable of supplying power to the non-safety auxiliary feedwater pump (NSAFP). Station blackout means the complete loss of alternating current (ac) electric power to the essential and nonessential switchgear buses in a nuclear power plant (i.e.,

loss of offsite electric power system concurrent with turbine trip and unavailability of the onsite emergency ac power system).

The SBO DG system is not credited for coping with a station blackout per NRC Regulatory Guide 1.155 and NUMARC 87-00, but is instead installed to provide plant MSPI/PRA margin.

The SBO DGs are located with a missile barrier designed to limit the average wind speed downstream of the barrier entrance to less than or equal to 150 mph during a 230 mph tornado event in accordance with NRC Regulatory Guide 1.76, Rev. 1.

8.1.3 SAFETY-RELATED LOADS

Refer to Figure 8.3-2 for a listing of loads supplied by the Class IE ac system. Refer to Table 8.3-1 for a list of loads supplied by the Class IE dc system. Specific safety related loads and safety functions are identified in Table 8.3-4.

8.1.4 DESIGN BASES

8.1.4.1 Offsite Power System

8.1.4.1.1 Safety Design Bases

SAFETY DESIGN BASIS ONE - Electrical power from the power grid to the plant site is supplied by two physically independent circuits designed and located so as to minimize the likelihood of simultaneous failure.

SAFETY DESIGN BASIS TWO - Each of these independent circuits has the capability to safely shut down the unit. The first preferred circuit, which is connected to the startup transformer, has the capacity to supply the startup and all the auxiliary loads (both group 1 and group 2 simultaneously) of the unit.

SAFETY DESIGN BASIS THREE - The second preferred power circuit, which supplies power to the ESF transformer, has the capacity to supply all the safety-related loads of the unit.

SAFETY DESIGN BASIS FOUR - The loss of the nuclear unit or the most critical unit on the grid will not result in the loss of offsite power to the Class IE busses.

8.1.4.1.2 Power Generation Design Bases

POWER GENERATION DESIGN BASIS ONE - The switchyard power circuit breaker control is designed with duplicate and redundant systems, i.e., two independent battery systems, two trip coils per breaker, and two independent protective relay schemes.

8.1-3 Rev. 30 WOLF CREEK

8.1.4.2 Onsite Power System

8.1.4.2.1 Safety Design Bases

SAFETY DESIGN BASIS ONE - The onsite power system includes a separate and independent Class IE electric power system (GDC-17).

SAFETY DESIGN BASIS TWO - The onsite Class IE electric power system is divided into two independent load groups, each with its own power supply, busses, transformers, loads, and associated 125- V dc control power. Each load group is independently capable of maintaining the plant in a cold shutdown (GDC-17).

SAFETY DESIGN BASIS THREE - One independent diesel generator is provided for each Class IE ac load group.

SAFETY DESIGN BASIS FOUR - No provisions are made for automatic transfer of load groups between redundant power sources.

SAFETY DESIGN BASIS FIVE - No portion (ac or dc) of the onsite standby power systems is shared with another unit (GDC-5).

SAFETY DESIGN BASIS SIX - The Class IE electric systems are designed to satisfy the single failure criterion (GDC-17).

SAFETY DESIGN BASIS SEVEN - For each of four protection channels, one independent 125-V dc and one 120-V vital ac power source are provided.

Batteries are sized for 240 minutes of operation without the support of battery chargers.

SAFETY DESIGN BASIS EIGHT - Raceways are not shared by Class IE and non-Class IE cables. However, associated cables connected to Class IE busses are treated as Class IE cables with regard to separation and identification and are run in their related Class IE raceway system.

SAFETY DESIGN BASIS NINE - Special identification criteria are applied for Class IE equipment, including cabling and raceways. Refer to Section 8.3.1.3.

SAFETY DESIGN BASIS TEN - Separation criteria are applied which establish requirements for preserving the independence of redundant Class IE load groups or power systems. Refer to Section 8.3.1.4.1.

SAFETY DESIGN BASIS ELEVEN - Class IE equipment is designed with the capability of being tested periodically (GDC-18).

8.1-4 Rev. 9 WOLF CREEK

SAFETY DESIGN BASIS TWELVE - Two physically and electrically independent ESF transformers equipped with automatic load tap changers are provided to supply the Class IE ac electric power system.

8.1.4.2.2 Power Generation Design Bases

POWER GENERATION DESIGN BASIS ONE - A separate non-Class IE dc system is provided for non-Class IE controls and dc motors.

8.1.4.3 Design Criteria, Regulatory Guides, IEEE Standards and IE Bulletins

The onsite power system is generally designed in accordance with IEEE Standards 279, 308, 317, 323, 334, 344, 379, 382, 383, 384, 387, 450, and 484.

Compliance with Regulatory Guides 1.6, 1.9, 1.22, 1.29, 1.30, 1.32, 1.40, 1.41, 1.47, 1.53, 1.62, 1.63, 1.68, 1.73, 1.75, 1.81, 1.89, 1.93, 1.100, 1.106, 1.108, 1.118, and 1.131 and IEEE Standards 323-1974, 338-1971, 344-1975, 384-1974, 387-1984, 308- 1974, and 317-1976 are discussed below:

Refer to Appendix 3A for the applicable revision dates on regulatory guides.

Compliance with General Design Criteria 17 and 18 is discussed in Section 3.1.

REGULATORY GUIDE 1.6, INDEPENDENCE BETWEEN REDUNDANT STANDBY (ONSITE) POWER SOURCES AND BETWEEN THEIR DISTRIBUTION SYSTEMS - The Class IE system is divided into redundant load groups so that loss of any one group does not prevent the minimum safety functions from being performed. Figure 8.3-1 shows this arrangement.

Each ac load group has connections to two preferred (offsite) power supplies and to a single diesel generator. Each diesel generator is exclusively connected to a single Class IE 4.16-kV load group and has no automatic connection to the redundant load group.

For a discussion of this regulatory guide, with respect to the Class IE dc system, refer to Section 8.3.2.2.1.

No provisions exist for automatic transfer of loads between redundant onsite power supplies.

The diesel generator of one load group cannot be automatically paralleled with the diesel generator of the redundant load group.

8.1-5 Rev. 36

WOLF CREEK

Interlocks are provided to assure that a single operator error would not parallel the standby power sources of redundant load groups. Refer to Section 8.3.1.1.3.

There is no interconnection of load groups.

REGULATORY GUIDE 1.9, SELECTION, DESIGN, QUALIFICATION, and TESTING OF EMERGENCY DIESEL GENERATOR UNITS USED AS CLASS 1E ONSITE ELECTRIC POWER SYSTEMS AT NUCLEAR POWER PLANTS

WCGS was initially licensed to Regulatory Guide 1.108 and Regulatory Guide 1.9, Revision 1 with regard to the original design and qualification of the emergency diesel generators. Regulatory Guide 1.9, Revision 1 was essentially an endorsement of IEEE Standard 387-1977 with a number of provisions specified in the Regulatory Position of the regulatory guide.

For ongoing testing of the emergency diesel generators, WCGS conforms to the Technical Specifications and with exceptions (as described in the Technical Specification 3.8.1 Bases) to the test recommendations of Regulatory Guide 1.9, Revision 3. Revision 3 of Regulatory Guide 1.9 integrates the pertinent guidance previously addressed in Revisions 1 and 2 of Regulatory Guide 1.9 and the guidance of Revision 1 of Regulatory Guide 1.108. Regulatory Guide 1.9, Revision 3 endorses IEEE 387-1984 with respect to design, qualification and periodic testing of diesel generator units, subject to the supplemental design considerations specified in Section C.1 and the diesel generator testing provisions specified in Section C.2 of the Regulatory Guide.

In accordance with Amendment No. 101, the ESW pump starting transient during the LOCA sequencing test will be demonstrated to be within a minimum voltage of 3120 Vac and recover to 3680 Vac within 3 seconds and to be within a maximum voltage of 4784 Vac and recover to 4320 Vac within 2 seconds.

Load requirements are listed in Figure 8.3-2.

The following exception applies to Regulatory guide 1.9, Revision 3, Regulatory Position C.1.3:

The predicted loads for short-time operation are less than the diesel generator short-time load rating and the predicted loads for continuous operation are less than the diesel generator continuous load rating.

The diesel generators are designed as follows:

a. To start and accelerate to rated speed, in the sequence shown in Figure 8.3-2, all the needed engineered safety features and emergency hot shutdown loads.

b. So that at no time during the loading sequence do the frequency and voltage decrease to less than 95 percent of 60 Hz (when operating at nominal 60Hz) and 75 percent of 4.16 kV, respectively. Calculations demonstrate that if the diesel generators are operating at the lower end of the Technical Specification frequency band and if the frequency momentarily dips below 95 percent of 60 Hz, that the equipment will still perform its safety function with no equipment damage. (Reference 1)

8.1-6 Rev. 27 WOLF CREEK

c. Frequency is restored to within 2 percent of nominal in less than 60 percent of each load-sequence interval for step load increase and in less than 80 percent of each load sequence interval for disconnection of the single largest load, and voltage is restored to within 10 percent of nominal within 60 percent of each load-sequence time interval. (A greater percentage of the time interval may be used if it can be justified by analysis. However, the load-sequence time interval should include sufficient margin to account for the accuracy and repeatability of the load-sequence timer.) During recovery from transients caused by the disconnection of the largest single load, the speed of the diesel generator unit does not exceed the nominal speed plus 75 percent of the difference between nominal speed and the over-speed trip setpoint of 115 percent of nominal, whichever is lower.

Furthermore, the transient following the complete loss of load does not cause the speed of the unit to attain the overspeed trip setpoint.

The suitability of each diesel generator is confirmed by the manufacturer's prototype qualification test data and preoperational tests.

REGULATORY GUIDE 1.22, PERIODIC TESTING OF PROTECTION SYSTEM ACTUATION FUNCTIONS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.29, SEISMIC DESIGN CLASSIFICATION - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.30, QUALITY ASSURANCE REQUIREMENTS FOR THE INSTALLATION, INSPECTION, AND TESTING OF INSTRUMENTATION AND ELECTRIC EQUIPMENT - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.32, CRITERIA FOR SAFETY-RELATED ELECTRIC POWER SYSTEMS FOR NUCLEAR POWER PLANTS - Compliance with IEEE Standard 450-1995 and the dc power requirements of IEEE Standard 308-1974 is discussed in Section 8.3.2.2.1. (See Appendix 3A for discussion of compliance to Regulatory Guide 1.32 in relation to IEEE Standard 450)

Compliance with ac power requirements of IEEE Standard 308-1974 is as follows:

The Class 1E ac power system is designed to ensure that any design basis event, as listed in Table 1 of IEEE 308, does not cause either (1) loss of electric power to a number of engineered safety features, surveillance, or protection system device sufficient to jeopardize the safety of the unit or (2) loss of electric power to equipment that could result in a reactor power transient capable of causing significant damage to the fuel or the reactor coolant system.

The Class 1E power system is capable of performing its function when subjected to the effects of any of the design basis events. The Class 1E loads are designed to perform their functions adequately for the design variations of voltage and frequency in the Class 1E system.

Circuit breaker control is provided in the control room and on the circuit breakers of the preferred power supplies and diesel generator supplies to the 4.16-kV busses of the Class 1E system. Controls are provided in each diesel generator room for local operation of the diesel generator.

Class 1E equipment and associated design, operating, and maintenance documents are distinctly identified as described in Section 8.3.1.3.

8.1-7 Rev. 27 WOLF CREEK

Each type of Class 1E equipment is qualified by analysis, by successful use under similar conditions, or by actual test to demonstrate its ability to perform its function under applicable design basis events.

A failure modes and effects analysis is performed. Refer to Section 8.3.1.2.1.

Supplementary design criteria of IEEE 308 are addressed in the applicable sections describing specific Class 1E equipment.

The surveillance requirements of IEEE 308 are followed in the design, installation, and operation of Class 1E systems and consist of the following:

a. Preoperational equipment tests and inspections were performed in accordance with the procedures described in Chapter 14.0 with all components installed.

b. Preoperational system tests were performed in accordance with the procedure described in Chapter 14.0 with all components installed.

c. Periodic equipment tests are performed at the scheduled intervals to detect deterioration of the system toward an unacceptable condition and to demonstrate that the standby power equipment and other components that are not running during normal operation of the station are operable.

d. Surveillance system tests referred to in item c above are performed at scheduled intervals to demonstrate the operational readiness of the system.

With regard to Section 7 of IEEE 308 and Regulatory Guide 1.93, The Technical Specifications discuss operating alternatives under degraded Class IE ac system conditions.

Section 8 of IEEE 308 describes multiunit considerations and is not applicable to WCGS.

The electrical and physical independence between redundant standby (onsite) power sources is discussed in the responses to Regulatory Guides 1.6 and 1.75.

Connection of non-Class 1E equipment to Class 1E systems is discussed in the response to Regulatory Guide 1.75.

Diesel generator set capacity is discussed in the response to Regulatory Guide 1.9.

REGULATORY GUIDE 1.40, QUALIFICATION TESTS OF CONTINUOUS-DUTY MOTORS INSTALLED INSIDE THE CONTAINMENT OF WATER-COOLED NUCLEAR POWER PLANTS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.41, PREOPERATIONAL TESTING OF REDUNDANT ONSITE ELECTRIC POWER SYSTEMS TO VERIFY PROPER LOAD GROUP ASSIGNMENTS - The onsite electric power systems, designed in accordance with Regulatory Guides 1.6 and 1.32, were tested as part of the preoperational testing program and also after major modifications. The tests were performed in accordance with the

8.1-8 Rev. 27 WOLF CREEK

procedures outlined in Chapter 14.0. These tests verify the independence between the redundant onsite power sources and their load groups.

The Class IE power system is isolated from the preferred (offsite) transmission network by direct actuation of the Class IE undervoltage relays monitoring the Class IE busses, resulting in tripping of the supply breakers.

The Class IE power system is tested functionally, one load group at a time, by allowing one load group to be powered only by its associated diesel generator while the bus is disconnected from the preferred power source. The redundant load group remains completely disconnected from its associated diesel generator and preferred power source.

An engineered safety features actuation signal (ESFAS) is simulated to start the diesel generators and initiate automatic sequencing. Functional performance of the loads is checked. Each test is of sufficient duration to achieve stable operating conditions and thus permit the onset and detection of adverse conditions which could result from improper assignment of loads.

During testing of one Class IE load group, the busses of the redundant load groups not under test are monitored to verify absence of voltage on these busses and loads, indicating no interconnection of load groups.

Refer to Section 8.3.2.2.1 for a discussion of this regulatory guide with respect to dc systems.

REGULATORY GUIDE 1.47, BYPASSED AND INOPERABLE STATUS INDICATION FOR NUCLEAR POWER PLANT SAFETY SYSTEMS - A detailed description of the engineered safety features status panel is provided in Section 7.5. A section of this panel is devoted to providing indication of the configuration and, therefore, the operability of the Class IE ac power distribution system.

REGULATORY GUIDE 1.53, APPLICATION OF THE SINGLE FAILURE CRITERION TO NUCLEAR POWER PLANT PROTECTION SYSTEMS - Refer to Section 7.3 for the response to this regulatory guide.

REGULATORY GUIDE 1.62, MANUAL INITIATION OF PROTECTIVE ACTIONS - Refer to Appendix 3A, Responses to Regulatory Guides.

REGULATORY GUIDE 1.63, ELECTRIC PENETRATION ASSEMBLIES IN CONTAINMENT STRUCTURES FOR LIGHT-WATER-COOLED NUCLEAR POWER PLANTS - The electric penetration assemblies conform to IEEE Standard 317-1976.

8.1-9 Rev. 0

WOLF CREEK

The electrical penetration assemblies do not incorporate self-fusing characteristics. They are designed to withstand the maximum possible fault current versus time conditions (which could occur because of single random failures of circuit overload protection devices) for any electrical fault external to the penetration within the two leads of any one single-phase circuit or the three leads of any one three-phase circuit.

In accordance with Regulatory Guide 1.63, the following system features are provided to ensure compliance with this requirement of the regulatory guide.

a. Medium Voltage System

For medium voltage circuits feeding loads (e.g. RCPs) in the reactor building, the primary protection is provided by the individual load circuit breakers, which are backed up by the main bus feeder breaker. Spatial separation is achieved by locating the primary (load breaker) and backup (bus feeder breaker) relays in separate switchgear cubicles on a given bus. Primary and backup circuit protection for control power are supplied from two separate dc sources. The penetration withstands the maximum available fault current for the respective durations which are characteristic of both the primary and backup protection. The switchgear is located in the turbine building. Separate non-Class IE battery sources are provided for the primary and backup protection and circuit breaker control. (No 4.16-kV loads are located within the reactor building).

b. Low Voltage Load Center Loads

1. Class IE Loads

For low voltage Class IE load centers feeding loads in the reactor building, the primary and backup protection is provided by a fuse or a MCC breaker in series with the individual load center load circuit breakers respectively.

Spatial separation is achieved, since the primary (fuse or MCC breaker) and backup (load center breaker) protective devices are in separate physical locations. The penetration withstands the available range of fault current and time duration for the load center breaker trip. No battery sources are necessary, since the breaker trip units are direct acting.

8.1-10 Rev. 28

WOLF CREEK

2. Non-Class IE load center loads are few in number, and are treated on an individual basis as follows:

(a) Containment Polar Crane and Non-Class IE MCC

The containment polar crane and MCC are powered from their respective non-class IE load centers located in the auxiliary building. For the non-Class IE MCC, primary and backup protection is provided in a manner similar to that described for Class IE load center loads in Item 1. The primary and backup protection is provided by the individual load circuit breaker and the associated load center main feeder breaker, respectively. For the containment polar crane, primary and backup protection is provided by the individual load center feeder breaker and properly rated fuses, respectively. The penetration will withstand the range of fault current and the time duration which is characteristic of the primary and backup protection devices.

(b) Pressurizer Backup Heaters

The pressurizer backup heaters are supplied from non-Class IE load centers, which are located in the auxiliary building. Individual 480-V molded case circuit breakers feeding the heaters provide the primary protection. Fuses in series with these circuit breakers provide backup protection. The fuses are located in a different vertical section than the molded case circuit breakers. The penetrations will withstand the range of fault current and the time duration which is characteristic of the primary and backup protection devices.

(c) Pressurizer Control Group Heaters

The pressurizer control group heaters are supplied from a non-Class IE load center through an SCR controller and a bank of molded case circuit breakers. Since the SCR controller is fused, the primary protection is provided by the molded case circuit breakers, and the backup protection is provided by the fuses in the SCR controller. The penetration withstands the range of fault current and time duration which are characteristic of the primary and backup devices.

8.1-11 Rev. 0

WOLF CREEK

c.Low Voltage Motor Control Center Loads

1. General MCC loads

The 480-V loads within the reactor building are supplied power from Class IE or non-Class IE MCCs (as applicable) which are located in the auxiliary building. In this case, the primary protection is provided by the combination of a molded case circuit breaker (instantaneous only) and the thermal overload relays in the starter, for motor loads. The pri-mary protection is provided by a thermal-magnetic circuit breaker in the case of feeder tap breakers.

In both cases, backup protection is provided by introducing properly rated fuses in each cubicle between the breaker and the load. Although the primary (circuit breaker) and backup (fuse) protection are located within the same MCC compartment, these two protection means are diverse in their fault clearing mechanisms. There are two exceptions. First, primary protection in non Class 1E MCCs may be provided by fused disconnect switches equipped with current limiting fuses having circuit protection characteristics equal to or better than molded case circuit breakers in similar applications.

An exception also occurs in the case of large feeder tap breakers and larger motors connected to the MCCs.

In this case, where the penetration is relatively large and can practicably be coordinated with the MCC incoming breaker, the fuses are not used. In all cases, the penetration withstands the available current and time duration which are characteristic of the primary and backup devices.

2. Motor-Operated Valves

Class 1E motor-operated valves (MOVs), similar to the 480-V motor loads previously discussed, require properly rated fuses to be added to the individual motor starter cubicles for backup protection. However, the Class 1E motor-operated valves have their thermal overload (TOL) relays in the control circuit bypassed in order to ensure run to failure. Eliminating the TOL relays removes a portion of their primary protection. Complete primary protection for the MOV circuits is maintained using one of two methods, as follows:

(a) The typical method uses a magnetic-only molded-case circuit breaker with an adjustable trip setting (vertical intercept) that provides the primary protection. The trip setting is set low enough to stay below the thermal limit of the penetration (considering the upper limit of the breaker tripping tolerance band), and high enough to avoid nuisance tripping of the MOV during starts (considering the lower limit of the breaker tripping tolerance band).

Although the primary (circuit breaker) and backup (fuse) protection are located within the same MCC compartment, these two protection means are diverse as to their sensing and fault clearing mechanisms.

8.1-12 Rev. 30 WOLF CREEK

(b) The alternate method uses a second set of fuses to complement and complete the primary protection, as a magnetic-only molded-case circuit breaker with an adjustable trip setting may not be fully coordinated with the penetrations thermal limits as described above in (a). The molded-case circuit breaker trip setting is set high enough to avoid nuisance tripping of the MOV during starts (considering the lower limit of the breaker tripping tolerance band). The primary protection fuses are sized such that they actuate prior to the backup protection fuses. Although the primary (circuit breaker and fuse) and backup (fuse) protection may be located within the same MCC compartment, these three protection means are diverse as to their sensing and fault clearing mechanisms. In addition, the primary and backup fuses are of a different type, which reduces the potential for the fuses to have a common failure mode.

In all cases, the penetrations are sized such that their thermal limits are greater than the time-current curves of both the primary and backup protection devices.

d. Low Voltage Control Systems

Primary protection is provided by a fuse in the control circuit. Backup protection is provided by fuses in the control power transformer primary. The penetrations will withstand the range of fault current and the time duration which is characteristic of the primary and backup protection devices.

e. Instrument Systems

The energy levels in the instrument systems are sufficiently low so that no damage occurs to the electric penetration.

f. DC Loads

Primary and backup fuses are provided with the penetrations withstanding the available fault current and time duration which are characteristic of those devices.

REGULATORY GUIDE 1.68, INITIAL TEST PROGRAMS FOR WATER-COOLED NUCLEAR POWER PLANTS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.73, QUALIFICATION TESTS OF ELECTRIC VALVE OPERATORS INSTALLED INSIDE THE CONTAINMENT OF NUCLEAR POWER PLANTS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.75, PHYSICAL INDEPENDENCE OF ELECTRIC SYSTEMS - This regulatory guide sets forth criteria for the separation of circuits and electric equipment. These circuits and equipment either comprise or are associated with the Class IE power systems, the protection system, systems actuated or controlled by the protection system, and auxiliary or supporting systems that are essential to the operation of these systems. The separation criteria are discussed in Section 8.3.1.4.1 and meet the recommendations of Regulatory Guide 1.75. The following discussion supplements and clarifies

8.1-13 Rev. 30 WOLF CREEK

several of the items presented in the guide. Paragraph numbers herein correspond to paragraph numbers in IEEE 384-1974.

Paragraph 4.1

Two completely separate and independent load groups, each of which is capable of safely shutting down the unit, are provided. Separation between these load groups and between associated circuits and non-Class IE circuits is implemented to an extent commensurate with the hazard potential of the areas in which they are installed. See Section 8.3.1.4.1.

Paragraph 4.2

Equipment and circuits requiring separation are determined and delineated early in the design stage. Distinctive identification on documents and drawings is provided. See Section 8.3.1.3.

Paragraph 4.3

Various means of attaining physical separation of safety-related circuits and equipment include separate cable spreading rooms, separate cable chases, raceways, barriers, and distance. See Section 8.3.1.4.1.

Paragraph 4.4

Section 8.3.1.4.1.1 satisfies this guide paragraph.

Paragraph 4.5

Associated circuits are separated and identified as if safety related.

Associated circuits are not uniquely labeled as such; rather, they are identified as any safety-related circuit of the same separation group would be.

Where non-Class IE circuits are associated by reason of their sharing of Class IE sources, the following specific criteria are followed:

The non-Class 1E loads connected to Class 1E power buses are isolated with an isolation device as described below.

1. Circuit Breaker tripped by a safety injection signal (SIS).

2. Starter contactor opened by a safety injection signal (SIS).

3. Two circuit breakers, two fuses, or a breaker and a fuse in series, both coordinated with an upstream circuit breaker, and the circuit breaker periodically tested and visual inspection of fuses and fuse holders every refueling outage.

These power circuit loads are described as follows:

a. Tripped AC Loads

Non-Class IE loads which are tripped on occurrence of an SIS are as given below. These circuits beyond the isolation device (Class IE breaker or contactor) are treated per non-Class IE and non-associated criteria.

1. Air compressors

2. Standby ac lighting

3. Battery chargers, 125 V and 250 V

8.1-14 Rev. 33 WOLF CREEK

4. Pressurizer heaters backup groups

5. CRDM cooling fans

6. Boric acid transfer pumps

7. Boric acid heat tracing

8. NPIS Computer Equipment

9. Boric acid filter to charging pump valve

10. ESW unit heaters

11. Deleted

b. Non-Class IE AC Loads not Tripped

1. PN transformer - Original transformers were qualified as Class 1E equipment. The internals of the transformers were designed to self-regulate and had a physical isolation between the primary to the secondary side of the transformer. These transformers were credited for isolating the non-class 1E loads from the class 1E power source under accident conditions without degrading the class 1E power source. The new transformers do not contain the built in physical isolation; therefore, are not qualified as Class 1E isolation equipment. In order to assure that the class 1E power supply is not compromised; two circuit breakers in series are utilized in the primary circuit of each separation group.

The two upstream Class 1E breakers are connected in series and are trip coordinated, instantaneous and long-term trip, with the corresponding upstream Load Center breaker in order to maintain the integrity of the class 1E power system. The circuit breakers affected by this change are included in the circuit breaker surveillance program. For these reasons, the circuits beyond the second Class 1E circuit breaker are treated per non-Class 1E and non-associated criteria. Cables from the breakers to the transformers are procured Safety Related to ensure the Class 1E cable requirements are maintained. The non-Class 1E instrument ac power system is not tripped upon the occurrence of an SIS and the equipment downstream of non-Class 1E instrument ac power system does not affect the upstream Class 1E equipment.

2. Boric Acid heat tracing in Room 1113 that is not tripped on SIS. The Boric Acid heat tracing circuit is fed from a distribution panel which gets power from a safety related 480 volt circuit breaker. The distribution panel is isolated from the non-safety heat tracing circuit by two fuses in series. The two fuses in series are installed on both the supply and the return conductor between the safety related supply and non-safety related load. The two fuses are connected in series with a circuit breaker in the distribution panel. The Class 1E isolation fuses or the upstream circuit breaker clear the Non-Class 1E circuit fault from propagating to the Class 1E supply panel and are coordinated with the panel breaker, avoiding disruption to other Class 1E loads in the panel.

The circuits downstream of the fuses are considered non-Class 1E and are non-associated circuits.

8.1-15 Rev. 33 WOLF CREEK

Paragraph 4.6

Two channels of non-safety-related cables and raceway are associated with the normal plant systems and equipment. These channels require no specific separation. However, they are separated from the four safety-related separation groups by the same criteria that is applied to the separation of the four safety-related separation groups from each other.

All non-safety-related circuits are routed separately from safety-related and associated circuits to the above criteria. The specific separation distance required by Paragraphs 5.1.3, 5.1.4, or 5.6 is complied with.

Paragraph 5.1.1.1

The requirements of this paragraph are met. See Section 8.3.1.4.1.1.

Paragraph 5.1.1.2

Areas in which the only source of fire is electrical are divided into two groups--cable spreading areas and general plant areas. Section 8.3.1.4.1.1 is followed.

Paragraph 5.1.1.3

The separation distances of 1 horizontal and 3 vertical feet in the cable spreading and main control rooms and 3 horizontal and 5 vertical feet in general plant areas are provided, and are described in Section 8.3.1.4.1.1.

Cables and raceways are selected with flame-retardant properties.

Hazards are limited to failures or faults internal to the electrical equipment.

The use of splices in Class IE systems is limited to the following areas:

a. Splices are used in long duct bank runs to site buildings, such as intake structures for ESW systems, where cables are longer than is practical to manufacture and pull. Splices in the long duct bank runs are done in the vicinity of the manholes.

8.1-16 Rev. 0 WOLF CREEK

b. Where small control or instrument devices are supplied with short pigtails, the field cable may be terminated to the pigtail by means of an approved connection, which is adequately insulated, located close to the device, and enclosed in the connecting conduit.

c. Another possible area would be in the event of cable damage in an operating plant where a splice might be preferable over total replacement of the cable. Such instances are resolved on a case-by-case basis.

d. In cases in which field-run cables are incompatible with the terminal size on the devices to which they must terminate, a splice to a short, appropriate pigtail may be made to permit the required termination. Such instances are approved on a case-by-case basis, where the adequacy of the pigtail is confirmed and splices are made with qualified materials and are restricted to enclosures such as MCCs, termination compartments, and panels.

e. Splices made with qualified materials are used within enclosures where specified by design.

f. The 600 volt fire-resistive control and power cables are fitted with termination kits on both ends that are either factory installed or field installed. The termination kits provide transition from solid cable conductors to stranded pigtails suited for making cable terminations. The kits, along with the fire-resistive cables are covered by specification E-057C. Splices for terminating the fire-resisitive cables will be in accordance with paragraphs b, d and e above.

g. The 600 volt fire-resistive control and power cables typically have a maximum manufactured length of 100 feet. Factory installed or field installed splices provide for increased cable length. The splices are covered in the fire-resistive cable specification E-057C, and maintain the fire rating and structural integrity of the cables.

Paragraph 5.1.2

Exposed Class IE raceways are marked in a distinct, permanent manner at intervals not exceeding 15 feet and at points of entry to and exit from enclosed areas.

In addition, separate color identification is provided for each separation group of field wired, safety-related cables.

As stated in reference to Paragraph 4.5, associated circuits are identified the same as their related Class IE circuits, and are, therefore, distinguished from one another as stated above.

See Section 8.3.1.3.

Paragraph 5.1.3

8.1-17 Rev. 24 WOLF CREEK

Section 8.3.1.4.1.1 satisfies this paragraph.

Paragraph 5.1.4

Section 8.3.1.4.1.1 satisfies this paragraph.

Paragraph 5.2.1

Sections 8.3.1.1.3 satisfy this paragraph.

Paragraph 5.2.2

Section 8.3.1.1.3 satisfies this paragraph.

Paragraph 5.3.1

Each of the four Class IE batteries is located in a separate room of the control building.

Paragraph 5.3.2

As per Section 8.3.2.1 and 8.3.2.2.1, physical separation, electrical isolation, and redundancy are provided for the entire Class IE dc system, including the battery chargers.

Paragraph 5.4.1

As per Section 8.3.1.1.7, Class IE switchgear of redundant load groups is located in separate rooms in the control building.

Paragraph 5.4.2

As per Section 8.3.1.1.7, Class IE motor control centers of redundant load groups are located in separate rooms within seismic Category I buildings.

Paragraph 5.4.3

Vital distribution switchboards of different separation groups are located in separate rooms in the control building. Each switchboard is located with the vital switchgear of its respective separation group.

Paragraph 5.5

Two separate penetration areas are provided. One area contains cables for separation groups 2 and 4, each group having separate penetration assemblies.

The other area contains cables for separation groups 1 and 3, each group again having separate penetration assemblies. Raceway separation criteria apply to the penetrations. See Section 8.3.1.4.1.1.

Paragraph 5.6.1

Sections 8.3.1.1.6, 8.3.1.3 and 8.3.1.4.1.2 satisfy this guide paragraph.

8.1-18 Rev. 24 WOLF CREEK

Paragraph 5.6.2

Separation criteria for wiring internal to control boards are satisfied by Section 8.3.1.4.1.2.

Paragraph 5.6.3

Identification of wiring internal to control boards is provided by separation group designation. See Section 8.3.1.3.

Paragraph 5.6.4

Single control devices to which different separation groups are connected are avoided, wherever practicable. Where single devices are unavoidable, electrical isolation is provided. Where separation by distance is not practicable and internal fire is the only consideration, fire barriers, conduit, or wire duct are used. See Section 8.3.1.4.1.2.

Paragraph 5.6.5

Within control boards and other panels, nonsafety-related wiring is not harnessed with safety-related wiring. Where both types of wiring are contained within the same board or panel, the nonsafety-related wiring is separated from the safety-related wiring by means of barriers or by a distance equal to or greater than 6 inches.

Paragraph 5.6.6

Load Group l and Protection Channels 1 and 3 enter the lower cable spreading room and hence enter from the bottom of the control board. Load Group 2 and Protection Channels 2 and 4 generally enter the upper cable spreading room and hence enter from the top of the control board. The only exception to this is in the console which has channels 2 and 4 brought directly from the channel 2 and 4 vertical shaft via embedded floor raceways into separate openings into the bottom of the console. The scheme meets all requirements of Paragraph 5.1.3. See Section 8.3.1.4.1.1.

Paragraph 5.7

Class IE instruments of different separation groups are generally precluded from occupying the same cabinet. Where this is not practicable, such instruments are located in separate compartments of the cabinet, or are adequately separated by barriers.

8.1-19 Rev. 0

WOLF CREEK

Paragraph 5.8

Section 7.3 satisfies the requirements of this paragraph.

Paragraph 5.9

Location of Class 1E actuated equipment is evaluated to ensure that adequate separation for redundant equipment is implemented.

REGULATORY GUIDE 1.81, SHARED EMERGENCY AND SHUTDOWN ELECTRIC SYSTEMS FOR MULTI-UNIT NUCLEAR POWER PLANTS - Wolf Creek is a one unit site.

REGULATORY GUIDE 1.89, QUALIFICATION OF CLASS 1E EQUIPMENT FOR NUCLEAR POWER PLANTS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.93, AVAILABILITY OF ELECTRIC POWER SOURCES - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.100, SEISMIC QUALIFICATION OF ELECTRIC EQUIPMENT FOR NUCLEAR POWER PLANTS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.106, THERMAL OVERLOAD PROTECTION FOR ELECTRIC MOTORS ON MOTOR-OPERATED VALVES - Overload protection for safety-related, motor-operated valves is discussed in Section 8.3.1.1.2. Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.108 - PERIODIC TESTING OF DIESEL GENERATOR UNITS USED AS ONSITE ELECTRIC POWER SYSTEMS AT NUCLEAR POWER PLANTS - The original testing of the emergency diesel generators was performed in conformance with Regulatory Guide 1.108. After final assembly and preliminary startup testing, each diesel generator was tested as described in Section 8.3.1.1.3.

Ongoing, periodic surveillance testing of the diesel generators is performed in accordance with the plant Technical Specifications. The testing requirements in the plant Technical Specifications are based on Regulatory Guide 1.9, Revision 3. The testing guidance of Regulatory Guide 1.108 was largely incorporated into Regulatory Guide 1.9, Revision 3. Refer to Appendix 3A for additional information regarding Regulatory Guide 1.108.

8.1-20 Rev. 27 WOLF CREEK

REGULATORY GUIDE 1.118, PERIODIC TESTING OF ELECTRIC POWER AND PROTECTION SYSTEMS - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.131, QUALIFICATION TESTS OF ELECTRIC CABLES, FIELD SPLICES, AND CONNECTIONS FOR LIGHT-WATER-COOLED NUCLEAR POWER PLANTS - The requirements of IEEE Standard 383, 1974 have been used for the qualification of cables, field splices, and connections.

The cable, field splices, and connections are qualified to the environmental conditions and all design basis events (e.g., steam line break) by testing and/or analysis.

Type tests for design basis event conditions consist of subjecting nonaged and aged cables, field splices, and connections to a sequence of environmental extremes that simulate the most severe postulated conditions of a design basis event and specified conditions of installation. Type tests demonstrate margin by application of multiple transients or increased level. Electrical and physical performance of the cable is measured during and following the environmental cycle. All environmental conditions are enveloped by the qualification program. However, the factors for margin given in Section 6.3.1.5 of IEEE 323 are not used.

Testing data is provided to establish the long-term performance of the insulation. Data is evaluated using the Arrhenius technique, using a minimum of three data points including 136 C and two others at least 10 C apart in temperature. No on-going qualification is used.

The recommendations of Regulatory Guide 1.89 are discussed later in this section.

Vertical tray flame testing is performed in accordance with IEEE 383, Paragraph 2.5. However, aged samples are not used.

No field splices are used in the cable trays.

Fire tests are performed with the vertical tray perpendicular to the plane of the horizon.

A gas burner flame source releasing approximately 70,000 Btu/hr is used.

The ribbon gas burner flame source is mounted in accordance with the requirements of the regulatory guide, except that the flame is directed from the back side of the cable tray.

The 600 volt fire-resistive control and power cables are type tested to 1925 F to verify 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> fire ratings, and to verify environmental qualifications in accordance with NRC Generic Letter 86-10, Supplement 1. The fire testing requirements of NRC Generic Letter 86-10, Supplement 1, exceed the flame test requirements of IEEE 383.

Oil or burlap as an alternate flame source is not used.

The requirements outlined in Regulatory Guide Position 13 are met.

IEEE 323-1974 IEEE STANDARD FOR QUALIFYING CLASS IE EQUIPMENT FOR NUCLEAR POWER GENERATING STATIONS - Environmental qualification of Class IE electric equipment and the extent of compliance with IEEE 323 are discussed in Section 3.11(B) and 3.11(N).

8.1-21 Rev. 27 WOLF CREEK

IEEE 338-1971 CRITERIA FOR THE PERIODIC TESTING OF NUCLEAR POWER GENERATING STATION PROTECTION SYSTEMS - Refer to Table 7.1-2 for application of this standard to various systems.

IEEE 344-1975 SEISMIC QUALIFICATION OF CLASS IE ELECTRIC EQUIPMENT FOR NUCLEAR POWER GENERATING STATIONS - Seismic qualification of Class IE electric equipment and the extent of compliance with IEEE 344 are discussed in Section 3.10(B) and 3.10(N).

IEEE 387-1984 CRITERIA FOR DIESEL GENERATOR UNITS APPLIED AS STANDBY POWER SUPPLIES FOR NUCLEAR POWER GENERATING STATIONS - The original design and testing of the emergency diesel generators conformed to Regulatory Guide 1.9, Revision 1 and Regulatory Guide 1.108. Regulatory Guide 1.9, Revision 1 endorsed IEEE Standard 387-1977, and original compliance was demonstrated based on the design criteria as stated below. The following demonstrates compliance with design criteria of IEEE 387:

a. Service Environment

The diesel generator unit provides power to appropriate ventilation equipment to maintain an acceptable environment within the diesel generator rooms.

b. Starting, Loading, and Design Load Profile

The diesel generator unit is capable of starting, accelerating, being loaded, and carrying the design load described in Section 8.3.1.1.3. The unit energizes its cooling equipment within an acceptable time.

c. Quality of Power

Refer to previous discussions in this section on Regulatory Guide 1.9 concerning frequency and voltage limits.

d. Ratings

Refer to previous discussions in this section on Regulatory Guide 1.9 concerning the basis for the continuous rating of the diesel generator.

Periodic, in-service testing of the diesel generators is performed in accordance with the plant Technical Specifications and the test recommendations of Regulatory Guide 1.9, Revision 3. Regulatory Position C.2 of Regulatory Guide 1.9, Revision 3 endorses requirements of IEEE Standard 387-1984 with respect to Section 3, Definitions, Section 6, Testing, and Section 7, Qualification Requirements, subject to the supplemental design considerations specified in Section C.1 and the diesel generator testing provisions specified in Section C.2 of the Regulatory Guide. Differences between the test requirements of the plant Technical Specifications and the recommendations of the Regulatory Guide are due to the Standard Technical Specifications and/or approved changes to the plant Technical Specifications.

8.1-22 Rev. 27

WOLF CREEK

e. Interactions

Refer to previous discussions in this section for an analysis per Regulatory Guide 1.6 for assurance that independence is provided between redundant diesel generators and the Class IE electric system. Mechanical systems are designed so that a single failure affects the operation of only a single diesel generator.

f. Qualification

Refer to Section 3.11(B) for the extent of compliance to IEEE 323.

g. Design and Application Considerations

Design conditions such as vibration, torsional vibration, and overspeed are considered in accordance with the requirements of IEEE 387.

h. Governor and Voltage Regulator Operation

Governor and voltage regulator manually actuated droop modes are automatically reset in the isochronous modes in the event of the loss of offsite power.

i. Control

The diesel generator is provided with control systems permitting automatic and manual control. The start-diesel signal is functional, except in the local (repair and maintenance) mode. The capability is provided at each diesel generator for restricted manual starting in the event of a control room emergency. Refer to previous discussions in this section for a further description of the control systems.

j. Surveillance

Voltage, current, frequency, and power metering are provided in the control room to permit assessment of the operating condition of each diesel generator.

Surveillance instrumentation is provided in accordance with IEEE 387, as described in Sections 9.5.4 through 9.5.8.

8.1-23 Rev. 0 WOLF CREEK

k. Testing

Tests are conducted on each diesel-generator unit in accordance with IEEE 387, as listed in Section 8.3.1.1.3.

IEEE 317-1976 IEEE STANDARD FOR ELECTRICAL PENETRATION ASSEMBLIES IN CONTAINMENT STRUCTURES FOR NUCLEAR POWER GENERATING STATIONS - Electrical penetration assemblies are used for all electrical cables that pass through the reactor building. These assemblies are designed and tested in accordance with IEEE Standard 317.

Principal design criteria for these assemblies include the following:

a. The mechanical design, materials, fabrication, examination, and testing of the pressure-retaining boundary of the electrical penetration assembly, excluding electrical conductors, feed-through connectors, insulation, potting compounds, and gaskets, are in accordance with the requirements of the ASME Boiler and Pressure Vessel Code,Section III, Subsection NE, for Class MC components.

b. The electrical penetration assembly is designed to meet all the electrical requirements for the specified service environment without dielectric breakdown or overheating.

c. The electrical penetration assembly is designed to have a total gas leakage rate through its pressure-retaining boundary exclusive of the aperture seal not greater than 1 x 10-6 standard (20 C at one atmosphere of pressure) cubic centimeters per second of dry helium (or equivalent means of measurement) at the maximum specified containment design pressure.

d. A leak test is performed on each penetration assembly following installation. The test is capable of detecting a leakage rate of 10-2 cubic centimeters per second or less of dry nitrogen with maximum containment pressure applied across the penetration assembly pressure barrier seal at ambient temperature.

e. Each penetration room has a continuous nitrogen supply system manifolded to each penetration assembly. The design and installation of the system facilitates periodic individual penetration assembly gas leak rate testing after installation.

8.1-24 Rev. 12 WOLF CREEK

f. The electrical penetration assembly design is such that safety-related channel separation is maintained.

g. The penetration assembly design is qualified by testing for the intended service within the service and DBE environment.

IEEE 317-1983 IEEE STANDARD FOR ELECTRICAL PENETRATION ASSEMBLIES IN CONTAINMENT STRUCTURES FOR NUCLEAR POWER GENERATING STATIONS - An Electrical penetration assembly is used for all fiber optic cables that pass through the reactor building. This assembly is designed and tested in accordance with the applicable portions (non-electrical) of IEEE Standard 317.

Principal design criteria for this assembly include the following:

a. The mechanical design, materials, fabrication, examination, and testing of the pressure-retaining boundary of the electrical penetration assembly used for fiber optic cables, excluding the fiber conductors, fiber covering/sealant and spare port plugs/ferrule assemblies, are in accordance with the requirements of the ASME Boiler and Pressure Vessel Code,Section III, Subsection NE, for Class MC components.

b. The electrical penetration assembly used for fiber optic cables is designed to have a total gas leakage rate through its pressure-retaining boundary exclusive of the aperture seal not greater than 1 x 10-3 standard cubic centimeters per second of dry nitrogen (@20 C + 15 C) at the maximum specified containment design pressure.

c. A leak test is performed on the Electrical penetration assembly used for fiber optic cables, following installation. A post installation leakage test is conducted in accordance with Appendix J requirements.

d. The electrical penetration assembly used for fiber optic cables does not incorporate O-rings and does not require constant nitrogen pressurization in order to provide the pressure boundary seal. The design facilitates periodic penetration assembly gas leak rate testing after installation.

IE BULLETIN 79-27

Power for the vital reactor instrumentation and protection systems is provided by the Class 1E instrument ac power system. This system is composed of four independent 120-volt ac power supplies to provide power for the four channels of the vital reactor protection and instrumentation systems. With one channel inoperable, the remaining three channels are capable of monitoring the vital reactor parameters continuously and safely shutting down the reactor.

Each essential power panel is fed from a dedicated Class 1E inverter, which, in turn, is fed from one of four independent Class 1E batteries. Each essential power panel is fed from a dedicated Class 1E inverter, which, in turn, is fed from one or four independent Class 1E batteries. Each inverter has a 125 VDC supply and a separate 120VAC supply to an internal constant voltage transformer. In the event of a failure of the inverter DC rectifier section, the inverter internal constant voltage transformer will supply the 120VAC power panel until the swing (backup) inverter can be placed in service to replace it.

Each battery has an associated charger that is fed from a diesel generator backed bus. Each battery has an associated charger that is fed from a diesel generator backed bus.

8.1-25 Rev. 29 WOLF CREEK

Power for the four non-Class 1E reactor process control channels is provided by the non-Class 1E ac power system through two non-Class 1E uninterruptible power supplies (UPSs). Each power supply train supplies a dedicated UPS that, in turn, supplies all four process control cabinets. A backup dc supply is provided to each UPS in the event that the primary source is not available.

The backup dc power source is the non-Class 1E dc system. This system is composed of two station batteries and two battery chargers. Both of the chargers are powered from a diesel generator backed bus.

In the event of the loss of a power supply as a result of a UPS failure, the second UPS automatically provides power to all four process control cabinets.

This configuration prevents the loss of a single power supply from causing a loss of power to any of the four process control cabinets.

Power for miscellaneous non-Class 1E instrument loads is provided by the non-Class 1E instrument ac power system. This system is powered from the Class 1E power system through a qualified isolating regulating transformer. One transformer is provided for each train of instrument ac. No cross ties are provided.

The Class IE instrument ac power system is provided with the following alarms in the control room:

a. Inverter Trouble

b. Inverter Static Switch Transfer

c. Loss of switchboard voltage

The non-Class IE dc system is provided with the following alarms which are grouped into a summary alarm in the control room:

a. System ground

b. Battery imbalance

c. Charger dc overvoltage

d. Charger ac undervoltage

e. Charger dc undervoltage

f. Charger ac and dc breakers open

g. Charge failure

h. Loss of distribution board voltage

i. Loss of switchboard voltage

The non-Class IE instrument ac system is provided with a loss of bus voltage alarm in the control room.

Procedures have been developed that address Action Item No. 2 of IE Bulletin 79-27 (i.e. emergency procedures, administrative procedures, and/or alarm procedures). As a result of the review of IE Bulletin 79-27 and IE Circular 79-02, no design modifications are required. However, the ongoing development of procedures and administrative controls will consider these IE issuances.

8.1-26 Rev. 35 WOLF CREEK

8.

1.5 REFERENCES

1. Calculation NE-E-001, Rev. 0, Emergency Diesel Transient Loading Analysis

8.1-27 Rev. 27

WOLF CREEK

8.2 OFFSITE POWER SYSTEM

8.

2.1 DESCRIPTION

The WCGS offsite ac power supply for the startup, normal operation, and safe shutdown is supplied from the transmission network. The principal design bases as applied to the offsite power system are described in Section 8.1.4.

The portion of the offsite power system from the startup transformer and ESF transformer XNB01 to the 4.16-kV Class 1E busses is discussed here. The offsite power system from the transmission line network to the startup transformer and ESF transformer XNB01 is discussed in Section 8.2.1.1.

Two physically independent sources of offsite power are brought to the onsite power system. One circuit is fed from ESF transformer XNB01 and supplies power normally to its associated 4.16-kV Class 1E bus.

The other circuit is fed from one secondary winding of the startup transformer, through ESF transformer XNB02, and supplies power normally to its associated 4.16-kV Class lE bus. In addition, each offsite power circuit can be manually aligned to supply power to the opposite or both 4.16-kV Class lE busses, if required. Each of these offsite power circuits is designed to be available in sufficient time to ensure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded following a loss of all onsite power sources and the remaining offsite power circuit.

The ESF transformers are equipped with automatic load tap changers (LTC). The ESF transformers with automatic LTCs do not share any common electrical or control circuits with any other transformer. They cannot be paralleled to each other even if the Class 1E 4.16kV busses NB01 and NB02 are being supplied by the same transformer. The failure of one ESF transformer will have no effect on the operation of the opposite ESF transformer. The credible failure mechanisms of the transformer that will have the worst-case effects on the associated Class 1E equipment are summarized in Table 8.3-4.

The two ESF transformers XNB01 and XNB02 are separated by a 3-hour fire wall.

The cables associated with each of these offsite power circuits are routed in separate and distinct raceways.

The offsite power circuits, including the transformers and cables, have been sized to carry their anticipated loads continuously. Each ESF transformer is sized to carry its associated safety-related load group continuously. The secondary feeder cables to the 4.16-kV Class lE busses are sized in excess of that required to carry their maximum load continuously. The startup transformer is sized to carry its anticipated load continuously, but may be slightly overloaded under certain abnormal conditions. For additional details of the sizing of these components, refer to Section 8.3.1.

8.2-1 Rev. 36

WOLF CREEK

These two circuits are fully testable. Since they are continuously energized, they are continuously tested by their use. When one circuit is shutdown, relays, meters, and other instruments can be tested and calibrated as required.

Control and instrumentation power for these offsite power circuits is provided by the Non-Class lE dc system. A dc power source from separate station batteries is provided to each offsite power circuit for control and relaying purposes.

From the above considerations, it is concluded that the installation, sizing, and control of both of the offsite power circuits are designed so as to minimize the likelihood of their simultaneous failure under operating and accident conditions.

For additional details concerning the compliance of the offsite power system with General Design Criteria, refer to Section 3.1.

The instrumentation associated with the offsite ac power system provides sufficient information to determine the system availability at any time.

Table 1.7-1 of the USAR contains drawings 10466-E-01NB01 and 10466-E-01NB02, Single Line Meter and Relay Diagrams for the Safety-Related 4.16-kV Busses NB01 and NB02. These drawings show the surveillance details of the ESF transformers and their associated 4.16-kV bus. Table 8.3-4 of the USAR, Failure Modes and Effects Analysis, shows the system failure modes and the method of such failure detection.

8.2.1.1 Transmission Network

The KG&E and KCPL transmission systems serve as the main outlet and source of offsite power for WCGS. Connection of the station output to the system is achieved via a 345-kV overhead line from the plant yard to the Wolf Creek 345-kV switchyard.

A rather extensive 345-kV network forms the backbone of the KG&E-KCPL and neighboring systems, as can be seen from Figure 8.2-1. This transmission system provides a highly reliable source of continuous power for plant shutdown.

KCPL and KG&E maintains voltage between a maximum and minimum range of +5%, -2%

of nominal. The frequency range is 60 +/- .002 Hertz.

8.2-2 Rev. 35

WOLF CREEK

There are three 345-kV lines connecting the Wolf Creek 345-kV Substation to the area transmission system. The three lines are as follows:

a. Wolf Creek-Waverly-LaCygne 345-kV Line:

The Wolf Creek-Waverly-LaCygne line is sectioned into two line sections. The first is a 5 miles long line connecting Wolf Creek to the Waverly Switching Station followed by a 53 miles long line connecting Waverly Switching Station to LaCygne Steam Electric Station which has three additional 345-kV lines.

b. Wolf Creek-Rose Hill 345-kV Line:

98 miles long, connecting to the Rose Hill Substation southeast of Wichita. Rose Hill Substation has three additional 345-kV connections.

c. Wolf Creek-Benton 345-kV Line:

100.1 miles long, connecting to the Benton Substation northeast of Wichita. Benton Substation has two additional 345-kV lines, one of which is to the Wichita 345-kV Substation, near the Gordon Evans Steam Electric Station.

The above 345-kV lines do not share common rights-of-way, do not have any crossovers, and are not in close proximity of one another, except in the immediate vicinity of the switchyard. In those areas, the design is such as to maintain clearances as required by the National Electric Safety Code (4).

In addition, a 27-mile long 69-kV line connects the Wolf Creek 345-kV switchyard to the Athens Switching Station located south of the Wolf Creek Plant site. The Wolf Creek-Rose Hill 345-kV line crosses over this 69-kV line once approximately 7 miles from the Wolf Creek Plant site. The physical separation of the two lines meets or exceeds the requirements of the National Electric Safety Code (4).

If one of the three 345-kV lines faulted, the breakers located at Wolf Creek Substation would trip, deenergizing the line (in the case of the Wolf Creek-Waverly-LaCygne Line only one segment of the line would normally be deenergized due to the Waverly tap, however, the remaining segment would no longer be credited as a source of power for the plant). Any one of the two remaining incoming 345-kV transmission lines at Wolf Creek Substation (in the case of the Waverly/LaCygne Line both line segments must be in-service) can carry the total ESF load required for safe shutdown by controlled switching of the Wolf Creek substation breakers, providing a separate transmission line feeding each ESF transformer.

The Phillips 69-kV line, Figure 8.2-5, is owned and maintained by the Lyon-Coffey County REC. It is not a supply line for the 69-kV system. Should a fault occur on this line, a 69-kV breaker located in the Wolf Creek Substation would trip, deenergizing the line -- not adversely affecting the 345-kV offsite source.

8.2-3 Rev. 34 WOLF CREEK

All line designs are such as to minimize the possibility of conductor vibration and/or galloping. The design of these overhead lines meets or exceeds the requirements of the National Electric Safety Code (4) for heavy loading district, Grade B construction, and is based on a lightning performance of less than one outage per 100 miles per year.

8.2.1.2 Switchyard and Connection to the Onsite Distribution System

Figure 8.2-3 shows the physical orientation and separation of the 345-kV and 69-kV switchyards; the main, startup, 345/69/13.8-kV, and 13.8/13.8kV transformers; the manual throwover switch and the transmission line routing.

Figure 8.2-4 provides a one-line diagram of the electrical distribution on the site. The electrical one-line diagram of the installation showing connections to offsite substations is shown in Figure 8.2-5.

The 345-kV switchyard design includes a breaker-and-a-half arrangement. 69-kV lines and transformers connected to the local transmission system are provided.

The 345-13.8-kV unit startup transformer, through switchyard breaker 345-100 or 345-110, serves one of the two Class IE busses by way of the ESF number two transformer. The No. 8 and No. 9 transformers (345/69/13.8-kV autotransformers) are both of the preferred sources for the second Class IE bus. The No. 8 transformer can supply the second Class IE bus by way of transformer No. 10 (13.8/13.8-kV phase-shift transformer), breaker 13-50, the manual throwover switch, and the ESF number one transformer. The No. 9 transformer can supply the second Class IE bus by way of transformer No. 11 (13.8/13.8-kV phase-shift transformer), breaker 13-49, the manual throwover switch, and the ESF number one transformer.

The No. 10 and No. 11 transformers supply five underground circuits. These five circuits feed through metal clad switchgear with drawout type breakers and a transfer bus which serve the ESF No. 1 transformer, one switchyard station power transformer, the site distribution system, and the east and west construction loops. Figure 8.2-3 shows the routing of the overhead line from the 345-kV switchyard to the startup transformer, which serves one of the load groups. This figure also shows the underground circuits encased in concrete from the primary 345/13.8-kV source and the alternate 345/69-kV source to the manual throwover switch, then from the manual throwover switch in the 69-kV switchyard via an underground circuit encased in concrete to the ESF number one transformer. Voltage studies have been performed and cables have been sized to assure that either offsite source is capable of supplying the entire Class IE loads should it become necessary.

8.2-4 Rev. 36 WOLF CREEK

The 69-kV system may be connected to the 345-kV system through Transformers No.

8 and/or No. 9. When Transformers No. 8 and 9 are supplying power to XNB01 in parallel, the 69-kV bus must be connected to Transformer No. 8 and No. 9 simultaneously, or connected to neither transformer.

Three single-phase, one-third size, step-up transformers provided for the unit raise the generator voltage to 345-kV prior to transmission, via an overhead line, to the 345-kV switchyard located approximately 700 feet due north of the turbine building. This overhead line is not carried on the same supporting structures as the line to the unit startup transformer. The design of these overhead lines meets or exceeds the requirements of the National Electric Safety Code (4) for heavy loading district, Grade B construction.

The generating unit is to be synchronized to the system across the generator circuit breakers located in the 345-kV switchyard. Control of these synchronizing breakers and the 13.8-kV breakers is administered from the plant main control room. Control Room indication is provided for all 345-kV breakers and 69-kV feeder breakers. Control of all other transmission breakers in the Wolf Creek switchyard is via supervisory control from the Operating Agent's System Control Center in Topeka.

In addition to status indication of all 345-kV breakers and line disconnect switches, the 69-kV feeder breakers and the 13.8-kV breakers, eight main control board annunciator windows are provided to alert the operator to any failure which could result in loss of availability of either preferred offsite source to perform its intended function. These alarms include the following:

345-kV Supervisory Trouble 345-kV Battery Trouble SU XFMR Trouble SU XFMR Lockout

1. 8/#10 XFMR Trouble

1. 9/#11 XFMR Trouble 13-49 Breaker Trip 13-50 Breaker Trip

8.2-5 Rev. 36 WOLF CREEK

A partial breakdown of many of these alarms is provided on the plant computer alarm listing with a further breakdown on the local annunciator panel in the switchyard buildings and equipment cabinets. A voltmeter is provided on the main control board for monitoring the voltage on the 13.8-kV cross-tied busses SL7/SL8 and breakers 13-49 and 13-50.

The 345/69/13.8-kV transformers are equipped with Open Phase Detection equipment. The purpose of this equipment is to ensure that an Open Phase Condition (OPC) event is detected. An OPC is created when there is not proper circuit continuity for one or more phases of an offsite source.

No failure causing a loss of function of one offsite source can occur without alarming on the Main Control Board in some manner. The main switchyard bus and interconnections between various switchyard components are comprised of rigid aluminum busses - connected together with aluminum jumpers.

8.2.1.3 Compliance with Design Criteria and Standards

The offsite power systems are capable of providing reliable sources of power to the Class IE systems in compliance with GDC 17 and 18 of 10 CFR Part 50 and Regulatory Guide 1.32. Design of the offsite power systems for Wolf Creek exceeds the minimum requirements cited in the above documents as demonstrated by the following analysis.

Criterion 17 - Electric Power Systems

In addition to the features detailed in Sections 8.2.1.1 and 8.2.1.2, compliance with Criterion 17 is further demonstrated by the following:

a. In the event any one of the overhead 345-kV transmission lines were to be interrupted, either one of the remaining two lines is capable (in the case of the Waverly/LaCygne Line both line segments must be in-service) of carrying the total ESF load required for post-accident and post-fire safe shutdown.

Controlled switching of the Wolf Creek substation breakers, providing a separate transmission line feeding each ESF transformer, based on grid conditions, is an acceptable means of maintaining acceptable voltage to carry the ESF load required for post-accident and post-fire safe shutdown.

b. The two 345-kV transmission lines from the plant yard to the switching station are supported on their own individual structures. Structural design and circuit separation are such as to eliminate the possibility of a structural collapse causing an outage of both 345-kV transmission lines.

c. The 345-kV system is protected from lightning and switching surges by lightning protective equipment and by overhead static lines.

8.2-6 Rev. 36 WOLF CREEK

d. The design of all overhead lines meets or exceeds the requirements of the National Electric Safety Code (4) for heavy loading district, Grade B construction, and is based on a lightning performance of less than one outage per 100 miles per year. Design of switchyard components is in accordance with the latest standards of the IEEE, ANSI and NEMA.

e. The design of the 125-V dc system for the 345-kV portion of the switchyard consists of two independent dc systems. Each of the two systems consists of a separate 125-V dc battery, battery charger, and distribution system. Cable separation is maintained between the two systems. A single failure caused by a malfunction of either of the two 125-V dc systems will not affect the performance of the other system. The ability of the switchyard to supply offsite power to the plant will not be affected by the loss of one of the two 125-V dc systems. The surveillance of battery charger operation and battery voltage for each battery system is provided by individual alarms monitored in the switchyard control building. Alarms are also monitored in the plant control room. The 69-kV portion of the switchyard has its own 125-Vdc battery for relaying. There is no dc tie between the switchyard batteries and those in the power block.

f. Two isolated 13.8-kV supplies from separate sources are provided to the switchyard. One supply is from the offsite 13.8-kV bus and the other is from a site 13.8-kV bus. Each supply serves a station power transformer which is capable of supplying the total ac load of the station. Loss of the normal source will initiate automatic throwover of all load to the standby transformer.

Subsequent loss of the standby source will initiate automatic throwover to a standby diesel generator.

g. For reliability and operating flexibility, the 345-kV switchyard design includes a breaker-and-a-half arrangement for each circuit. Along with breaker failure backup protection. Each 345-kV breaker has two trip coils on separate isolated dc control circuits. The above provisions permit the following:

1. Any transmission line can be cleared under normal or fault conditions without affecting any other transmission line.

2. Any 345-kV circuit breaker can be isolated for maintenance without interrupting the power or protection to any circuit.

3. Short circuits on a section of bus can be isolated without interrupting service to any circuit other than that connected to the faulted bus section.

h. Both offsite sources from the 345-kV switchyard are separate and independent. The failure or structural collapse of one will not affect the other.

8.2-7 Rev. 30 WOLF CREEK

i. The offsite sources from the startup and the two primary 345/69/13.8-kV transformers to the ESF transformers and associated switchgear are independently and separately routed.

j. Two physically independent circuits are provided to supply offsite power to the onsite distribution system.

The offsite sources from the 345-kV switchyard are each normally connected to their own individual ESF transformers, and are both immediately available following a LOCA to supply components important to safety.

Criterion 18 - Inspection and Testing of Electric Power Systems

The 345-kV and 69-kV circuit breakers are inspected, maintained and tested on a routine basis. This can be accomplished without removing the generators, transformers or transmission lines from service.

Transmission line protective relays are tested on a routine basis. This can be accomplished without removing the transmission lines from service. The OPD equipment includes abnormal condition alarms and can be functionality tested with the system online. Generator, main, startup and standby transformer relays are tested on a routine basis when the generator is off line.

Regulatory Guide 1.32

As described in the paragraph above, the two offsite sources are immediate access circuits from the transmission network.

This design conforms to the preferred design as outlined in Regulatory Guide 1.32.

Industry Standards

The design complies with the following industry standards and recommendations:

1. Institute of Electrical Electronics Engineers, Inc (IEEE)

2. American National Standards Institute (ANSI)

3. National Electrical Manufacturers Association (NEMA)

4. American Institute Steel Construction (AISC)

5. American Concrete Institute (ACI)

8.2-8 Rev. 36 WOLF CREEK

6. American Society for Testing and Materials (ASTM)

7. American Welding Society (AWS)

8. Steel Structures Painting Council (SSPC)

9. National Environmental Systems Contractors (NESC)

10. National Electrical Code (NEC)

11. American Society of Civil Engineers (ASCE)

12. Underwriters Laboratory, Inc (UL)

13. Local Building Codes

14. American Iron and Steel Institute (AISI)

15. Metal Building Manufacturers Association (MBMA)

16. Sheet Metal and Air Conditioning Contractors National Association (SMACNA)

8.2.2 ANALYSIS

The 345-kV system to which the WCGS is connected is quite extensive with several major interconnections to other regions. One major benefit to be derived from such a system is that, through proper design, the system continues to function properly on loss of a generating unit, loss of a heavily loaded circuit, or various other contingency conditions.

Analysis of conditions during plant operation demonstrate the following regarding the Wolf Creek 345-kV Substation and its associated lines:

1. The system can successfully withstand loss of the Wolf Creek unit when fully loaded.

2. With all 345-kV lines in service and the Wolf Creek unit fully loaded, the system can successfully withstand loss of any one 345-kV line from Wolf Creek Substation under three-phase fault conditions with the fault cleared in normal clearing sequence.

3. With all 345-kV lines in service and the Wolf Creek unit fully loaded, the system can successfully withstand loss of any two elements caused by a single phase fault being cleared by back-up breaker operation in back-up clearing sequences.

8.2-9 Rev. 0 WOLF CREEK

4. Any one 345-kV line, when energized from the remote end (in the case of the Waverly/LaCygne 345kV Line both line segments must be energized), can successfully carry the total ESF load required for post-accident and post-fire safe shutdown should it become necessary to do so.

Controlled switching of the Wolf Creek substation breakers, providing a separate transmission line feeding each ESF transformer, based on grid conditions, is an acceptable means of maintaining acceptable voltage to carry the ESF load required for post-accident and post-fire safe shutdown.

5. All of the above comments apply on both a transient stability and a steady state basis.

The analyses of the WCGS demonstrate that the transmission system is fully capable of delivering the output from WCGS and of providing adequate power for safe operation of WCGS.

A transmission system analysis has shown the frequency decay rate to be below 5.0 Hz/sec, therefore, the reactor coolant pump motor breakers are not required to be safety grade.

Transmission grid availability of the KG&E and KCPL systems has historically been very high with no recorded incidents of system islanding within the twenty year period prior to licensing. During the period 1942 to the mid-sixties, KG&E and KCPL established multiple 138 and 161-kV interconnections with their neighboring utilities, significantly strengthening the reliability of the bulk power systems. Grid availability has been further strengthened by multiple 345-kV lines constructed in this and surrounding areas since 1966.

The area's historical outage rate prior to licensing for 345-kV circuits is below 1.0 per 100 circuit miles/year for outages of over 15 minutes duration and less than 2.0 per 100 circuit miles/year for all outages including momentary interruptions. This compares favorably with the historical performance of other 345-kV transmission systems. These outages are caused primarily by lightning, wind and ice.

In view of the applied system design, and based on past performance of the transmission system, uninterrupted transmission grid availability to meet all requirements is projected over the life of WCGS.

8.2-10 Rev. 29 IOWA T 0 MrNNE APOLIS

, TO DES MOINES ...... -*

NEBRASKA \\ .. - - .. .. - -..... --.. - .. - - .. - -"' ---.. -.. __ ..... _

TO OMAHA'-

TO LINCOLN \\

....... - .... ----------- ..... --:-.. ______ MISSOURI

KANSAS HOYT STRANGER CREEK

TO ST. LOUIS

1\\

• WIND POWER

~ STATION TO e SUBSTATION ST. LOUIS

• POWER STATION

- 345 KV LINE TRANSMISSION

---STATE BORDER

Rev. 32

WOIJF1 CREEK UPDATElD fiAFElmY ANALYf!I REPORT

TO Figure 8.2-1

TO OKLAHOMA CITY OKLAHOMA TO TULSA 345 KV SYSTEM

(Historical)

TO WAVERLY WIND FARM COLLECTOR SUB 5 MILES

100.1 MILES

AREA OF CHANGE WAVERLY 345KV

345KV TO WAVERLY 5 MILES

AREA OF WOLF CREEK CHANGE 345KV

345KV TO LACYGNE 53 MILES

LATHAM

TO SOONER 34 WOLF CREEK

8.3 ONSITE POWER SYSTEMS

The onsite power system is comprised of a standardized portion within the power block which uses the same design as Callaway and a nonstandardized portion outside of the power block.

8.3.1 AC POWER SYSTEMS

8.3.1.1 Description

The onsite ac power system includes a Class IE system and a non-Class IE system.

8.3.1.1.1 Non-Class IE System

8.3.1.1.1.1 Non Class IE Site Auxiliary Power System

A single-line diagram of the AC auxiliary power system is shown in Figure 8.3-1, sheet 3.

Site auxiliary power is supplied at 13.8-kV from two independent sources within the power block: Buses PA01 and PA02. Neither of these is a Class IE power bus. Two air circuit breakers at each source (four total) deliver power to the site through underground feeder cables. Controls, metering, instrumentation and protective relaying for each site feeder are provided within the power block.

One of the site feeders serves the makeup water screenhouse and makeup water discharge structure. At the makeup water discharge structure, the feeder is tapped to supply a 480-volt unit substation through a 13.8-kV-480V transformer for the raw water pumps. At the screenhouse, the feeder supplies 4.16-kV switchgear through a 13.8/4.16-kV transformer. The transformer is rated 5.0 MVA, OA, and is equipped for automatic tap changing under load. The 4.16-kV switchgear supplies the makeup water pumps and a 480-volt unit substation for various auxiliaries.

One site feeder from each of the power block buses serves the non-Class IE circulating water screenhouse. At the screenhouse, each feeder supplies 13.8-kV switchgear through a manually operated, normally closed disconnect. A normally open disconnect between the two switchgears permits manual interconnection of the buses, but mechanical interlocks prevent interconnection of the independent site feeders. Each of the site feeders is sized to carry the entire screenhouse in the event the other feeder is disabled. Each 13.8-kV switchgear supplies circulating water pumps, a 480-volt unit substation for auxiliaries, and a 4.16-kV switchgear through a 13.8/4.16-kV transformer rated 5.0 MVA, OA. Electrically operated circuit breakers at the 4.16-kV switchgear permit interconnection of the buses, but electrical interlocks prevent

8.3-1 Rev. 13 WOLF CREEK

parallel operation of the 13.8/4.16-kV transformers. Each transformer is sized to carry the entire 4.16-kV screenhouse load in the event the other transformer is disabled. The 4.16-kV switchgear supplies the service water pumps and the motor-driven fire pump.

The remaining site feeder serves 13.8-kV switchgear located in the shop building. This switchgear supplies standby station power for the 345-kV switchyard, an emergency feed for the town of Burlington, Kansas, and 480-volt unit substations for auxiliaries at the shop building, administration building, main warehouse, auxiliary warehouse, technical support center, guardhouse, and Water Treatment Building North.

Electrical interlocks, or administrative controls, prevent interconnection of the onsite auxiliary power system with the Burlington normal source or the switchyard station power normal source.

The selection, application, and design of the equipment used in the onsite auxiliary power system is compatible with that of the power block and is in compliance with applicable standards and regulations.

8.3.1.1.1.2 Non-Class IE Powerblock Power System

The non-Class IE ac system is that part of the power system outside the broken-line enclosures indicated in Figure 8.3-1, sheet 1. The non-Class IE ac system distributes power at 13.8 kV, 4.16 kV, 480 V, and 208/120 V ac for all nonsafety-related loads. The non-Class IE ac system also supplies preferred (offsite) power to the Class IE ac system through two ESF transformers. One ESF transformer is supplied power directly, by one of the preferred power circuits, from the offsite power system. The second ESF transformer is supplied power from one of the secondary windings of the startup transformer.

This startup transformer is supplied power from the second preferred power circuit from the offsite power system. Feeds to ESF transformer XNB01 and the startup transformer are described in Section 8.2.1.2.

The unit auxiliary transformer and the startup transformer each have two secondary windings rated at 13.8 kV.

Two 13.8-kV busses supply power to nonsafety-related loads. Each 13.8-kV bus is connected to a secondary winding of the startup transformer and also to a secondary winding of the unit auxiliary transformer. During starting of the unit, both 13.8-kV busses are

8.3-2 Rev. 35 WOLF CREEK

supplied power from the startup transformer. The busses are later transferred to the unit auxiliary transformer, during power generation, by a manually initiated transfer. Automatic transfer of the 13.8-kV busses from the unit auxiliary transformer to the startup transformer is provided.

a. The bus transfer is performed immediately after electrical faults where the generator/network can no longer supply power to the reactor coolant pumps.

b. The bus transfer is performed approximately three seconds after generator vital trips (trips initiated by a turbine trip due to a mechanical fault) where the generator/network can no longer supply power to the reactor coolant pumps. Generator vital trips are initiated by turbine trips on low vacuum, thrust bearing wear, low bearing oil pressure and high vibration.

c. The bus transfer is performed approximately 33 seconds after initiation of Reverse Power Relay and subsequent generator non-vital trips circuitry (trips not involving electrical or turbine faults).

The turbine generator remains connected to the switchyard during the delay to allow the switchyard to supply power to the reactor coolant pump busses for at least 30 seconds before any transfer is made.

The startup transformer has the capacity to supply both non-Class IE and both Class IE load groups simultaneously. Refer to Section 8.1.2 for a definition of load group. Figure 8.3-1 shows the transformers, feeders, busses, and their connections. It also lists all loads directly supplied from each 13.8-kV and 4.16-kV bus.

Two feeders from each of the two 13.8-kV busses supply power to non-Class IE site loads located outside the power block. Loads and power distribution systems for WCGS are described in detail in Section 8.3.1 of the USAR.

The startup transformer is equipped with two secondary windings, each rated at 13.8 kV, 50 MVA FOA.

The startup transformer, ESF transformers, and their associated feeder cables have all been sized to carry their expected loads continuously. During normal system operation, transformer loads are below the manufacturer's FOA design limitations. Under abnormal system configurations, such as when ESF No. 2 or a station service transformer have lost their normal feeds, loads may be transferred to the alternate startup transformer secondary winding. (NOTE:

The previous statement is for very limited conditions of plant operation which include as stated, abnormal or complicated scenarios. Refer to USAR Fig. 8.2-4 for a better description of actual system configuration.) Provisions exist for the automatic transfer of busses PB03/PB04 to their alternate source. Under these conditions, additional loads may be placed on a startup transformer secondary winding.

8.3-3 Rev. 33 WOLF CREEK

Analyses have been performed to evaluate the maximum bus and transformer loadings that may result from these transformer failures. These loads represent the maximum credible loads that may be achieved during abnormal system operation.

Using the guidelines of ANSI C57.92-1962, operation of oil-immersed power transformers in an overloaded condition is permissible. Measurable loss of transformer life occurs if the overload is allowed to persist for extended periods of time.

The protective relays associated with the startup transformer are set above these maximum overload values.

The continuous ampacity of the feeder cables from the startup transformer to the 13.8 kV switchgear PA02 and ESF transformer XNB02 is not exceeded under any loading condition described above.

8.3.1.1.1.3, Station Blackout Diesel Generators

The Station Blackout Diesel Generator (SBO DG)System consists of a missile barrier located outside of the Protected Area (PA) that contains the necessary equipment required to provide reliable power to 4.16 kV Class 1E bus NB001 or NB002 during a station blackout event, and to the non-safety auxiliary feedwater pump (NSAFP).

This equipment includes three diesel generators (DGs) and one power equipment center (PEC). The PEC includes nine 4.16 kV switchgear sections, four control panels and one 125 VDC battery system in addition to other auxiliary equipment required to support the operation of the system.

One control panel is also located in each of the ESF Switchgear Rooms to allow operation of the SBO DG system without the need for plant personnel to be present in the missile barrier.

Each diesel generator is housed within its own enclosure which contains all equipment necessary to start the DGs. Starting of the SBO DGs must be initiated by an operator, from any of the following locations:

1) Engine control panels located within the diesel generator enclosure.

2) Local control panel located inside the PEC. The diesel generators can be started simultaneously through a Human-Machine Interface (HMI) touchscreen. They can also be started individually through the HMI touchscreen or through control switches.

3) Remote control panels located inside the ESF Switchgear Room. The diesel generators can be started either individually or simultaneously through HMI touchscreens.

Note: The SBO DG control switches must be in the auto position in order to be controlled through the HMI touchscreens.

a. Installed Capability All system operation within the control system for the diesel generators, including each of the HMIs, is performed in what is described as Minimum Requirements Mode. The SBO vendor has provided alternate modes of operation that involve modifications to the NB switchgear, running the SBO DGs in parallel with energized NB switchgear or the construction loop, and installing an external load bank. However, these options have not been installed.

8.3-4 Rev. 30 WOLF CREEK

Minimum Requirements Mode is the installed configuration. There are no connections between the existing switchgear (NB001 and NB002) and the Kohler switchgear except for the differential CT wires and the open/closed status of NB00114 and NB00214. The operation of breakers NB00114 and NB00214 is manual only with no automatic protective features.

The Kohler-supplied switchgear is designed to control three Kohler 3250 kW

generators in parallel with each other. All transfers and tests are manually initiated using an HMI (touchscreen).

There is one 15" HMI (touchscreen) mounted on the control section in the PEC for system monitoring and control. The Kohler- provided PLC-based control system consists of one hot standby master PLC and a PLC for each generator. In the event of a complete PLC system failure, the operator can use the control switches on the KU100 Local Control Panel to synchronize the generators and manually connect them to PB005.

There are two remote control panel enclosures. One is located in the NB00l Switchgear room and the other in the NB002 Switchgear room. There is one 15" HMI (touchscreen) mounted on each remote enclosure for system monitoring and control. The control switches on each remote control panel enclosure, with the exception of the emergency stop push buttons, are not functional in Minimum Requirements Mode. All breakers in NB001 and NB002 must be operated locally. No status (except open/closed status of NB00114 and NB00214) or control of these breakers is available.

To protect the cables going from the PB bus to the NB buses, monitoring, alarms and protective relaying are utilized. The loading on the cables will be monitored by the PLC, using an elapsed time counter to track the amount of time that the cables are loaded beyond a specified setpoint. The HMI will also alarm when the cables are loaded beyond the same setpoint. The setpoint along with a time delay is configurable through the HMI. Protective relaying is present at the PB bus that prevents cable overload damage while allowing the required loads to be powered without spurious tripping.

b. Periodic Testing

The SBO DG system will be periodically tested to ensure continued reliability of the system. The system is capable of performing the following tests while in the Minimum Requirements Mode:

No Load Test This test is performed from the PEC local control panel. This test will run the SBO diesels for an operator defined amount of time to verify readiness to operate.

8.3-5 Rev. 30 WOLF CREEK

• NSAFP Load Test This test is performed from either the PEC local control panel or one of the ESF Switchgear Room remote control panels.

This test will start and synchronize at least two diesel generators to the PB005 bus and will prevent the PB005 bus from powering the NB busses, before closing the PB00506 breaker.

The SBO DGs will provide power to the NSAFWP for the specified period of time to verify readiness to operate.

• NB Functional Load Test

This test is performed from either of the ESF switchgear room remote control panels. This test will unload and de-energize the NB busses, then start at least two SBO DGs, energize the NB busses from the SBO DGs, and carry necessary plant loads for a Station Blackout Event.

8.3.1.1.2 Class 1E AC System

The Class 1E AC system is that portion of the onsite power system inside the broken-line enclosures shown in Figure 8.3-1, sheet 1, and sheet 2.

The Class 1E AC system distributes power at 4.16 kV, 480 V, 208/120 V, and 120 V ac to all safety-related loads. Also, the Class 1E AC system supplies certain selected loads which are not safety related but are important to the plant operation. Figure 8.3-2 lists the major safety-related and isolated nonsafety-related loads supplied from the Class 1E AC system.

In addition to the above power distribution, the Class 1E AC system contains standby power sources diesel generator which provide the power required for post-accident and post-fire safe shutdown in the event of a loss of the preferred power sources.

The following describes various features of the Class 1E systems:

POWER SUPPLY FEEDERS - Each 4.16-kV load group is supplied by two preferred power supply feeders and one diesel generator (standby) supply feeder. Each 4.16-kV bus supplies motor loads and 4.0-kV/480-V load center transformers with their associated 480-V busses.

BUS ARRANGEMENTS - The Class 1E AC system is divided into two redundant load groups (load groups 1 and 2). Either one of the load groups is capable of providing power to safely reach cold shutdown. Each ac load group consists of a 4.16-kV bus, 480-V load centers, 480-V motor control centers, and lower voltage ac supplies.

LOADS SUPPLIED FROM EACH BUS - Refer to Figure 8.3-2 for a listing of Class 1E system loads and their respective busses.

MANUAL AND AUTOMATIC INTERCONNECTIONS BETWEEN BUSSES, BUSSES AND LOADS, AND BUSSES AND SUPPLIES - No provisions exist for automatically connecting one Class IE load group to another redundant Class IE load group or for automatically transferring loads between load groups. The incoming preferred power supply associated with a load group can supply the 4.16-kV Class 1E bus of the other load group by manual operation of the requisite 4.16-kV circuit breakers when required.

8.3-6 Rev. 30 WOLF CREEK

For a discussion of interlocks, refer to Section 8.3.1.1.3.

INTERCONNECTIONS BETWEEN SAFETY-RELATED AND NONSAFETY-RELATED BUSSES - No interconnections are provided between the safety- and nonsafety-related busses.

The startup transformer supplies power through the same winding to a 13.8-kV bus and a 13.8/4.16-kV ESF transformer.

REDUNDANT BUS SEPARATION - The Class 1E switchgear, load centers, and motor control centers for the redundant load groups are located in separate rooms of the control building and auxiliary building in such a way as to ensure physical separation. Refer to Section 8.3.1.4.1 and Section 8.3.1.1.7 for the criteria governing redundant bus separation.

CLASS 1E EQUIPMENT CAPACITIES -

a. 4.16-kV Switchgear

Bus 2000A continuous rating Incoming breakers 2000A continuous, 350 MVA interrupting

Feeder breakers 1200A continuous, 350 MVA interrupting

b. 480-V Unit Load Centers

Transformers 1000 kVA, 3 phase, 60-Hz, 4000/480 V Bus 1600A continuous Incoming breakers 1600A continuous, 50,000A rms symmetrical interrupting Feeder breakers 800A continuous, 30,000A rms symmetrical interrupting (AKR) 800A continuous, 42,000A rms symmetrical interrupting (MP)

c. 480-V Motor Control Centers

Horizontal bus 600A continuous, 25,000A rms symmetrical Vertical bus 300A continuous, 25,000A rms symmetrical Breakers 25,000A rms symmetrical, (molded case) minimum interrupting (singly for thermal-magnetic breakers and in combination with a starter for magnetic only breakers)

AUTOMATIC LOADING AND LOAD SHEDDING - The automatic loading sequence of the Class IE busses is indicated in Figure 8.3-2.

If preferred power is available to the 4.16-kV Class 1E bus following a LOCA, the Class 1E loads are started in programmed time increments by the load sequencer. The emergency standby diesel generator is automatically started but not connected to the bus. However, in the event that preferred power is lost following a LOCA, the load sequencer will function to shed selected loads and automatically start the associated standby diesel generator (connection of the standby diesel generator to the 4.16-kV Class 1E bus is performed by the diesel generator control circuitry). Load sequencers then function to start the required Class 1E loads in programmed time increments.

8.3-7 Rev. 30 WOLF CREEK

A failure modes and effects analysis and a reliability study have been performed on the load shedder emergency load sequencers (LSELS). These studies have shown that no failure within a single LSELS can result in the failure of both sources of offsite power, that there are no credible sneak circuits or common mode failures in the LSELS that could render both the onsite and offsite power sources unavailable, and that sequencing of loads on the offsite power system does not compromise the reliability of the offsite power source.

There are no permissive devices (e.g., lube oil pressure) incorporated into the final actuation control circuitry for large horsepower, safety-related motors.

Refer to Section 8.3.1.1.3 for additional information on load shedding and sequencing.

CLASS 1E EQUIPMENT IDENTIFICATION - Refer to Section 8.3.1.3 for details regarding the physical identification of Class 1E equipment.

INSTRUMENTATION AND CONTROL SYSTEMS FOR THE APPLICABLE POWER SYSTEMS WITH THE ASSIGNED POWER SUPPLY IDENTIFIED - The dc control supplies for switchgear breaker operation are separate and independent so that Class 1E dc load group 1 supplies Class 1E load group 1 switchgear. The battery chargers for dc load group 1 are fed from the same load group switchgear. Class 1E dc load group 2 supplies Class 1E load group 2 switchgear. For further information on the dc power system, refer to Section 8.3.2.

Each 4.16-kV switchgear bus and 480-V load center bus is equipped with an undervoltage relay for annunciation in the control room. All Class 1E 4.16-kV buses are provided with voltage and current indication. The 480 volt system is provided with current indications only.

ELECTRIC CIRCUIT PROTECTION SYSTEMS - Protective relay schemes or direct-acting trip devices on primary and backup circuit breakers are provided throughout the onsite power system in order to:

a. Isolate faulted equipment and/or circuits from unfaulted equipment and/or circuits

b. Prevent damage to equipment

c. Protect personnel

d. Minimize system disturbances

The short circuit protective system is analyzed to ensure that the various adjustable devices are applied within their ratings and set to be coordinated with each other to attain selectivity in their operation. The combination of devices and settings applied affords the selectivity necessary to isolate a faulted area quickly with a minimum of disturbance to the rest of the system.

8.3-8 Rev. 27 WOLF CREEK

Major types of protection applications that are used consist of the following:

a. Overcurrent Relaying

Each bus supply breaker (except the standby diesel breaker) is equipped with three inverse-time overcurrent relays and one inverse-time ground fault relay for bus faults and to provide backup for feeder circuit relays.

Bus supply breakers from the standby emergency diesel generator are equipped with three inverse-time overcurrent relays only. Ground protection is provided on each generator neutral.

Each 4.16-kV motor circuit breaker has three overcurrent relays, each with one long-time and two instantaneous elements for overload, locked rotor, and short circuit protection. Each 4.16-kV motor circuit breaker is also equipped with an instantaneous ground current relay.

The current for Class 1E motors is monitored by computer in the control room and at the Class 1E switchgear.

Each 4.16-kV supply circuit breaker to a load center transformer has three overcurrent relays with long-time and instantaneous elements. An instantaneous overcurrent ground current relay provides sensitive ground fault protection.

b. Undervoltage Relaying

Each 4.16-kV Class 1E bus is equipped with undervoltage relays for diesel generator start initiation and undervoltage annunciation.

Each 480-V Class 1E load center bus is equipped with undervoltage relays for undervoltage annunciation.

c. Differential Relaying

The main, unit auxiliary, startup, station service, and ESF transformers are equipped with differential relays.

These relays provide high-speed disconnection to prevent severe damage in the event of transformer internal faults.

Motors rated above 3,500 horsepower are equipped with differential protection.

The main generator and the standby emergency diesel generator are provided with differential protection.

d. 480-V Load Center Overcurrent Relaying

Each 480-V load center circuit breaker is equipped with a solid state device which has an adjustable phase and ground overcurrent trip.

8.3-9 Rev. 27 WOLF CREEK

e. 480-V Motor Control Center Overcurrent Relaying

Molded case circuit breakers provide time overcurrent and/or instantaneous short circuit protection for connected loads. The molded case circuit breakers for motor circuits are equipped with instantaneous trip only. Motor overload protection is provided by ambient compensated thermal trip units in the motor controller.

The molded case breakers for nonmotor feeder circuits provide thermal time overcurrent protection as well as instantaneous short circuit protection.

All starters for motor-operated valves are equipped with thermal overload relays. The thermal overload relay trip contacts located in 480-V motor control centers for all Class 1E valves, are bypassed in accordance with Regulatory Guide 1.106, Rev. 1, dated March 1977.

The starters and the feeder circuit breakers located in the motor control center are coordinated with the motor control center incoming supply breakers so that, upon ground fault, the protective device nearest the fault trips first. Where coordination is not possible using the protective devices normally furnished in a standard motor control center module, solid-state ground fault protectors are added to the affected modules on an individual basis.

TESTING OF THE AC SYSTEMS DURING POWER OPERATION - All Class 1E circuit breakers and motor controllers are testable during reactor operation, except for the electric equipment associated with those Class 1E loads identified in Chapter 7.0. During periodic Class 1E system tests, subsystems of the engineered safety features actuation system, such as safety injection, containment spray, and containment isolation, are actuated, thereby causing appropriate circuit breaker or contactor operation. The 4.16-kV and 480-V circuit breakers and control circuits can also be tested independently while individual equipment is shut down. The circuit breakers can be placed in the test position and exercised without operation of the associated equipment.

8.3.1.1.3 Standby Power Supply

The standby power supply for each safety-related load group consists of one diesel generator complete with its accessories and fuel storage and transfer systems. It is capable of supplying essential loads necessary to reliably and safely shut down and isolate the reactor. Each diesel generator is rated at 6,201 kW for continuous operation. Additional ratings are 6,635 kW for 2,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, 6,821 kW for 7 days, and 7,441 kW for 30 minutes. The generator 2-hour rating is equal to the 7-day rating. Each diesel generator is connected exclusively to a single 4.16-kV safety feature bus for one load group. The load groups are redundant and have similar safety-related equipment. Each load group is adequate to satisfy minimum engineered safety features demand caused by a LOCA and/or loss of preferred power supply. The diesel generators are electrically isolated from each other. Physical separation for fire and missile protection is provided between the diesel generators, since they are housed in separate rooms of a seismic Category I structure. Power and control cables for the diesel generators and associated switchgear are routed to maintain physical separation.

8.3-10 Rev. 27 WOLF CREEK

Ratings for diesel generator sets are established in order to satisfy the requirements set forth in Regulatory Guide 1.9. Refer to Section 8.1.4.3.

The diesel generator loads are determined on the basis of nameplate rating, pump pressure and flow conditions, or pump runout conditions. The basis for each load is noted in Figure 8.3-2. The continuous rating of the diesel generator is based on the maximum total load required at any time.

The functional aspects of the onsite power system are discussed below.

STARTING INITIATING CIRCUITS - The diesel generators are started on the following:

a. Receipt of a safety injection signal (SIS)

b. Loss of voltage to the respective 4.16-kV Class 1E bus to which each generator is connected

c. Manual - Remote switch actuation (main control room)

d. Manual - Local switch actuation (diesel generator room)

e. Emergency Manual - Local switch actuation (diesel generator room)

Refer to logic diagrams - Figures 8.3-3, 8.3-4, and 8.3-5.

DIESEL STARTING MECHANISM AND SYSTEM - Refer to Section 9.5.6.

TRIPPING DEVICES - The following protective functions are for each diesel generator:

a. Start failure relay

b. Engine overspeed

c. High jacket coolant temperature

d. Low lube oil pressure

e. High crankcase pressure

f. Generator differential

The above protective devices, which function to shut down the diesel or trip the diesel generator breaker, are also functional following an SIS or loss of offsite power.

The high jacket water coolant temperature, and low lube oil pressure, switches initiate shutdown only upon coincidence of a modified two-out-of-four logic.

The high crankcase pressure switches initiate shutdown only upon coincidence of a modified two-out-of-three logic. That is, a false trip on one channel does not erroneously shut down the diesel generator.

8.3-11 Rev. 27 WOLF CREEK

The remaining protective functions that are retained during an SIS are (1) generator differential, (2) engine overspeed, and (3) start failure.

In accordance with the provisions of Reg. Guide 1.9, the engine overspeed and generator differential trips are retained to protect the diesel generator set from massive damage. The start failure protection functions to interrupt the starting of the diesel generator if a predetermined speed is not reached or if lube oil pressure is not established within a predetermined time following the start initiation.

Reverse power, loss of field, generator overcurrent, generator voltage-restrained overcurrent, generator ground overcurrent, overexcitation and underfrequency protection are also provided but cause a trip only during tests when the diesel generator is operating in parallel with the preferred power system.

During testing with a loss of offsite power event the diesel generator may trip due to one of the seven (7) previously mentioned protective trips. If the diesel generator trips, operator action may be required to reset a lockout relay. If the diesel generator does not trip, operator action is required to disable the seven (7) protective trips and place the diesel generator in isochronous mode.

Underfrequency protection is provided for safely separating the diesel generators from the preferred source (when previously synchronized to it) without damage to or shutdown of the diesel generators.

The diesel generators are monitored from the control room, and each device, when actuated, initiates an annunciator in the diesel generator room, a summary annunciator in the control room, and in some cases individual annunciation in the control room (see Section 8.3.1.1.3). The alarms are set to provide a warning of impending trouble prior to trip of the diesels.

INTERLOCKS - Circuit breaker electrical interlocks are provided to prevent automatic closing of a diesel generator breaker to an energized or faulted bus.

If the preferred power has been lost, undervoltage relays on the incoming (offsite) side of the 4.16-kV feeder breakers prevent closure of these breakers.

The two 4.16-kV circuit breakers which control the incoming preferred source power to a 4.16-kV Class 1E bus are so interlocked that only one breaker can be closed at any one time. This is to prevent parallel operation of the preferred sources.

When operating from the diesel generator supply (loss of offsite power),

redundant load groups cannot be manually connected together since the 4.16-kV circuit breakers controlling the incoming preferred power supplies to the Class 1E busses are interlocked to prevent paralleling of the diesel generators.

During normal operation (offsite power available), synchronizing check relays provide an interlock function. They prevent an operator error that would parallel the standby power source with the offsite power source when the two are out-of-synchronism.

8.3-12 Rev. 27 WOLF CREEK

PERMISSIVES - A single switch (AUTO, LOCAL/ MANUAL) in the diesel generator room is provided for each diesel generator to block automatic start signals when the diesel is out for maintenance (i.e., LOCAL/MANUAL position). When in the LOCAL/MANUAL position, an annunciator is initiated in the control room.

A pushbutton in the control room and a local pushbutton are provided to allow manual start capability.

During periodic diesel generator tests, subsequent to diesel start and prior to synchronization to the preferred system, a switch in the control room allows parallel operation with the preferred system.

LOAD-SHEDDING CIRCUITS - Upon recognition of a loss of or degraded voltage on a 4.16-kV Class 1E bus, a logic signal is initiated to effect the following on each load group:

a. Shed selected loads

b. Send signal to start diesel

c. Trip 4.16-kV preferred power supply breakers

Two voltage sensing schemes are employed on each 4.16-kV Class lE bus to initiate the required logic signal. One scheme recognizes a loss of voltage, and the other recognizes a degraded voltage. Four potential transformers on each bus provide the necessary input voltages to the protective devices necessary to achieve the above protection.

In order to recognize a loss of voltage, four instantaneous undervoltage relays are used. The output contacts of these relays are directed to logic circuits that process the four undervoltage input circuits into the 2-out-of-4 logic circuit described above. This scheme is used on each bus.

The loss of voltage logic signal is set below the minimum bus voltage encountered during diesel generator sequential loading. A brief time delay is employed to prevent false trips arising from transient undervoltage (spike) conditions.

In order to recognize a degraded voltage, a diverse protection scheme is used.

The above four potential transformers each provide an analog output signal of 0-120 volts. This signal is directed to logic circuits and processors that convert the analog signals into a 2-out-of-4 logic signal, whenever the signal drops below a preset value. This scheme serves only to trip the incoming offsite power circuit breakers when that power source has been determined to be degraded. This design cannot adversely affect the sequential loading of the diesel generators.

The degraded voltage logic signal is set to ensure that the running and starting voltage requirements of the Class 1E equipment are maintained during postulated design basis accidents or anticipated operational occurrences. A time delay is provided that prevents damage to or spurious tripping of the permanently connected Class lE loads by limiting the amount of time they are exposed to a degraded voltage. The final voltage and time setpoints was determined based on an analysis of the auxiliary power distribution system, including the Class lE busses at all voltage levels. The use of an SIS contact

8.3-13 Rev. 35 WOLF CREEK

in series with the degraded voltage logic circuit output contact ensures that the Class lE busses are immediately (after an initial time delay) separated from the offsite power system whenever an accident occurs and the offsite power system is not able to accept the loads continuously. An alarm is also provided to alert the operator to a degraded voltage condition. It is delayed until any motor starting-induced voltage transient bus has had sufficient time to clear.

As each generator reaches rated voltage and frequency, the generator breaker connecting it to the corresponding 4.16-kV bus closes. With the SIS, connection of the diesel generator to the 4.16-kV bus is not made unless the preferred source of power is lost. The diesel generator is able to accept loads within 12 seconds after receipt of a starting signal, and all automatically sequenced loads are connected to the Class 1E bus within 35 seconds thereafter. Refer to Figure 8.3-2. Relays at the diesel generator detect generator rated voltage and frequency conditions and provide a permissive interlock for the closing of the respective generator circuit breaker. Upon loss of the preferred source of power without a LOCA, the load sequencer system initiates the starting of the diesel generators and sheds all loads, except the load centers and the centrifugal charging pumps.

Following diesel start and connection to the Class 1E bus, the loads are automatically sequenced onto the bus at programmed time intervals. A fast responding exciter and voltage regulator ensure voltage recovery of the diesel generator after each load step. Field flashing is utilized on the diesel generators for fast voltage buildup during the start sequence. Momentary voltage and frequency dips will not exceed a maximum of 25 percent below nominal rating (4.16 kV) for voltage and 5 percent for frequency.

The voltage levels at safety-related buses are optimized for the expected load conditions throughout the anticipated range of voltage of the offsite system by adjustment of transformer taps. This analysis is verified to be accurate by testing.

TESTING - Because the diesel generator is not of the type or size that has been previously used as a standby emergency power source in nuclear power plant service, the following tests are performed at the manufacturer's facility:

a. Load capability qualification tests were performed as follows:

1. The engine was brought to temperature equilibrium conditions and then run at rated load for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />.

Immediately following this period, the diesel was run for 2 additional hours at the rated short-time load.

This is in accordance with Paragraph 6.3.1(1) and (2) of IEEE 387-1977.

2. A load rejection from rated load was performed in one step. The engine speed did not exceed the normal speed plus 75 percent of the difference between normal speed and the overspeed setpoint. This is in accordance with Paragraph 6.3.1(3) of IEEE 387-1977.

8.3-14 Rev. 35 WOLF CREEK

3. A no load test was conducted for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> followed by loading to the rated load to demonstrate the capability to carry full load following operation at no load. This is in accordance with Paragraph 6.3.1(4) of IEEE 387-1977. Refer to Section 9.5.8.2.3 for a discussion of the manufacturer's operating recommendations for light and no load operations for extended periods. (Note that IEEE-387 contains no requirement for analyzing or inspecting the exhaust gas or the exhaust system during or following this test. The acceptance criterion is the acceptance of the rated load.)

b. At least 300 valid start and load tests are performed on one diesel generator. This includes all valid tests performed offsite. A valid start and load test is defined as an unloaded start from design conditions with

subsequent loading to at least 50 percent of the continuous rating within the required time interval and continued operation until temperature equilibrium is attained. This is in accordance with Paragraph 6.3.2 of IEEE 387-1977. At least 90 percent of these start tests were made from hot standby conditions and 10 percent from design hot equilibrium.

A failure-to-start rate in excess of one per hundred requires further testing as well as a review of the system design adequacy.

If failures to start are found to be caused by failures of a generic nature in a single component, it may be possible to correct the problem by use of a different kind of component or to correct the deficiency in the component.

If it is possible to independently test the component after its deficiencies have been corrected, it is not necessary to repeat the 300 starting tests of the complete diesel generator unit. If the component is successfully tested 300 times or more under acceptable simulated starting conditions, it is only necessary to continue and complete the original required 300 unit tests with the replacement component.

If starting failures are of a random nature or cannot be readily identified as being generic component failures, additional starting tests of the complete unit are performed after each starting problem has been corrected. The additional tests are of a sufficient number to verify the required starting reliability.

c. At least two full load and margin tests are performed on each diesel generator to demonstrate the start and load capability of these units with some margin in excess of the design requirements. The margin test includes step-loading the diesel generator with a test load at least 10 percent larger than the largest design single-step load.

This is in accordance with Paragraph 6.3.3 of IEEE 387-1977.

8.3-15 Rev. 35 WOLF CREEK

In addition to the above tests, after final assembly and preliminary startup testing each diesel generator was tested at the site prior to reactor fuel loading to verify actual electrical loading on the diesel generator and to demonstrate its ability to perform its intended function. The diesel generator is given each of the following tests, in accordance with Paragraph 6.4 of IEEE 387-1977 to certify the adequacy of the unit for the intended service.

a. Starting tests to demonstrate the ability to start automatically on simulation of loss of ac voltage and attain stabilized frequency and voltage within the rated limits and time.

b. Load acceptance tests to demonstrate the ability to accept the design loads in the design accident loading sequence and to maintain voltage and frequency within acceptable limits.

c. Rated load tests, with the diesel in parallel with the offsite system, to demonstrate the ability to carry the continuous rated load until temperature equilibrium is reached, followed by operation for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> at the short-time rated load of the diesel generator, followed by operation for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> at the continuous rated load, without exceeding the manufacturer's design limits.

d. Functional tests to demonstrate diesel generator capability at full load temperature conditions by rerunning tests a and b above immediately following c above. If these tests are not satisfactorily completed, it is not necessary to repeat the tests of item c above prior to rerunning this test. Instead, prior to rerunning these tests, the diesel generator may be operated at the continuous rated load for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or until operating temperature has stabilized.

e. Design load tests to demonstrate the ability to carry the design load for a time required to reach equilibrium temperature plus 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> without exceeding the manufacturer's design limits.

f. Load rejection tests to demonstrate the ability to reject the maximum rated load without exceeding speeds or voltages that cause tripping, mechanical damage, or harmful overstresses.

g. Electrical tests to demonstrate that the electrical properties of the generator, excitation system, voltage regulator, engine governor system, and the control and surveillance systems are acceptable for the intended application including:

8.3-16 Rev. 35 WOLF CREEK

1. Synchronize the diesel generator unit with offsite system while the unit is connected to the emergency load.

2. Transfer the emergency load to the offsite system.

3. Isolate the diesel generator unit from the offsite system.

4. Restore diesel unit to standby status.

h. A minimum of 35 consecutive valid tests are to be run with no failures to demonstrate the required reliability.

i. Subsystem tests to demonstrate the capability of the control, surveillance, and protection systems to function in accordance with their intended application.

j. Tests to demonstrate the capability of the diesel generator unit to respond to an emergency start signal within the required time.

After being placed in service, the standby power system is tested periodically in accordance with the plant Technical Specifications to demonstrate the continued ability of the unit to perform its intended function.

REPAIRS AND MAINTENANCE - Preventative and corrective maintenance records are maintained and reviewed on a continuing basis for parts failure data. In cases where repeated failures of a certain part or component are identified, then investigative maintenance is performed to try to identify the root cause of the problem.

Upon completion of repairs or maintenance and prior to an actual start, run, and load test, a final equipment check is made to ensure the diesel generators are ready for operation.

FUEL OIL STORAGE AND TRANSFER SYSTEMS - The diesel generator fuel oil system is described in Section 9.5.4.

DIESEL GENERATOR COOLING AND HEATING SYSTEMS - The diesel generator cooling water system is described in Section 9.5.5.

INSTRUMENTATION AND CONTROL SYSTEMS FOR STANDBY POWER SUPPLY - Equipment is provided in the control room for each diesel generator for the following operations:

a. Remote manual starting and stopping

8.3-17 Rev. 27 WOLF CREEK

b. Remote manual synchronization

c. Remote manual frequency adjustment Remote manual voltage adjustment for the NE001 EDG and remote manual voltage adjustment for the NE002 EDG while in automatic voltage control only.

d. Governor and voltage drop selection

e. Automatic or manual voltage regulator selection (The NE002 EDG can only be switched between automatic and manual voltage control locally.)

A master transfer switch is provided in the diesel room for automatic and local-manual control selection. The switch is normally in the automatic position, whereby the engineered safety features system senses an accident or loss of preferred power and starts the diesel. The master transfer switch is placed in the local-manual position to allow manual operation of the diesel locally when it is out for maintenance. Equipment is provided locally at each diesel generator for manual starting in case of a control room evacuation. The local emergency start functions to start the diesel generator, regardless of the position of the master transfer switch.

Equipment is provided at each local control panel for the following operation (when the master transfer switch is in the local position):

a. Manual starting

b. Manual stopping

c. Frequency and voltage regulation

d. Automatic or manual regulation selection

e. Exciter field removal and reset

The local control operation is annunciated in the control room. The dc power source for the diesel generator instrumentation and control system is of the same load group as the respective diesel generator.

Each diesel generator is equipped with the following alarms at the local control panel:

a. Lube oil pressure low

b. Lube oil temperature high

c. Lube oil temperature low

8.3-18 Rev. 27 WOLF CREEK

d. Lube oil level high in sump

e. Lube oil level low in sump

f. Lube oil filter differential pressure high

g. Lube oil strainer differential pressure high

h. Fuel oil filter differential pressure high

i. Fuel oil strainer differential pressure high

j. Fuel oil pressure low

k. Jacket coolant pressure low

1. Jacket coolant temperature high

m. Jacket coolant temperature low

n. Jacket coolant level low in expansion tank

o. Diesel generator undervoltage

p. Start failure

q. Engine trouble shutdown

r. Generator underfrequency

s. Barring device engaged

t. DC control power failure

u. Starting air pressure low train 1

v. Starting air pressure low train 2

w. Crankcase pressure high

x. Engine overspeed trip

y. Any switch not in auto position

z. Generator protective relay trip

aa. Diesel main bearing temperature high

8.3-19 Rev. 27 WOLF CREEK

bb. Combustion air pressure low

cc. Intercooler water pressure low

dd. Intercooler water temperature high

ee. Intercooler water temperature low

ff. Rocker arm lube oil filter differential pressure high

gg. Rocker arm lube oil level high

hh. Rocker arm lube oil pressure low

ii. Diesel generator underexcitation

jj. Diesel generator field grounded

kk. Exciter power potential transformer fuse failure

The following conditions are separately alarmed in the control room:

a. Diesel out of service

b. Diesel local alarm

c. Diesel generator undervoltage or underfrequency

d. Diesel overvoltage

e. Diesel negative phase sequence

Electrical instruments are provided in the control room and at the diesel generator for surveillance of generator voltage, current, frequency, power, and reactive volt amperes. The breaker status of each 4.16-kV breaker of the engineered safety features system is displayed by red and green indicating lamps in the control room. Local indication is provided at the switchgear.

A window is provided on the engineered safety features status panel in order to determine the availability of the diesel generator. The window reads "Emergency Diesel Generator" and operates as described in Section 7.5.2.2.

This window is activated by all conditions which render the diesel inoperable.

These conditions are listed as follows:

a. Loss of dc control power

b. Generator relay trip

8.3-20 Rev. 27 WOLF CREEK

c. Barring device engaged

d. Starting air pressure low

e. Engine shutdown

f. Start failure

g. Diesel generator control switch not in auto position

h. Diesel generator auxiliaries control switch in off position.

Controls and monitoring instruments for the WCGS emergency diesel generators are installed in free standing, floor-mounted control panels, separate from the engine skid. Only those sensors and other electrical controls (solenoid valves and governor actuator) which send or receive signals to and from the control panels are mounted on the diesel generator unit.

Although the WCGS panels are mounted on the same floor as the engine skid they do not employ vibration mounts because the floor is of sufficient mass to dampen the engine vibrations.

8.3.1.1.4 Control Rod Drive Power Supply

Electric power to control rod drive mechanisms is supplied by two full-capacity, motor-generator sets. Each motor-generator set is connected to a separate non-Class IE 480-V load center. Each generator is of the synchronous type and is driven by a 200-hp induction motor. The ac power is distributed to the rod control power cabinets through two series-connected reactor trip breakers.

8.3.1.1.5 Vital Instrument AC Power Supply

Four independent Class IE 120-V vital instrument ac power supplies are provided to supply the four channels of the protection systems and reactor control systems. Each vital instrument ac power supply consists of one normal inverter equipped with an integral bypass constant voltage transformer and one distribution bus. Normally, the inverter is operating to supply the vital ac bus. Each inverter is supplied by a separate Class IE battery system, as described in Section 8.3.2. If an inverter is inoperable or is to be removed from service, the vital ac bus can be supplied from the integral constant voltage transformer until the trains swing (backup) inverter is configured to operate in its place. The swing unit can supply either inverter in that train.

A selector switch located on the inverter is positioned to select the appropriate inverter to be replaced (a keylock is used to maintain the position). The swing unit will be fed from the dc bus associated with the affected inverters power supply. A 125 VDC power source is selected on the DC manual transfer switch via key operated switches.

Refer to Figure 8.3-6, sheet 1, for the single-line arrangement of the vital instrument ac power supply.

8.3-21 Rev. 29 WOLF CREEK

8.3.1.1.6 Non-vital Instrument AC Power Supply

The non-vital 120/208-V instrument ac power supply is designed to furnish reliable power to all nonsafety-related plant instruments. In addition, it is utilized as the source of power for the public address system.

The non-vital instrument ac power supply system is divided into four panelboards. Two of the panel boards are normally supplied by three phase transformers, each connected to a Class 1E motor control center. In the event of the loss of normal auxiliary power, the transformers are automatically energized by the emergency diesel generators. In the event that the transformers fail, the instrument buses will be automatically transferred to an alternate regulated source from non-vital motor control centers. The other two panelboards are fed from uninterruptible power supplies. These panelboards supply instrument loads which are required for stable plant operation and cannot withstand an interruption in power.

8.3.1.1.7 Electric Equipment Layout

The following are the general features of the electric equipment layout:

a. Class IE switchgear, load centers, and motor control centers of redundant load groups are located in separate rooms within seismic Category I buildings.

b. Four Class IE battery supplies are located in the control building. Each battery is located in a separate room.

Battery ventilation considerations are addressed in Section 9.4.1.

c. The battery charger, inverter, and dc busses associated with each of the four subsystems are in separate rooms outside the battery rooms.

d. Two cable spreading rooms are provided, one above and one below the control room. This enhances redundant cable separation.

e. Redundant diesel generators and associated supporting equipment are located in separate rooms in the seismic Category I diesel generator building.

Electrical equipment layout drawings showing the location of electrical equipment and equipment and cable raceways are listed in Section 1.7.

8.3-22 Rev. 27 WOLF CREEK

8.3.1.1.8 Design Criteria for Class IE Equipment

Design criteria are discussed below for the Class IE equipment:

MOTOR SIZE - For all motors rated above 480 Volts, some have the nameplate rated horsepower less than the horsepower required by the driven load under runout condition, but still within the service factor of the motor.

In the case of containment spray pumps (500 hp nameplate rating and 505 brake horsepower), residual heat removal pumps (500 hp nameplate rating and 510 brake horsepower), centrifugal charging pumps (600 hp nameplate rating and 680 brake horsepower), and safety injection pumps (450 hp nameplate rating and 460 brake horsepower) which are under the scope of the NSSS supplier, the brake horsepower exceeds the nameplate rating of the motor, but is within the capability of the motors which have a service factor of 1.15.

MINIMUM MOTOR ACCELERATING VOLTAGE - All Class IE motors fed from the 4.16-kV busses are specified with accelerating capability at 75 percent of the motor nameplate rating (4,000 volts). IE motors rated for use on lower voltage busses, which are required to start concurrently with large 4-kV motors, are specified with accelerating capability at 65 percent of the motor nameplate rating.

To prevent valve damage from the oversizing of motors, motor-operated valve actuators are specified with accelerating capability at 80 percent of the nameplating rating.

The electrical system is designed so that the total voltage drop on the Class IE motor circuits is less than that required to accelerate those motors.

MOTOR STARTING TORQUE - The motor starting torque is capable of starting and accelerating the connected load to normal speed within sufficient time to perform its safety function for all expected operating conditions, including the design minimum bus voltage stated in Section 8.3.1.1.3.

MINIMUM MOTOR TORQUE MARGIN OVER PUMP TORQUE THROUGH ACCELERATING PERIOD - The minimum torque margin (accelerating torque) is such that the pump-motor assembly reaches nominal speed within sufficient time to perform its safety function at design minimum terminal voltage.

MOTOR INSULATION - Insulation systems are selected on the basis of the particular ambient conditions to which insulation is exposed. For Class IE motors located within the containment, the insulation system is selected to withstand the postulated accident environment.

8.3-23 Rev. 27 WOLF CREEK

TEMPERATURE MONITORING DEVICES PROVIDED IN LARGE HORSEPOWER MOTORS - Each motor in excess of 1,500 hp is provided with six resistance temperature detectors (RTD) embedded in the motor slots, two per phase. In normal operation, the RTD at the hottest location (selected by test) monitors the motor temperature and provides a computer alarm in the control room on high temperature. Each 4.16-kV motor bearing (except residual heat removal) is provided with one thermocouple which will provide an alarm on bearing high temperature.

INTERRUPTING CAPACITIES - The interrupting capacities of the protective equipment are determined as follows:

a. Switchgear

Switchgear interrupting capacities are greater than the maximum short circuit current available at the point of application. The magnitude of the short circuit currents in the medium voltage systems is determined in accordance with ANSI C37.010-1972. The offsite power system, a single operating diesel generator, and running motor contributions are considered in determining the fault level. All motors connected to the bus are considered to be running when the short circuit is postulated.

High voltage power circuit breaker interrupting capacity ratings are selected in accordance with ANSI C37.06-1971.

b. Load Centers, Motor Control Centers, and Distribution Panels

Load centers, motor control centers, and distribution panel circuit breakers have a symmetrical rated interrupting current as great as the determined total available symmetrical current at the point of application. Symmetrical current is determined in accordance with the procedures of ANSI C37-1973 for low-voltage circuit breakers other than molded-case breakers and of NEMA Standards Publication AB l for molded case circuit breakers.

ELECTRIC CIRCUIT PROTECTION - Refer to Section 8.3.1.1.2 for criteria regarding the electric circuit protection.

GROUNDING REQUIREMENTS - Equipment and system grounding were designed using IEEE 80, 1971 "Guide for Safety in AC Substation Grounding," and IEEE 142, 1972, "Recommended Practice for Grounding of Industrial and Commercial Power Systems" as a guide.

8.3-24 Rev. 27 WOLF CREEK

8.3.1.1.9 Cable Derating and Cable Tray Fill

The ampacity and group derating factors for cables in conduit duct bank and maintained space trays are in accordance with the manufacturers recommendations and IPCEA P-46-426 or the NEC. For randomly filled trays, ICEA P-54-440 with IPCEA P-46-426, as appropriate, is used in conjunction with the manufacturers recommendation for cable ampacity and group derating factors.

The cable ampacities are based on a maximum conductor temperature of 90 C, 100-percent load factor, and all cables fully loaded.

Cable tray fill, for the various randomly filled tray configurations, is generally limited by the percentage criteria as follows: 45% for raceway containing control and low voltage power cables inside the cable spreading rooms and for raceway containing instrumentation cables; 30% for raceway containing control and low voltage power cables outside the cable spreading rooms. Where these conditions cannot be maintained, a design engineer reviews each case for the adequacy of the design for both physical fill and derating.

Conduit fill is in compliance with the provisions of the NEC. Where these provisions cannot be maintained, a design engineer reviews each case and will allow a higher fill percentage based on actual cable sizes, conduit sizes, length of conduit, and number of bends.

8.3.1.2 Analysis

8.3.1.2.1 Compliance with General Design Criteria 17 and 18 and Regulatory Guides

For discussion of regulatory guides in regard to Class IE ac systems, refer to Section 8.1.4.3.

Compliance with General Design Criteria 17 and 18 is discussed in Section 3.1.

A failure modes and effects analysis is provided in accordance with IEEE 352-1972. Refer to Table 8.3-4.

8.3.1.2.2 Safety-Related Equipment Exposed to Hostile Environment

The detailed information on all Class IE equipment that must operate in a hostile environment during and/or subsequent to an accident is furnished in Section 3.11(B) and 3.11(N).

8.3.1.3 Physical Identification of Safety-Related Equipment

Each circuit (scheme) and raceway is given a unique alphanumeric identification. This identification provides a means of distinguishing a circuit or raceway association with a particular channel or load group, and is assigned on the basis of the following criteria:

8.3-25 Rev. 27 WOLF CREEK

SEPARATION GROUP 1 - A safety-related instrumentation, control, or power scheme/raceway associated with safety-related load group 1 or protection system channel 1.

SEPARATION GROUP 2 - A safety-related instrumentation, control, or power scheme/raceway associated with protection system channel 2.

SEPARATION GROUP 3 - A safety-related instrumentation, power, or control scheme/raceway associated with protection system channel 3.

SEPARATION GROUP 4 - A safety-related instrumentation, control, or power scheme/raceway associated with safety-related load group 2 or protection system channel 4.

Nonsafety-related cables and raceways associated with normal plant (non-Class IE) equipment are uniquely identified and separately routed from safety-related cables and raceways, as described in Section 8.1.4.3.

The unique identification afforded all nonsafety-related cables is generally black; however, other colors (other than Red, White, Blue and Yellow) may be used for non-safety related cable in isolated cases.

Nameplates with colored backgrounds are provided for all IEEE 308 Class lE equipment (such as transformers, motors, motor control centers, switchgear, panels, and switchboards) under A/E scope. Each separation group has its distinguishing color. The applicable channel or load group designation is marked on each nameplate. For the identification of instrumentation and control equipment, refer to Section 7.1.2.3.

Raceways are marked in a distinct, permanent manner at intervals not to exceed 15 feet and at points of entry to, and exit from, enclosed areas.

The 600 volt fire-resistive control and power cables are routed independent of raceways. The fire-resisitive cables are distinctly and permanently marked in the same manner as described above for raceways.

Color identification is provided for each separation group of field-wired, safety-related cables.

Within control panels where more than one separation group is present, wiring is identified by separation group designation or, if enclosed by conduit, the conduit is identified by separation group designation.

8.3-26 Rev. 27 WOLF CREEK

Within a cabinet or panel which is associated and identified with a single separation group, the internal wiring is exclusively associated with the same separation group and, therefore, requires no further identification.

In cases where the majority of the wiring within a cabinet or panel is primarily one separation group, standard color wire and/or sleeves for the majority separation group is used. The remaining wiring is identified, using the appropriate color, as defined in applicable specifications or drawings.

When colored sleeves are used in lieu of colored wiring, the sleeves are provided at both ends of the wire and at strategic intervals along its length.

Design drawings provide distinct identification of Class IE equipment.

Operating and maintenance documents pertaining to Class IE equipment are distinctly identified.

8.3.1.4 Independence of Redundant Systems

8.3.1.4.1 Separation Criteria

This section establishes the criteria and the bases for preserving the independence of redundant Class IE power systems.

8.3.1.4.1.1 Raceway and Cable Routing

a. Wherever possible, cable trays are arranged from top to bottom, with trays containing the highest voltage cables at the top and trays containing the lowest voltage cables at the bottom. A raceway designated for a single voltage category of cables contains only cables of the same voltage category. Voltage categories are:

1. 15-kV power (non-Class IE)

2. 5-kV power

3. Large 600-V power (cables from load centers)

4. 600-V power (cables from motor control centers, control and digital signal cables)

5. Instrumentation cables

b. Cables associated with each safety-related separation group, as defined in Section 8.3.1.3, are run in separate conduits, cable trays, ducts, and penetrations.

8.3-27 Rev. 27 WOLF CREEK

The 600 volt fire-resistive control and power cables are routed independent of raceways. The fire-resistive cables are routed in the same manner as conduits.

c. The arrangement of electrical equipment and cabling minimizes the possibility of a fire in one separation group from propagating to another separation group.

In the absence of confirming analyses to support less stringent requirements, the following rules apply to those areas in which the only source of fire is electrical. Areas in which the only source of fire is electrical are divided into two groups--cable spreading rooms and general plant areas. (See Section 8.3.1.4.1.4 for exemptions) Table 8.3-5 contains analyses of alternate minimum separation distances as allowed by RG 1.75.

GENERAL - Routing of instrumentation, control, or power cables through rooms or spaces where there is a potential for accumulation of large quantities of combustible fluids is avoided. Where such routing is unavoidable, only cables of one separation group are allowed. In addition, the cables are enclosed in conduit. Openings in solid floors for vertical runs of cables are sealed with fire resistant material.

GENERAL PLANT AREAS - In plant areas from which equipment with potential hazards such as missiles, external fires, and pipe whip are excluded, the separation criteria are as follows:

a. Cable trays of different separation groups have a minimum horizontal separation of 3 feet if no physical barrier exists between the trays. In the limited number of areas where horizontal separation of 3 feet is unattainable, a fire barrier is installed extending at least 1 foot above the top of the tray (or to the ceiling) and 1 foot below the bottom of the tray (or to the floor).

b. For cable trays of different separation groups, there is a minimum vertical separation of 5 feet between open-top trays stacked vertically. In the limited number of areas where trays of different separation groups are stacked with less than 5 feet of vertical separation, a fire barrier is placed between the two separation groups. The barrier extends 1 foot to each side of the tray system (or to the wall).

8.3-28 Rev. 27 WOLF CREEK

c. In the case where a tray of one separation group crosses over a tray of a different separation group and the vertical separation is less than 5 feet, a fire barrier is installed extending 1 foot from each side of each tray and 5 feet along each tray from the crossover.

d. Where it is necessary that cables of different separation groups approach the same or adjacent control panels with less than 3-foot horizontal or 5-foot vertical spacing, isolation is maintained by installing both separation groups in steel conduit or enclosed wireway or by installing fire barriers between the separation groups. In the case of horizontal separation, the barrier extends 1 foot below the bottom of the tray (or to the floor) to 1 foot above the top of the tray (or to the ceiling). In the case of vertical spacing, the barrier extends 1 foot on each side of the tray system (or to the wall).

e. Isolation between separation groups is considered to be adequate where physical separation is less than that indicated in Items a, b, and c above, provided the circuits of different separation groups are run in enclosed raceways that qualify as barriers or other barriers are installed between the different separation groups. The minimum distance between these enclosed raceways and between barriers and raceways is 1 inch.

The barriers are installed as described in a through d above. Additionally, 600 volt fire-resistive control and power cables are capable of withstanding fire and can be routed with 1.5 inch isolation distance from other separation groups and non-safety raceways and fire resistive cables.

In cases of open trays containing safety-related cables and totally enclosed conduits containing non-safety-related cables, the safety design basis is to protect the safety-related cables from failure of the non-safety-related circuits, and not vice-versa. In consideration of this limit, enclosing the non-safety circuits in raceway and maintaining at least one inch separation provides an acceptable level of protection.

The conduit can contain only a limited quantity of combustible material (cable insulation and jacket).

Furthermore, there is insufficient oxygen inside the conduit to support combustion of more than a fraction of the available material.

Based on these considerations, it is established that one-inch separation between a conduit containing non-safety-related circuits and an open tray containing safety-related circuits is sufficient to assure that any failure within the non-safety related circuits will not propagate into and compromise the integrity of the safety related circuits.

8.3-29 Rev. 27 WOLF CREEK

CABLE SPREADING AREAS - The cable spreading area does not contain high energy equipment such as switchgear, transformers, rotating equipment, or potential sources of missiles or pipe whip and is not used for storing flammable materials. (Circuits in the cable spreading area are limited to control and instrument functions and also those power supply circuits and facilities serving the control room and instrument systems.) Power supply feeders 480 V and above are installed in enclosed raceways. Separation criteria are as follows:

a. he minimum separation distance between redundant Class IE cable trays is 1 foot between trays separated horizontally and 3 feet between trays separated vertically.

b. Where termination arrangements preclude maintaining the minimum separation distance, the redundant circuits are run in enclosed raceways or other barriers are provided between redundant circuits. The minimum distance between these redundant enclosed raceways and between barriers and raceways is 1 inch. The fire barriers are installed as described above in "General Plant Areas."

c. Arrangement and/or protective barriers preclude locally generated forces or missiles from destroying redundant systems. In the absence of confirming analyses to support less stringent requirements, the following rules have been used:

1. The routing of Class IE circuits and the location of Class IE electrical equipment is reviewed for exposure to hazards such as high pressure piping, missiles, flammable material, and flooding.

A degree of separation or physical protection commensurate with the damage potential of the hazard is provided so that the independence of redundant Class IE subsystems is maintained. The separation of redundant Class IE circuits and equipment makes use of features inherent in the plant design, such as using different rooms or opposite sides of rooms or areas.

2. The separation of Class IE circuits and equipment is such that the required independence is not compromised by the failure of mechanical systems served by the Class IE systems. For example, Class IE circuits are routed or protected so that failure

8.3-30 Rev. 27 WOLF CREEK

of related mechanical equipment of one redundant subsystem cannot jeopardize Class IE circuits or equipment essential to the operation of the other redundant subsystem.

d. Nonsafety-related cables are not routed through safety-related raceways. However, if a nonsafety-related cable is fed from a safety-related power service it may be routed through safety-related raceways of the same separation group as that of the power service. For discussion of nonsafety-related circuits fed from safety-related sources through isolation devices, refer to Section 8.1.4.3 - Regulatory Guide 1.75.

e. Load group 1 and protection channels 1 and 3 and load group 2 and protection channels 2 and 4 cables are routed through separate cable chases and cable spreading rooms. The former circuits enter the lower cable spreading room, while the latter circuits enter the upper cable spreading room.

f. The independence of redundant NSSS safety-related systems is discussed below:

Safety-related reactor trip, engineered safety features actuation, and instrumentation and control power supply systems are designed to meet the independence and separation requirements of Criterion 22 of the 1971 General Design Criteria and Paragraph 4.6 of IEEE 279, 1971.

Channel independence is carried throughout the system, extending from the sensor through to the devices actuating the protective function. Physical separation of wiring for each redundant channel set is used.

Redundant analog equipment is separated by locating modules in different protection rack sets.

Each redundant channel set is energized from a separate ac power feed.

There are four separate process protection analog rack sets. Separation of redundant analog channels begins at the process sensors and is maintained in the analog protection racks to the redundant trains in the logic racks. Redundant analog channels are separated by locating modules in different rack sets. Within these racks, field run nonsafety-related shielded cables having a signal level of 100 V or less are routed in common

8.3-31 Rev. 27 WOLF CREEK

wireways with safety-related shielded cables with no physical separation. Internal cabinet safety and nonsafety-related cables are similarly routed.

Justification for this method of routing is contained in Reference 1. The field run non safety-related shielded cables to these cabinets are routed in accordance with Reference 1.

Two reactor trip breakers are actuated by two separate logic matrices which interrupt power to the control rod drive mechanisms. The breaker main contacts are connected in series with the power supply so that opening either breaker interrupts power to all control rod drive mechanisms, permitting the rods to free fall into the core.

Protection system channel inputs are separated from the solid state protection system train outputs as follows:

1. Shielded cables defined in the NSSS vendor protection system documentation (process sensing circuits, solid state protection system logic cabinet inputs from control board switches, and pushbuttons) are separated from 120-V ac instrumentation and vital instrument bus voltage cables and 120-V ac and 125-V dc control voltage cables.

2. Prefabricated cables which connect process control system 24-V dc signals to the protection system input are separated from the 120-V ac instrumentation and vital instrument bus voltage cables, 120-V ac and 125-V dc control voltage cables.

3. The 48-V dc reactor trip logic Train A and Train B output circuits are installed in separate conduits.

4. Train A protection system outputs (120-V ac and 125-V dc Class IE control voltage unshielded cables only) are contained in the same tray as protection system channel I unshielded cables.

5. Train B protection system outputs (120-V ac and 125-V dc Class IE control voltage unshielded cables only) are contained in the same tray as protection system channel IV unshielded cables.

These requirements are complied with in the field circuiting.

8.3-32 Rev. 27 WOLF CREEK

8.3.1.4.1.2 Control Boards and Other Panels

Within the control boards and other panels associated with protection systems, circuits and instruments of different separation groups (see Section 8.3.1.3) are independent and physically separated horizontally and vertically by a distance of 6 inches. Where physical separation is impracticable, conduit and/or fire barriers are utilized to maintain independence.

Single control devices to which different separation groups are connected are avoided, wherever practicable. Where single devices are unavoidable, electrical isolation is provided. Devices that provide electrical isolation include relays, isolation amplifiers, and solid-state optical couplers. A small number of control switches (e.g., reactor trip switches, lockout relays) contain different separation group wiring to their control contacts. For these switches, electrical independence is maintained, and physical barriers are provided between each separation group. Within control boards and other panels, nonsafety-related wiring is not harnessed together with safety-related wiring.

However, if an associated nonsafety-related cable is supplied from a safety-related bus it is treated as a safety-related cable and is harnessed with safety-related cables of the same group. Harnesses of different separation groups are separated physically by a distance of 6 inches. Where physical separation is impracticable, fire barriers, conduit, or wire duct is used to maintain independence.

8.3.1.4.1.3 Reactor Containment Penetration Areas

Two separate penetration areas are provided for cables that must pass through the containment wall. The south penetration area contains cable for Separation Groups 2 and 4, each group having separate penetration assemblies. The north penetration area contains cable for Separation Groups l and 3, each group again having separate penetration assemblies. Raceway separation criteria, as described in this section, apply in routing cable through the penetration areas.

8.3.1.4.1.4 Exemptions from Physical Separation Requirements

A limited number of specific raceway and panel configurations exist for which the previously given separation requirements are not imposed due to practical limitations. These exemptions are identified in E-1R8902. The evaluation criteria for acceptance of these exemptions is as follows:

A) Class 1E raceway is assumed lost and the effects are determined.

Exception is allowed provided the loss does not affect safe shutdown; OR B) Non-Class 1E circuits are energized only during maintenance when Class 1E circuits are out of service. Non-Class 1E circuits are isolated from the Class 1E circuits by administrative controls; OR C) Deviations are evaluated based upon a review of Electrical Raceway Separation Verification Test Reports for Limerick Units 1 & 2 and the WCNOC overcurrent protection system.

8.3-33 Rev. 27 WOLF CREEK

Review/Analysis -- Wyle Laboratories conducted tests for Limerick Units 1 and 2 (Test Report 46960-1 and 46960-3) to justify separation which is less than the standard distance. They used similar cables of the same size (and larger) as the WCNOC cables in question. Their tests are based on the following failure mode assumptions:

1. The cable or equipment in the circuit develops a fault that is not cleared due to the failure of the primary overcurrent protective device.

2. The fault current level (660 amps) is just below the long-term trip setpoint of the next higher level overcurrent device.

3. The impedance of the fault adjusts itself automatically to maintain the fault current magnitude at a constant level as the resistance of the wire increases due to heating.

4. There are no other loads on the same circuit which would cause the next high level overcurrent device to trip.

5. The overload wire can maintain the continuous overheated condition without an operator being aware of the condition.

Philadelphia Electric Company's Design Verification Test Report #48503 showed that heating effects due to wiring faults which caused sustained overcurrent conditions with the above assumptions had the greatest impact on adjacent wires. The results of their tests revealed the following:

1. Cable sized #4/0 AWG and smaller when energized with 660 amps and routed in an open cable tray, did not ignite.

Cables were tested in both horizontal and vertical tray configurations and did not ignite in any case.

Configuration with a 1" vertical separation between cable trays and zero separation between cable tray and enclosed raceway were tested successfully without damage.

2. No separation was required between an enclosed raceway and another enclosed raceway or cable tray when the enclosed raceway contains cables which are #4/0 AWG and smaller.

3. One inch separation between an enclosed raceway and another enclosed raceway or cable tray is required when the enclosed raceway contains cables larger than #4/0 AWG.

8.3-34 Rev. 27 WOLF CREEK

The Electrical Raceway Separation Verification Test reports for Limerick Units 1 & 2 are applicable to WCNOC for the following reasons:

1. WCNOC uses similar cables made by the same manufactures as the cables used in the test. Cables used by WCNOC made by different manufactures than those used in the test use the same type of insulation material (cross-linked polyethylene or cross-linked ethylene propylene rubber) and jacket material (chlorosulfonated polyethylene or neoprene). In addition, all class 1E cables, with the exception of stanless steel fire-resistive cables, are qualified to the same standards such as IEEE-323 and IEEE-383 and are manufactured to the same IPCEA standards. Stanless steel fire-resistive cables have been type tested for exceeding the standards of IEEE-323 and IEEE-383.

2. The WCNOC electrical raceway configurations are similar to the electrical raceway configurations used in the test.

3. The fault current used in the test is very conservative compared to the maximum credible fault current that could develop for the configuration of circuits described above in this section.

Physical separation between transient electrical cables and Class 1E raceway/cables/equipment may on a temporary basis fail to meet the 3 foot - 5 foot requirement per Reg. Guide 1.75 Rev. 1 and IEEE 384-1974.

Transient electrical cables are defined as follows: transient electrical cables are those non-safety related cables used on a temporary basis in support of field work activities or testing/monitoring which will remain in place for a short duration of time and which do not require a permanent plant modification or a temporary modification for their use. Transient cables typically include but are not limited to: extension cords, temporary power leads, temporary lighting cords, hand power tool cords, welding leads, communication cables, computer cables, video cables, test leads, (DMMs, recorders, data acquisition equipment, etc.) and instrumentation leads.

Transient cable separation requirements are delineated in plant administrative procedures. All deviations from the administrative procedures will require an engineering evaluation.

Physical separation between the non-safety related Local Area Network (LAN) cable and Class 1E raceway may on a limited basis, fail to meet the 3 foot horizontal and 5 foot vertical requirement of R.G. 1.75 and IEEE 384-1974.

These cables are installed in free air. Physical separation of 1 inch horizontal and 3 inches vertical is maintained between the free air cables and Class 1E raceway.

LAN cables inside the power block consist of fiber optic cables and 4 pair - 24 AWGUTP, Category 5/5e cables, both of which meet the flame spread requirements of WCNOC design document, E-11013, section 3.0. The fiber optic cable carries no electrical energy, cannot conduct electrical current and will not propagate a flame. Consequently these cables pose no risk to Class 1E electrical circuits. The 24 AWGUTP Category 5 copper conductor cables carry digital computer data only and consequently do not pose a risk with respect to degrading the functions of Class 1E electrical circuits.

8.3-35 Rev. 27 WOLF CREEK

8.3.1.4.2 Administrative Responsibilities and Controls for Assuring Separation Criteria During Design and Installation

The scheme and raceway channel identification (refer to Section 8.3.1.3) facilitated and ensured the maintenance of separation in the routing of cables and the connection of control boards and panels. At the time of the cable routing assignment in the design office, the routing engineer checked to ensure that the separation group designation on the scheme to be routed was compatible with the raceways in the intended route. Extensive use of computer program

checks helped ensure separation. Each circuit and raceway was identified in the computer program, and the identification included the applicable separation group. The program used in routing specifically checked to ensure that cables of a particular separation group were routed through the appropriate raceways.

The routing was also confirmed by quality control personnel, during installation, to be consistent with the design document. Color identification of equipment and cabling (refer to Section 8.3.1.3) assisted field personnel in this effort.

8.3.2 DC POWER SYSTEMS

8.3.2.1 Description

Site dc power is supplied at 125 volts from two independent sources within the power block, Buses PK01 and PK02 as shown in Figure 8.3-6 sheet 2, neither of which is a Class 1E power bus. One fused disconnect switch at each source delivers power to the site through underground feeders. Each site feeder supplies a 125-V dc distribution panel at the shop building. Each distribution panel supplies miscellaneous dc loads at the shop building, and a 125-V dc distribution panel at the non-Class 1E circulating water screenhouse. These distribution panels supply miscellaneous dc loads at the screenhouse.

Interconnection of the independent power block buses is prevented at all levels of distribution.

The makeup water screenhouse is provided with a 125-V dc wet cell storage battery. The battery is rated at 160 ampere-hours and is trickle-charged from a static battery charger. The battery supplies a 125-V dc distribution panel, which in turn supplies miscellaneous dc loads at the screenhouse.

The powerblock dc power system for WCGS consists of four independent Class 1E 125-V dc subsystems, four non-Class 1E 125-V dc subsystems, and one non-Class 1E 250-V dc system. The dc power system is designed to provide reliable and continuous power for controls, instrumentation, inverters, and dc emergency auxiliaries.

8.3-36 Rev. 27 WOLF CREEK

The Class 1E dc system provides dc electric power to the Class 1E dc loads and for control and switching of the Class 1E systems. Physical separation, electrical isolation, and redundancy are provided to comply with the requirements of IEEE 308. The four class 1E dc power subsystems are shown in Figure 8.3-6, sheet 1. Subsystems 1 and 4 provide control power for ac Load Groups 1 and 2, respectively. These subsystems also provide vital instrumentation and control power for channels 1 and 4, respectively, of the reactor protection and engineered safety features systems. DC subsystems 2 and 3 provide vital instrumentation and control power for channels 2 and 3, respectively, of the reactor protection and engineered safety features systems.

Each Class 1E dc power subsystem consists of one 125-V battery, one battery charger, one inverter, and distribution switchboards. The battery chargers for dc subsystems 1 and 3 are supplied 480-V ac power from different Class 1E busses of Load Group 1. Similarly, the battery chargers for dc subsystems 2 and 4 are supplied 480-V ac power from different Class 1E busses of Load Group 2.

The inverters provide four independent 120-V ac vital instrumentation and control power supplies for the channels of reactor protection and engineered safety features systems.

Two spare battery chargers and two swing (spare) inverters are provided for the power block. The spare chargers are located in the ESF Switchgear rooms and are connected in place of failed chargers via non-automatic transfer switches.

The Train A swing inverter is located in the Train A ESF room and the Train B swing inverter is located in the Train B ESF room. These are aligned to replace the selected inverter via non-automatic transfer switches. In the event of a charger or inverter failure, the spare charger/swing inverter is connected to the affected system permitting the malfunctioning equipment to be repaired without long term disruption of the system.

The batteries, racks, chargers, inverters, and auxiliary distribution equipment (switchboards) are designated seismic Category I, and are designed to maintain their functional capability during and after an SSE. The electrical equipment qualification is discussed in Section 3.10(B) and 3.10(N).

The non-Class IE loads for the power block are supplied by separate dc systems.

A 125-V dc system PK03 and PK04 is provided to supply nonvital control and instrumentation. Two 200-A dc feeders are provided to supply the site system dc control loads. In addition, a 250-V dc system is provided to supply nonvital dc motors, such as emergency lube oil pumps and emergency seal oil pumps. The 125-V dc system, in conjunction with inverters, also serves as the back-up source of power for the computers and fire detection system.

The 250-V dc system includes one battery and two battery chargers, one charger serving as a backup for the other. The non-Class IE 125-V dc system includes four batteries, each of which has one battery charger.

One battery charger of the 250-V dc system and all battery chargers of the non-Class IE 125-V dc system are supplied 480-V ac power from the standby power system.

The 125-V and 250-V dc non-Class 1E and 125-v dc Class 1E systems are subjected to a maximum voltage of 140V (for 125V) and 280V (for 250V) dc. This occurs during the equalization of the batteries. All equipment associated with and connected to the dc systems is designed to withstand the maximum voltage during equalization.

8.3-37 Rev. 29 WOLF CREEK

8.3.2.1.1 Safety-Related DC Loads Table 8.3-1 identifies loads related to each Class IE 125-V dc subsystem.

8.3.2.1.2 Class IE Station Batteries and Battery Chargers

BATTERY CAPACITY - The WCGS Class IE batteries are sized in excess of that required to supply the loads in Tables 8.3-2 and 8.3-3 for 240 minutes. The required capacity is initially evaluated from design loads, with margin, imposed on each battery throughout the 240-minute duty cycle.

From this capacity, a margin of 25 percent is applied to ensure that the rated battery capacity is at least 125 percent of that required. This margin is consistent with the 80 percent capacity battery replacement criteria given in IEEE 450-1995.

As a result of the above sizing, the WCGS batteries are selected from those larger sizes that are commercially available. The resulting final battery selection is in excess of 150 percent of the system requirements.

BATTERY CHARGER CAPACITY - The capacity of each Class IE battery charger is based on the largest combined demand of all the steady state loads and the charging capacity to restore the battery from the design minimum charge state (one duty cycle) to the fully charged state within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (irrespective of the status of the plant during which these demands occur).

INSPECTION, MAINTENANCE, AND TESTING - Testing of the dc power system is performed during plant operation, in accordance with Regulatory Guide 1.118 and IEEE Standard 450-1995.

Preoperational tests and inspections were performed in accordance with the procedures described in Chapter 14.0.

8.3.2.1.3 Separation and Ventilation

The Class IE batteries, chargers, and dc switchgear of each separation group are located in separate rooms of the seismic Category I control building.

Chargers and dc switchgear are in separate rooms from the batteries. The battery rooms are ventilated by a system which is designed to preclude the possibility of hydrogen accumulation. Section 9.4.1.2 contains a description of the battery room ventilation system. Battery room temperature is controlled or the batteries appropriately derated so that the battery capacity is maintained at a level that satisfies the requirements of Section 8.3.2.1.2.

8.3.2.2 Analysis

8.3.2.2.1 Compliance with General Design Criteria, Regulatory Guides, and Industry Standards

The following paragraphs analyze compliance of the Class IE dc power system with Regulatory Guides 1.6, 1.32, 1.41, 1.81, 1.93, 1.128, and 1.129 and IEEE Standards 308-1974 and 450-1995.

Compliance with General Design Criteria 17 and 18 is discussed in Section 3.1.

Refer to Appendix 3A for the applicable revision dates on regulatory guides.

8.3-38 Rev. 27 WOLF CREEK

REGULATORY GUIDE 1.6, INDEPENDENCE BETWEEN REDUNDANT STANDBY (ONSITE) POWER SOURCES AND BETWEEN THEIR DISTRIBUTION SYSTEMS - The power block Class IE dc system is separated into four subsystems, two per load group. Each dc subsystem is energized by one battery and one battery charger. Each battery charger is supplied from its associated ac load group. The batteries are exclusively associated with a single 125-V dc bus. No provision exists for transferring loads between redundant 125-V dc subsystems. Thus, sufficient independence and redundancy exist between the 125-V dc subsystems to ensure performance of minimum safety functions, assuming a single failure.

Two spare chargers are provided to replace any of the four chargers. The spare chargers are located in the ESF Switchgear rooms, and are connected in place of failed chargers via non-automatic transfer switches.

REGULATORY GUIDE 1.32, CRITERIA FOR SAFETY-RELATED ELECTRIC POWER SYSTEMS FOR NUCLEAR POWER PLANTS

The requirements of Regulatory Positions C.1 and C.2 pertaining to the dc systems are met as follows:

a.

Reference:

Paragraph C.1.b of the regulatory guide.

Refer to Section 8.3.2.1.2.

b.

Reference:

Paragraph C.1.c of the regulatory guide. The battery performance test interval is performed as specified in IEEE Standard 450-1995 rather than the 3 years specified in Table 2 of IEEE Standard 308-1974.

The battery service test described in IEEE Standard 450-1995 is performed in accordance with the provisions of the plant Technical Specifications. A modified performance discharge test may be performed in lieu of a service test if desired, in accordance with the provisions of the Technical Specifications and IEEE Standard 450-1995.

(See Appendix 3A for discussion of compliance to Regulatory Guide 1.32 in relation to IEEE Standard 450)

c.

Reference:

Paragraph C.1.d of the regulatory guide.

Refer to Regulatory Guide 1.6 above in this section.

d.

Reference:

Paragraph C.2.a of the regulatory guide.

Refer to Regulatory Guide 1.81 below in this section.

e.

Reference:

Paragraph C.2.b of the regulatory guide.

Refer to Regulatory Guide 1.93 below in this section.

REGULATORY GUIDE 1.41, PREOPERATIONAL TESTING OF REDUNDANT ON-SITE ELECTRIC POWER SYSTEMS TO VERIFY PROPER LOAD GROUP ASSIGNMENTS - In compliance with this regulatory guide, the Class IE 125-V dc subsystems designed in accordance with Regulatory Guides 1.6 and 1.32 are tested as follows:

a. Testing of the dc power system, including an acceptance test of battery capacity, is performed prior to unit operation and after major modifications or repairs in accordance with the procedures described in Chapter 14.0.

b. The charger, battery connections, and charger supply are checked for proper assignment to the proper ac load group.

8.3-39 Rev. 35 WOLF CREEK

c. Class IE 125-V dc subsystems are functionally tested, along with the associated ac load group, by discon-necting and isolating the other ac load group, its ac power sources, and the associated dc subsystem. Each test includes simulation of an engineered safety features actuation signal, startup of the standby diesel generator and the load group under test, sequencing of loads, and the functional performance of the loads.

During these tests, the ability of the 125-V dc subsystem to perform its intended functions, e.g.,

control of diesel generators and Class IE ac switchgear, is checked.

d. During the testing of the Class IE 125-V dc subsystem associated with one ac load group, the busses of the 125-V dc subsystem associated with the ac load groups not under test are monitored to verify the absence of voltage, indicating no interconnection of the dc systems.

REGULATORY GUIDE 1.81, SHARED EMERGENCY AND SHUTDOWN ELECTRIC SYSTEMS FOR MULTI-UNIT NUCLEAR POWER PLANTS - WCGS is a single unit plant.

REGULATORY GUIDE 1.93, AVAILABILITY OF ELECTRIC POWER SOURCES - Refer to Appendix 3A for the response to this regulatory guide.

REGULATORY GUIDE 1.128, INSTALLATION DESIGN AND INSTALLATION OF LARGE LEAD STORAGE BATTERIES FOR NUCLEAR POWER PLANTS - The requirements of IEEE 484, 1975 are used for the installation of batteries.

The battery room ventilation system limits hydrogen concentration to less than 2 percent by volume at any location in the battery area.

Restraining channel beams and tie rods are electrically insulated from the cell cases and are finished with acid-resistant paint.

The requirements of Regulatory Guide 1.120 for safety-related battery rooms are complied with. Refer to Appendix 3A for the response to this regulatory guide.

The requirements of Regulatory Guide 1.100 are complied with. Refer to Appendix 3A for the response to this regulatory guide.

Batteries are located in a well-ventilated location with adequate aisle space and space above cells.

Temperature differential between cells is no greater than 3ø C at a given time.

The presence of localized heat sources is precluded.

Eyewash facilities are provided in the corridor between the battery rooms as shown on Figure 1.2-24.

Battery racks provide for the mounting of batteries in a two-step configuration.

Fire detection sensors and alarms are provided as described in Section 9.5.1.

8.3-40 Rev. 27 WOLF CREEK

During unpacking, any cell with electrolyte level 1/2 inch or more below the top of the plates is replaced.

Cells are stored in a clean, level, dry, and cool location. Extremely low ambient temperatures and localized sources of heat are avoided.

The recommendations for a freshening charge outlined in IEEE 484, Paragraph 5.3.1, are followed after the installation of the batteries.

A hydrogen survey is performed to verify that the ventilation system limits hydrogen concentration to less than 2 percent by volume. This survey data is recorded and maintained in a permanent file for future reference.

REGULATORY GUIDE 1.129, MAINTENANCE, TESTING, AND REPLACEMENT OF LARGE LEAD STORAGE BATTERIES FOR NUCLEAR POWER PLANTS - The requirements of IEEE 450, 1995 are followed as described below.

IEEE Standard 308-1974, IEEE Standard Criteria for Class IE Electric Systems for Nuclear Power Generating Stations - For compliance with the ac power requirements of IEEE 308, refer to Section 8.1.4.3.

The following provides compliance for the dc power requirements of IEEE 308.

The Class IE dc system provides dc electric power to the Class IE dc loads and for the control and switching of the Class IE systems. Physical separation, electrical isolation, and redundancy are provided to prevent the occurrence of common mode failures. The design of the Class IE dc system includes the following:

a. he dc system is separated into four subsystems.

b. The safety actions of each group of loads are independent of the safety actions provided by its redundant counterpart.

c. Each dc subsystem includes power supplies that consist of one battery and one battery charger.

d. The batteries are not interconnected.

e. The batteries do not have a common failure mode.

Each Class IE dc distribution circuit is capable of transmitting sufficient energy to start and operate all the required loads in that circuit.

Distribution circuits to redundant equipment are independent of each other.

The distribution system is monitored to the extent that it is shown to be ready to perform its intended function. The dc auxiliary devices required to operate the equipment of a specific ac load group are supplied from the dc subsystem of the same load group.

8.3-41 Rev. 27 WOLF CREEK

The batteries are maintained in a fully charged condition and have sufficient stored energy to operate all the necessary circuit breakers and to provide an adequate amount of energy for all required emergency loads for 240 minutes after loss of ac power or charger failure.

Each battery charger has sufficient capacity to restore the battery from the design minimum charge (one duty cycle) to its fully charged state while supplying the largest combined demand of the steady-state loads. The battery charger of one subsystem is independent of the battery charger for the redundant subsystem.

Instrumentation is provided to monitor the status of each dc subsystem. No instrumentation is shared between subsystems.

A summary annunciator in the control room is provided to alarm on any one of the following conditions. Each condition is also provided with individual alarm windows at the main switchboard.

a. Charger input breaker open

b. Charger output breaker open

c. Charger failure

d. Charger input ac undervoltage

e. Charger output dc undervoltage

f. Charger output dc overvoltage

g. Dc bus undervoltage

h. Distribution switchboard undervoltage

i. Dc ground

j. Battery circuit continuity monitor

Indicating instruments are provided to monitor the following:

a. Battery output amperes (local and control room)

b. Bus voltage (local and control room)

c. Charger output current (local and control room)

d. Charger output voltage (local only)

e. Distribution switchboard white light (local only)

8.3-42 Rev. 27 WOLF CREEK

Each battery charger has an input ac and output dc circuit breaker for isolation of the charger. Each battery charger power supply is designed to prevent the ac supply from becoming a load on the battery due to a power feedback as the result of the loss of ac power to the chargers.

Equipment of the Class IE dc system is protected and isolated by fuses or circuit breakers in the event of a short circuit or overload conditions.

Indication is provided to identify equipment that is made unavailable per the following:

Event Available Indication

a. Battery charger ac Control room summary alarm, input breaker trip alarm at main switchboard, breaker position at charger

b. Battery charger dc Control room summary alarm, output breaker trip alarm at main switchboard, breaker position at charger

c. Battery fuse blow Control room summary alarm, alarm at main switchboard

d. Distribution switch- Control room summary alarm, board feeder fuse blow alarm at main switchboard local white light

e. Distribution circuit Individual equipment alarm fuse blow

f. Inverter dc feeder Inverter trouble alarm/static fuse blow switch transfer

g. Inverter output ac 120-v ac vital bus under-breaker trip voltage alarm

h. Battery high rate of Control room computer alarm discharge

Periodic testing and surveillance requirements for the Class IE batteries are detailed in the Technical Specifications.

Dependable power supplies are provided for the reactor protection system and engineered safety features actuation system. Four independent dc and ac power supplies are provided for control and instrumentation of these systems. The independent dc supplies are provided by distribution circuits from distribution panels on each system. Independent ac supplies are provided by the four inverters and associated 120-v ac vital busses. Refer to Section 8.3.1.1.5 for further description of these vital instrument ac power supplies.

8.3-43 Rev. 29 WOLF CREEK

IEEE STANDARD 450-1995, RECOMMENDED PRACTICE FOR MAINTENANCE, TESTING, AND REPLACEMENT OF VENTED LEAD-ACID BATTERIES FOR STATIONARY APPLICATIONS - The following recommended practices of IEEE 450 for maintenance, testing, and replacement of batteries are followed for the Class IE batteries:

a. Maintenance, inspections, and tests, including cell differential temperature measurements, are carried out on a regularly scheduled basis to comply with the requirements of IEEE 450.

b. An acceptance test of battery capacity is performed at the factory to determine if it meets the specified discharge rate and duration.

c. The first performance test of battery capacity was carried out within the first 2 years of service. The subsequent performance tests or modified performance tests of battery capacity are made once every 5 years until the battery shows signs of degradation. Refer to Technical Specification 3.8.4.

d. Eighteen month performance tests of battery capacity are given to any battery which shows signs of degradation or which has reached 85 percent of the expected service life, in accordance with the provisions of IEEE 450-1995 and the plant Technical Specifications.

e. The battery service tests or modified performance tests described in Sections 5.3 and 5.4 of IEEE Standard 450-1995 are performed in accordance with the provisions of the plant Technical Specifications. If system design is changed so that the previous test is no longer a valid test of the capability of the battery to meet the changed design requirements of the system, a service test is conducted on the new system design.

f. The rating of the battery when purchased is approximately 50 percent greater than that required to supply the emergency load requirements. 25% of the 50% is reserved for aging margin. This margin permits a battery replacement criteria of 80-percent rated capacity (refer to Section 8.3.2.1.2).

g. Records of the data obtained from inspections and tests are kept along with test procedures, to comply with the requirements.

8.3-44 Rev. 35 WOLF CREEK

8.3.3 FIRE PROTECTION FOR CABLE SYSTEMS

The measures employed for the prevention of and protection against fires in electrical cables are described in Section 9.5.1.

Section 8.3.1.4.1, Separation Criteria, provides information regarding separation between redundant cable trays.

8.

3.4 REFERENCES

1. Marasco, F. W. and Siroky, R. M., "Westinghouse 7300 Series Process Control System Noise Tests," WCAP-8892-A, June 1977.

8.3-45 Rev. 27 WOLF CREEK

TABLE 8.3-1

CLASS IE DC SYSTEM LOADS

I. DC Subsystem 1 (Separation Group 1)

a. Diesel generator NE01 control and field flashing

b. Solenoid valves, indicating lights, and miscellaneous power and controls associated with load group 1

c. Class IE switchgear of load group 1 dc control

d. Inverter NN11 (or Swing Inverter NN15)

e. Reactor trip switchgear, channel 1 dc control

f. Main control room dc emergency lighting

g. Load shedder and emergency load sequencer panel

h. Engineered safety feature status panel

i. Diesel generator 1 control panel

II. DC Subsystem 4 (Separation Group 4)

a. Diesel generator NE02 control and field flashing

b. Solenoid valves, indicating lights, and miscellaneous power and controls associated with load group 2

c. Class IE switchgear of load group 2 dc control

d. Inverter NN14 (or Swing Inverter NN16)

e. Reactor trip switchgear channel 2 dc control

f. Engineered safety features status panel

g. Load shedder and emergency load sequencer panel

h. Diesel generator 2 control panel

III. DC Subsystem 3 (Separation Group 3)

a. Inverter NN13 (or Swing Inverter NN15)

b. Miscellaneous indicators, power, and controls associated with Separation Group 3

Rev. 29 WOLF CREEK

TABLE 8.3-1 (Sheet 2)

IV. DC Subsystem 2 (Separation Group 2)

a. Inverter NN12 (or Swing Inverter NN16)

b. Miscellaneous indicators, power, controls, and auxiliary feedwater pump turbine controls associated with Separation Group 2

Rev. 29

WOLF CREEK

TABLE 8.3-4

FAILURE MODES AND EFFECTS ANALYSIS

This table presents the failure mode and effects analysis (FMEA) of the engineered safety features (ESF) auxiliary electrical power system. The purpose of the analysis is to demonstrate that the Class IE power system can provide sufficient power to ensure the operation of all ESF loads required for post-accident safe shutdown, assuming a single component failure, as defined in IEEE Standard 308-1974.

Components which are included in the analysis are listed on the first sheets of the table. Refer to Figure 8.3-1 sheets 1 through 5 and Figure 8.3-6, sheet 1, for the location of these components in the system.

Rev. 21

WOLF CREEK

APPENDIX 8.3A

STATION BLACKOUT

8.3A.1 INTRODUCTION On July 21, 1988, the Nuclear Regulatory Commission (NRC) amended its

regulations in 10 C.F.R., Part 50. A new section, 50.63, was added which requires that each light-water-cooled nuclear power plant be able to withstand and recover from a station blackout (SBO) of a specified duration. It also identifies the factors that must be considered in specifying the station blackout duration. Section 50.63 requires that, for the station blackout duration, the plant be capable of maintaining core cooling and appropriate containment integrity. Section 50.63 further requires the following information:

1) A proposed station blackout duration including a justification for the selection based on the redundancy and reliability of the onsite emergency AC power sources, the expected frequency of loss of offsite power (LOOP),

and the probable time needed to restore offsite power;

2) A description of the procedures that will be implemented for station

blackout events for the duration (as determined in 1 above) and for recovery therefrom; and

3) A list and proposed schedule for any needed modifications to equipment

and associated procedures necessary for the specified SBO duration.

Late in 1985, the Nuclear Management and Resources Council, NUMARC, established a working group on station blackout. A Nuclear Utility Group on Station Blackout (NUGSBO) provided the major portion of the technical support for the NUMARC station blackout working group. NUMARC determined that many of the concerns related to station blackout could be alleviated through industry initiatives to reduce overall station blackout risk.

The NUMARC Executive Committee approved industry initiatives to address the more important contributors to station blackout risk.

In order to provide guidance and methodologies for implementing the NUMARC station blackout initiatives, NUMARC published the document NUMARC 87-00, Guidelines and Technical Bases for NUMARC Initiatives addressing Station Blackout at Light Water Reactors.

The NRC has issued Regulatory Guide 1.155 Station Blackout which describes a means acceptable to the NRC Staff for meeting the requirements of 10 C.F.R.

50.63. Regulatory Guide (RG) 1.155 states that the NRC Staff has determined that NUMARC 87-00 Guidelines and Technical Bases for NUMARC Initiatives addressing Station Blackout at Light Water Reactors also provides guidance that is, in a large part, identical to the RG 1.155 guidance and is acceptable to the NRC Staff for meeting these requirements.

8.3A-1 Rev. 14 WOLF CREEK

8.3A.2 STATION BLACKOUT GENERAL CRITERIA AND ASSUMPTIONS

Procedures and equipment relied upon in a station blackout should ensure that satisfactory performance of necessary decay heat removal systems is maintained for the required station blackout coping duration. Additional requirements are to keep the core covered and to provide appropriate containment integrity to the extent that isolation valves perform their intended function without AC power. The general criteria and baseline assumptions used to evaluate the station blackout event are discussed in detail in Reference 1, NUMARC 87-00.

8.3A.3 WOLF CREEK BLACKOUT DURATION NUMARC 87-00, Section 3 was used to determine a station blackout duration of

four hours for Wolf Creek. This duration was determined based on the following plant considerations.

8.3A.3.1 AC Power Design Characteristic Group

NUMARC 87-00 distinguishes between sites having particular susceptibilities to losing off-site power due to plant-centered, grid-related, and weather-related events. Three off-site power design groups are provided and are designed to be mutually exclusive. Of the three groups, group P1 includes those sites characterized by redundant and independent power sources that are considered less susceptible to loss as a result of plant-centered and weather-initiated events. Based upon NUMARC 87-00 guidance, Wolf Creek is determined to be in AC Power Design Characteristic Group, P1. This determination is based upon the following criteria of NUMARC 87-00.

a) The expected frequency of grid-related loss of offsite power (LOOPs) does not exceed once per twenty years. As discussed in the Wolf Creek USAR Section 8.2.2, the grid design and past performance of the transmission system support the projection of uninterrupted transmission grid availability necessary to meet all requirements over the life of Wolf Creek.

b) Sites are categorized in groups based upon the estimated frequency of

LOOPs due to extremely severe weather. The estimated frequency of loss of off-site power due to extremely severe weather is determined by the annual expectation of storms at the site with wind velocities greater than or equal to 125 mph. Sites within the Extreme Severe Weather Group 1 have an annual frequency of storms, with wind velocities greater than or equal to 125 mph, less than 3.3 x 10-4. Wolf Creek is in Extreme Severe Weather Group 1.

c) The estimated frequency of LOOPs due to severe weather places Wolf Creek in Severe Weather Group 2. Based on site specific factors, an empirical formula is used to determine the estimated frequency of LOOP due to severe weather in events per year. The factors include the annual expectation of tornados of severity f2 (windspeeds greater than or equal to 113 miles per hour) in events per square mile; and the annual expectation of storms for the site with wind velocities between 75 and 124 mph. Plants within Severe Weather Group 2 have an estimated frequency of loss of off-site power due to severe weather of 0.0033 or greater, up to but not including 0.0100.

d) The potential for long duration loss of off-site power events can have a significant impact on station blackout risk and required coping durations. Long duration LOOP events are associated with grid failures

8.3A-2 Rev. 14 WOLF CREEK

due to severe weather conditions or unique transmission system features.

Shorter duration LOOP events tend to be associated with specific switchyard features, in particular, (1) the independence of the off-site power sources constituting the preferred power supply to the shutdown buses on-site, and (2) the power transfer schemes when the normal source of AC power is lost. Two plant groupings, I 1/2 and I 3, are used for classifying the interface of the preferred power supply to the safe shutdown bus. Of the two groups, the I 1/2 group is characterized by features associated with greater independence and redundancy of sources, and a more desirable transfer scheme. The plant groupings are based upon the applicability of three conditions A, B (1), or B (2), for a given plant. Condition A requires that all off-site power sources are connected to the units safe shutdown buses through either the switchyards or two or more electrically connected switchyards. This condition applies at Wolf Creek.

Condition B (1) requires the normal source of AC power to be from the

unit main generator with no automatic transfers and one or more manual transfers of all safe shutdown buses to preferred or alternate off-site sources. Condition B (2) requires the normal source of AC power to be from the unit main generator with one automatic transfer and no manual transfers of all safe shutdown buses to one preferred or one alternate off-site power source.

Conditions B (1) and B (2) are not applicable to Wolf Creek. At Wolf Creek the normal source of AC power to the shutdown buses is from the switchyard. Since Condition A is applicable to Wolf Creek and Conditions B (1) and B (2) are not, the Wolf Creek off-site power system is assigned to the I 1/2 Group per NUMARC 87-00 guidance.

The combination of the above Factors places Wolf Creek in the P1 off-site power design characteristic group per NUMARC 87-00.

8.3A.3.2 Emergency AC Power Configuration Group Wolf Creek is determined to be in the emergency AC power configuration group C

(EAC Group C). After the likelihood of losing off-site power, the redundancy of the emergency AC power system is the next most important contributor to station blackout risk. With greater EAC system redundancy, the potential for station blackout diminishes, as does the likelihood of core damage. The importance of EAC redundancy is reflected through the use of four distinct EAC configuration groups. Those sites in group C have typical redundant and independent EAC sources to safe shutdown equipment.

Placement in this group depends on the number of EAC standby power supplies available and the number required to operate AC-powered decay heat removal equipment necessary to achieve and maintain safe shutdown in a station blackout. Overall, the greater the level of EAC redundancy, the less restrictive are the station blackout coping durations and maximum emergency diesel generator (EDG) failure rates before longer coping durations are required, or corrective actions become necessary.

8.3A-3 Rev. 14 WOLF CREEK

The potential for excess EAC power sources to be used as Alternate AC is directly related to the existing level of EAC redundancy. Since EAC redundancy is an important parameter for determining station blackout coping duration categories, EAC power sources relied upon as Alternate AC power sources must not also be considered when assessing the required coping duration.

The Wolf Creek designation of Group C is based on the following:

1) There are two emergency AC power supplies not credited as alternate AC power sources; and

2) One emergency AC power supply is necessary to operate safe shutdown

equipment following a loss of off-site power.

8.3A.3.3 Emergency Diesel Generator (EDG) Reliability

The target emergency diesel generator reliability for Wolf Creek is selected to be 0.95. The selection of this value is consistent with NUMARC 87-00 and is based upon having a nuclear unit average EDG reliability for the last 100 demands as of April 17, 1989 greater than 0.95.

The unit EDG reliability is used in conjunction with the sites off-site power design characteristic, P1, and the EAC configuration Group C, to determine the units required station blackout coping duration. The unit EDG reliability was calculated by averaging the individual EDG reliability for the last 20, 50, and 100 demands for each machine as of April 17, 1989.

The objective of the three-tier approach (i.e., 20, 50, and 100 Demands) to reliability measurements is to provide greater depth of understanding regarding reliability trends. The 20-demand sample set is the most volatile, and offers a very sensitive indication of EDG performance. Since this indicator moves with each incremental failure or success, it is not considered a reliable measure of long-term performance. Similarly, the 100-demand sample set offers a long-term trend indication, while providing limited insight to recent trends due to data smoothing effects. The 50-demand sample set bridges the two indicators while also providing an intermediate level. Taken together, the set of indicators provides a fairly complete picture of EDG reliability.

Wolf Creek maintains an EDG reliability monitoring program to ensure reliability remains greater than 0.95.

8.3A.3.4 Coping Duration Category

Using Table 3-8 of NUMARC 87-00, Wolf Creek has a required coping duration category of four hours. The criteria supporting this four hour duration include the Wolf Creek off-site power group P1, discussed in Section 8.3A.3.1, the EAC Group C, discussed in Section 8.3A.3.2, and the minimum EDG target reliability of 0.95, discussed in Section 8.3A.3.3.

8.3A-4 Rev. 14 WOLF CREEK

8.3A.4 Procedures for SBO

Wolf Creek procedures comply with the guidelines of NUMARC 87-00, Section 4.

SBO response guidelines provide for operator actions to be taken in a SBO event; guidance is provided to operations and load dispatcher personnel for actions to restore AC power in a station blackout; and guidance is given for operators to determine the proper actions due to the onset of severe weather.

Wolf Creek procedures incorporate these guidelines and are described as follows:

1) The station blackout response guidelines of NUMARC 87-00, Section 4.2.1 are met by plant procedures, Loss of all AC Power; Security Diesel Generator Operability Test; Technical Support Center Diesel Generator Operability Test and Emergency Operations Facility Diesel Generator Operability Test.

2) The AC power restoration guidelines of NUMARC 87-00, Section 4.2.2, are met by plant procedure, Loss of All AC Power Recovery Without SI Required.

3) The severe weather preparation guidelines of NUMARC 87-00, Section 4.2.3, are met by plant procedure, Natural Events OFF Normal.

8.3A.5 Summary of SBO Coping Assessment

The ability of Wolf Creek to cope with a station blackout for four hours has been assessed in accordance with NUMARC 87-00. The coping assessment assures that Wolf Creek has adequate condensate inventory for decay heat removal during a SBO of the four hour duration; has adequate battery capacity to support decay heat removal during the four hour duration; air operated valves required for decay heat removal have sufficient reserve air or can be manually operated under station blackout conditions for four hours; operability of equipment by determination of the average steady state temperature in dominant areas containing equipment necessary to achieve and maintain safe shutdown during the SBO; containment integrity can be provided during the SBO for the four hour duration, and the ability to maintain adequate reactor coolant system inventory. Each item of assessment is discussed in the following paragraphs.

8.3A.5.1 Condensate Inventory for Decay Heat Removal

It was originally determined using guidelines in Section 7.2.1 of NUMARC 87-00 that 151,000 gallons of water are required for decay heat removal for a four-hour coping duration. This number has changed to 156,300 gallons due to power rerate and condensate storage tank temperature analysis for elevated tank temperatures when using recirculation of the tank via the condensate demineralizer system. The minimum permissible condensate storage tank level per Technical Specifications provides 281,000 gallons of water, which exceeds the required quantity for coping with a four-hour station blackout. Hence this new number still satisfies a four-hour coping duration.

8.3A-5 Rev. 26 WOLF CREEK

8.3A.5.2 Class 1E Battery (ies) Capacity

A battery capacity calculation has been performed pursuant to NUMARC 87-00, Section 7.2.2, to verify that the Class 1E battery (ies) has sufficient capacity to meet station blackout loads for four hours.

8.3A.5.3 Compressed Air Air-operated valves relied upon to cope with a station blackout for four hours

have sufficient backup sources independent of the blacked out units preferred and Class 1E power supplies. The valves are identified in plant procedures.

8.3A.5.4 Effects of Loss of Ventilation

The calculated peak air temperature for the steam driven AFW pump room (the dominant area of concern for a PWR) during a station blackout induced loss of ventilation is 150° F provided corridor doors are opened. This requirement is incorporated in the plant procedures for Loss of All AC Power.

Reasonable assurance of the operability of station blackout response equipment in the above dominant area of concern has been assessed using Appendix F to NUMARC 87-00. No modifications are required to provide reasonable assurance for equipment operability.

The assumption in NUMARC 87-00, Section 2.7.1 that the control room will not

exceed 120°F during a station blackout has been assessed. Calculations verify that the control room at Wolf Creek will not exceed 120°F during a station blackout provided certain doors are opened. The doors are listed in an Attachment in plant procedure Loss of All AC Power.

8.3A.5.5 Containment Isolation The plant list of containment isolation valves has been reviewed to verify

that valves which must be capable of being closed or that must be operated (cycled) under station blackout conditions can be positioned (with indication) independent of the preferred Class 1E power supplies. No plant modifications were determined to be required to ensure that appropriate containment integrity can be provided under SBO conditions. Wolf Creek procedures include all actions necessary to assure containment integrity.

8.3A.5.6 Reactor Coolant Inventory

The ability to maintain adequate reactor coolant system inventory to ensure that the core is cooled for four hours has been assessed. A plant-specific analysis was used for this assessment. The expected rates of reactor coolant inventory loss under SBO conditions do not result in uncovering the core in an SBO of four hours. Therefore, makeup systems under SBO conditions are not required to maintain core cooling under natural circulation (including reflux boiling).

8.3A-6 Rev. 14 WOLF CREEK

8.3A.6 REFERENCES

1. NUMARC 87-00, Guidelines and Technical Bases for NUMARC Initiatives addressing Station Blackout at Light Water Reactors, November 1987.

2. NRC NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants, 1985.

3. NRC Regulatory Guide 1.155, Station Blackout.

4. Wolf Creek Calculations: AN 93-056, AN 99-004, GK-E-001, GK-EW-001, GK-M-005, GK-MW-004, NK-E-001, SR-88-001, SA-89-004, YY-01-W.

5. NO 89-0072, dated April 17, 1989 (Response to Station Blackout Rule).

6. ET 90-0057, dated March 30, 1990 (Supplemental Response to Station Blackout Rule).

7. ET 92-0072, dated March 24, 1992 (Response to Request for additional information on Station Blackout Analysis for the Wolf Creek Generating Station).

8. NRC letter dated Janurary 16, 1992 (Safety Evaluation and Request for Additional Information Concerning Station Blackout Analysis for the Wolf Creek Generating Station, TAC No. M68626).

9. NRC letter dated June 16, 1992, Wolf Creek Generating Station -Supplemental Safety Evaluation Regarding Blackout Rule.

10. WCAP-12231, Station Blackout Coping Assessment for Wolf Creek Generating Station, dated April 15, 1989.

11. Wolf Creek Procedure EMG C-0, Loss of All AC Power.

12. Wolf Creek Procedure EMG CS-01, Loss of All AC Power Recovery without SI Required.

13. Wolf Creek Procedure AP20A-007, Station Blackout Quality Program Requirements.

8.3A-7 Rev. 25