ML15224A779

FOIA/PA-2015-0393 - Resp 2 - Final, Part 1 of 1

ML15224A779
Person / Time
Site:	Oconee
Issue date:	08/07/2015
From:	Office of Information Services
To:
References
FOIA/PA-2015-0393
Download: ML15224A779 (75)

Text

' W UI" D eT lIsa"; REGULAkTORY COMMISSION-* IL, i. C.205t_ .o-June 3, 1977Docket Nos. 50-269 ..5o-z~oRECEIVEDand 50-287JU 97:,"DUKE POWERDuke Power Company* iJ# JOUm on:ATTN: Mr. WilliamO0. Parker,: Jr. ---- i ~ ~~Vice President SPost Office Box 2178 "' ": L'q 422 South Church Streeti Charlotte, North Carolina 28242* -Ge ntlemen:-- RE: OCONEE NUCLEAR STATION, UNITS 1, 2 AND 3Wie are currently reviewing the onsite emergency power systems of all* o operating nuclear .power facilities to assess the susceptibility oftheir safety related electrical equipment with regard to (1) sustaineddegraded voltage conditions at the offsite power sources and (2) inter-action between the off site, and onsite emergency power systems.* We have completed our review of licensee responses to our previousCi generic request for information relative to the electrical powerO distribution systems. Based on this initial review, we have preparedthe Safety Evaluation and Statement of Staff Positions contained inS E~ncl osure 1.We request that you compare the current design of the emergency powersystems at your facility(i~es) with the Staff Positions stated in theenclosure and:(1) propose plant modifications as necessary to meet the StaffPositions, or(2) provide a detailed analysis which .shows your facility designhas equivalent capabilities and protective features.Additionally. we require that certain technical specifications beincorporated into all facility operating licenses. Model technicalspecifications, consistent with the Staff Positions contained inEnclosure 1, are provided in Enclosure 2.0000L&770603AB42 iDuke Power Company June 3, 1977Accordingly, we request that you apply, within forty-five days ofthe receipt of this letter, for an amendment to your facilit! operatinglicense(s) to incorporate comparable technical specifications to thosepresented in the enclosure. Additionally, you should provide adescription and a schedul~e for the completlor' of a ny plant associatedmodi fications.If you have any questions on this matter, please cnntact us.Sincerely,v,' < 9 4~A. Schwencer, Chief-o Operating Reactors Branch #1Division of Operating Reactors

Enclosures:

1. Staff Positions-. 2. Model TechnicalSpecitfi cati ons..cc w/encl osures:Mr. William L. Porter.Duke Power CompanyP. 0. Box 2178*,' 422 South Church Street,Charlotte,. North Carolina 28242__ J. Michael McGarry, III-,; EsquireDeBevoise & Libernan700 Shoreham Building806-15th Street, N. W.Washington, D. C. 20005Oconee Public Library,201 South Spring Street,Walhalla, South Carolilna 29691

• i i , JIENCLOSURE 1' .SAFETY EVALUATION.AND STATEMENT OF STAFF POSITIONSRELATIVE TO THE EMERGENCY POWER SYSTEMSFOR OPERATING REACTORSA. INTRODUCTION") The onsite emergency power systems of operating nuclear power facilitiesare being reviewed to assess, the susceptibility of their associatedredundant safety-related electrical equipment to:-(a) *Sustained. degradeU voltage conditions at the offsite powersource; and(b) Interaction of the offsite and onsite emergency power systems.We have completed our review, of the responses to our generic request foradditional 1/ relative to the electrical power distributionsystems of currently ooeratinq nuclear Dower facilities. In responseto our request, all licensees have analyzed their system designs toO determine that the voltage levels at the safety-related buses havebeen optimized for the full load and nii~imum load conditions that areexpected throughout the anti~ipated range of voltage variations forthe offsite power sources. The transformer voltage tap adjustmentsthat were necessary to optimize the voltage levels have been accomplished.In addition to the above corrective action, we have developed tne followingstaff positions for use in evaluation of each of the operating nuclearwer plants with regard to the two items identified above. These positions,.÷ '.i ,ir ;icensee resr,'-1se t--,.m'Letters to all licensees, dated August 12 and 13, 1976.

• 0requests for additional information and *f other related informationas cited in the text.B. POSVTIONS1) Position 1: Second Level of Under-or-Over Voltage Protectionwith a Time DelayWerequire that a second level of voltage protection for theonsite power system be provided and that this second level ofr. voltage protection shall satisfy the followina criteria:F. a) The selection of voltage and time set Doints shall bedetermined from an an~lysis of the voltage requirements ofthe safety-related loads at all onsite system distribution~levels;( b) The voltage protection shall include coincidence logic toI spurious trips of the off~ite power source;) *.c) The tihe delay selected shall be based on thelfollowing conditions:.(1) The allowable time delay, including margin, shall notexceed the maximum time delay that is assumed in theFSAR accident analyses;(2) The time delay shall milnimize the effect of shortduration disturbances from reducin9 the availabilityof the offsite power and(3) The allowable ti.re d-iration of a degraded voltagecondition at all distribution~ system' levels gha1.1rnot in f clreo safer7 syste-' or co~cone'ts;

,.w i ,I; d) The voltage monitors shall automatically initiate the disconnection of offsite power sources whenever the voltage set point and time delay limits have been exceeded; ie) The voltage monitors be designed to satisfy the requirementsof IEEE Std. 279-1971, "Criteria for Protection Systems for Nuclear] *S Power Generating Stations"; andf)The Technical Specifications shall include limiting conditions forI N operation,'survelllance requirements, trip set points with minimum.- and maximum limits, and allowable values for the second-level0voltrage protection monitors.~.General Design Criterion 17 (GDC 17) "Electric Power Systems', of Appendixv- A, "General Design* Criteria for Nuclear Power Plants;" of 10 CFR Part 50o0 requires: (a) two physically independent circuits from. the offsite trans-0 mnlssion network (although one, of these circuits may be a delayed accesst, circuit, one c.ircuit must be automatically available within a few secondsfollowing a loss-of-coolant accident); (b) redundant onsite A.C. powersupplies; and (c) redundant D.C. power supplies.GDC-17 further requires that ,the safety function of each a.c. system (assumingthe other system is not functioning) shall be to provide sufficient capacityand capability to assure that;: (a) specified acceptable fuel design limits.and the design conditions the reactor coolant pressure boundary are notexceeded as a result of antic~ie te~~.~c' l oc:';'-rnces; and (b) thecore is ccok.td and *.lte~r4.,, o'her vit.al functions aremaintained during any of the :postulated accidents.

Existing undervoltage monitors automatically perform the required func-tion of switching from offstte power, the preferred oower source, to theredundant onsite power sources when the monitored voltage degrades to alevel of between SO to 70 percent of the nominal rated safety bus voltage.This Is usually accomplished ,after a one-half to one second time delay.These undervoltage monitors are designed to function on a complete lossof the offslte power source.:- The offsite power system is the co.ntnon source which normally suoolies1~-..power to the redundant safetyl-related buses. Any transient or sustaineddegradation of this conmnon sojrce will be reflected onto the onsitesystem's safety-related busesI.Asustained degradation of offsite Dower system's voltage couldresult in the loss of capability of the redundant safety loads, theircontrol circuitry, and the associated electrical components requiredfor performing safety functiops.The operating procedures and guidelines utilized by electric utilities* and their interconnected cooperative oroanizations minimize the pro-* bability for the above conditions to occur. However, since deoradationof an offsite Dower system that could lead to or cause the failure ofredundant safety-related electrical equipment is unacceptable, we requirethe additional safety margins associated with implementation of theprotective measures detailed above.

.I* 0-5-2) Position 2: Interaction of Onsite Power Sources with LoadShed FeatureWe require that the current system designs automatically preventload shedding of the emergency buses once the onsite sources aresupplying power to all sequenced loads on the emergency buses. Thedesign shall also include the capability of the load shedding featureto be automatically reinstated if the onsite source supply breakersare tripped. The automatic bypass and reinstatement feature shall beverified during the periodic testing identified in Position 3.* --- In the event an adequate basis can be provided for retaining the load~shed feature when loads are energized by the onsite power system, wewill require that the setpoint value in the Technical Specifications,which is currently specified as "...equal to or greater than..." beC) amended to specify L value having maximum and minimum limits. Theolicensees' bases for the setpoints and limits selected must be documented.GDC 17 requires that provisions be included to minimize the probabilityof losing electric power from any of the remaining supplies as a resultof or coincident with the loss of power generated by the nuclear powerunit, the loss of power from the transmission network, or the loss ofpower from the onsite electric power supplies. The functional safety requirement of the "loss-of-offsite powermonitors" is to detect the loss of voltage on the offsite (preferred)power system and to initiate the necessary actions required to trans-fer the safety-related buises to the onsite system. The load sheddingfeature, which is required to function prior to connecting the onsitepower sources to their respective buses can adversely interact withthe onstte power sources itf the load shedding feature is not bypassedafter it has performd i~s required function. The load shed feature"- should also be to allow itlto perform its function if the~onsite sources are interr~upted and are subsequently required to bereconnected to their respective buses.3) Position 3: Onsite Power Source TestingC)~We require that the Technical Specifications include a test requirementm'I" to demonstrate the full functional .operability and independence of theonsite power sources at least once per 18 months during shutdown. TheTechnical Specifications shall include a requirement for tests: (1)simulating loss of offsi~te power in conjunction with a safety injectionactuation signal; and (2) simulating interruption and subsequentreconnection of onsite power sources to their respective buses. Properoperation shall be determined by:a) Verifying that on loss of offsite power the emergency buses havebr~n ...-. that th: lo'.zhav'bee shed the ~b) Verifying that on, 19ss of offslte power the diesel generatorsi start from ambient condition on the autostart signal, the emergencybuses are energized with permanently connected loads, the auto-connected emergency loads are energized through the loadi sequencer, and the system operates for five minutes while thegenerators are loaded with the emergency loads.c) Verifying that on interruption of the onsite sources the loadsI are shed from the emergency buses in accordance with designii, m requirements and that subsequent loading of the onsite sources1i is through the load sequencer.GDC 17 requires that provisions be included to minimize the probabilityof losing electric power from any one of the remaining supplies as aQresult of or colncident,with the loss of power generated by the reactor~power unit, the loss of power generated by the nuclear power unit,; the loss of power fronr the *transmission network, or the loss of power* from the onsite electric power supplies.The testing requirements identified in Position 3 will demonstratethe capability of the onsite power system to perform its requiredfunction. The tests will also identify undesirable interactionbetween the offsite and onsite emergency power systems.

TABLE 3.3-3 (Continued)ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATIONF.UNCTIONAL UNITLOSS OF POWERa. 4.16 kv Energency BusUndervoltage (Loss of.Vol tage)b. 4.16 kv Emergency BusUndervol tage (DegradedVoltage)TOTAL NO.OF CHANNELSMiNIMUMCHANNELS CHIANNELSTO TRiP OPERABLEAPPLI[CABLEOPERATINGIODES** ACT[O__.,N***4()*u4(3)/Bus2/Bus2/Bus3(2)/Bus3(2)/Bus1,2, 31, 2, 3A or B00.9-.-4'71C'AerSI- tICw-u g~IllC,~-n'-4C,*(Entries In parenthesis are applicable for2 out of 3 coincidence logic)**Required when ESF equipment isrequired to be operable***Action A for 2 out of 4 logicAction B for 2 out of 3 logic IS STABLE 3.3-3 (Continued)ACTION STATEMENTSACTION A .-With the number of OPERABLE channels one less than theTotal Number of Channels operation may proceed providedboth of theifollowing conditions are satisfied:a. The inoperable channel is placed in the trippedcondition within one hour.b. The Minimum Channels OPERABLE requirement ismet; however, one additional channel may be'0 bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillancetesting per Specification (4.3.2.1.1).ACTION B -With the number of OPERABLE Channels one less than theTotal Number of Channels operation may proceed until-performance of the next required CHANNEL FUNCTIONALTEST provided the Inoperable channel Is placed in thetripped condition within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

r~ ~j ~ *~ Q1 7 ;: 7TABLE 3.3-4 (Continued)ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION TRIP VALUESFUNCTIONAL UNITi.OS:; OF POWERTRIP VALUEALLOWABLEVALUESS*'. 4.16 kv Emergency Bus Undervoltage(Loss of Voltage)h.. 4,16 ky Emergency Bus Undervoltage ...(De~graded Vol tage)( +Svolts with asecond time delay+ _)volts with asecond .time delayvolts with asecond time delay(+) volts with-aT_-) second time delay.1-vIU o 0 :. 4 6 0 I7 .;TABLE 4.3_-2 (Continued)ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION SURVEILLANCE REOUIREI4ENT$FU'2CTIONAL UNITI.OSS OF POWERa. 4.16 kv Emergency BusUndervoltage (Loss ofVoltage)hK 4.16 kv Evmergency BusUndervol tage--(Degraded .........Voltage)CHANNEL CHANNELCHECK CALIBRATIONCHANNELFUNCT IONALTESTOPERAT INGMOBES IN WHICHSURVE ILLANCEREQUIRED.£SSRRH141,2, 31, 2, 3S = at least once per 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sR = at least once per 18 monthsN = at least once per 31 days

...... J- ....*ELECTRICAL POWER

• IN-SURVEILLANCE REQU!RE?4ENTS. .. .r4.8.l.1.X Each diesel shall be demonstrated OPERABLE:a. At least per 18 months during shutdown by:1. Simulating a loss of offsite power in conjunction witha safetyinjection actuation test signal, and:a) Verifying de-energization of the emergency bussesand load shedding from the emergency busses.b) Verifying the diesel starts from ambient conditionon tihe auto-start signal, energizes the emergencybusses with permanently connected loads, energizesthe auto-connected emergency loads through the loadsequencer and operates for > 5 minutes while itsgenerator is loaded with th~ emergency loads.c) Verifying that on diesel generator trip, the loadsare Shed from the emer'gency busses and the dieselre-starts on the auto-start signal, the emergencybusses are energized with permanently connectedloads, the auto-connected emergency loads areenergized through the load sequencer and thediesel operates for > 5 minutes while its generatorIs loaded with the .emergency loads.o)

~422 SOrUTn1 CHVRCH ST~zsr. CRA!L.OTTE.. '. C. *July 21, 1977* g.*Mr. Edsou G. Case, Acting DirectorOffice of Nuclear ReactoF RegulationU. S. Nuclear Regulator/: Co~ission~Washington, D. C. 20555'* Onerating Reactors 3ranch ".'

Dear Mr. Case:

• a. Your letter of June 3., 1977 requested t.hat we compare t:he design of the, 0conee Nuclear Station power systems with the staf-f positlc-ns-- to assess the susceptiblilty of safety-related electrical equipment v-ihregard to C1) sustained degraded voltage conditions at the of fsite scur:es,~ ~and (2) interaction between' the offsite and. onsite emergency. p ower sys:e-..s.It is our conclusion, documented in the attached analysis, that the,design of the 0conee emergency power system has equivalent capabilitiesand protective features t~o those described in the staff's position."', Your letter requested an amendment t.o the Facility 0perating Licensebe proposed to incorporate comparable Technical Specifications to tiosail O provided in the staff p sition. This amendment :AlI be submitted by"September 13, 1977.ii .c, Very/truly yoursWilliam 0. Parker, MST:vrbec: Mr. 1t. B. Tucker Mr. Rt. T..Bond.bir. P. H. Barton I"Mr. T. P. EarrallMr. F. C. Eaywortb -.r1. B. I. RiceMr. K. S. Canady Mr. C. J. WylieMr. D. C. Eolt Master File OS 801.01Ms. L. J. Bare Section File OS 801.0)1 -Mr J. E. Smit~h

.... .OCON~EE NUCLEAR STAtTI0NResoonse to Staff Position on fle~raded System Condit~onsml m U II mIN.0'-0-o00The design of the Oconee Ni clear Station ousite emergency power system hasbeen reviewed and compared jw!th the Staff position as requested. It hasbeen determined that the protection system, relating to degradedoffsite system conditions, [ha equivu~ent. capabjLti£es and protection featuresto those described in the s position.The voltage protection i oae in the design consists of t.wo-out-of-threeconlincident undervolcage relay logic mon!toring the offside power syscam. Theundervol~age relays in thi4 logic have inverse time characteristcs that -il.Zprotect the onsite distribut~ion system from the effects of varyi.ng degradedoffsite system conditions.l The undervoltage protection will initiate sepa-ration of the onuite emergency buses from the offsite power systems irmedlatelyupon complete loss of offsite power or at a time delay depending on the axtentof the degraded condition.For the postultated conditions when the emergency buses must be separated fromthe offiste power systems some degraded condition, emergency power issupplied from the onsite K~owee Hydro Sta~tiou. Two 87.5 XVA hydro-electricgenerating units are avail~.ble to serve the emergency buses as described inFSAR Section 8.2.3. Due the enormous capacity of thease onsite emergencypower sources, load shedding and sequencing of the emergency loads is no:required. Therefore, the protection system incorporates all !eve._sof protection required fort degraded off site power system coudit~ons due the inherent caPabiltitiesjof the inverse time undervoltage relay.The following discussion a~dresses the comparison of the design of the OconeeNuclear Station emergency power systems with t.he scared Staff positions;Position !a) In response t.o the Augfzsc 12, 1976 NRC request for info~uat~on, ananalysis of the Oconaee electrical distribution system was performed,docunented, and. to the Staff. A susmary of this report isenclosed as Attachment, I. This analysis, covering the voltage requi.-e-ue.ntaof the electrical equipment under degraded conditions, defined the ,nder-voltage trip setpoint the inverse-time undervoltage protection relaysas 882 of the rated voltage. This setpolnc will initiate trippingat the following voltage levels and time delays, thereby providing pro-tection over the full of voltage decays:Percent of Setpoin ie ea5.0 sec3.6 sec8p2 2.0 sacs,0z 1.0 sec352 _'0.8 sec* I[ -

"1-2-~This settina orovides adq~quate margin sufficient to assure the ooerabilityof the emergency loads m~der short-time or long-time voltage degradationwithin the capability -" he equipment and wIthin the setpoinc limLits.b) The design of the voltage protection system conforms to this position inthat it provides* ewo-out'..of-three coincident undervoltage relay logic topreclude spuriously sepa "ating the emergency buses from the offsite powersources. -c) The time delays associated with the setpoints are listed in thepreceding response to Posi,.ion 1(a) were selected based on the followingconsiderations:-1) The allowable time d~lay, including margin to trip offsite power':i= and t.o provide emergency onsite power, does not exceed the 23seconds period for ai LOCA condition or the 23 minute period for~a mon-LOCA condition1 that is assumed in the accident analysis.* 2) The time delays sele~ted prevent short term transient conditionsl from reducing the av~.Ilabiliry of the offsire power sources and* -minimize the effects. of these disturbances.* ~3) The inverse-time c~haract.erlscic of the undervotage relays used* for voltage protectlion is well within the allowable limits estab-* O lished for the safety systems equipment. This protection will,.- therefore, separate t~he emergency buses from the offsice powersources before any level is reached which may be detrimentalto the safety systems or components.CDd) The undervolt.age protection logic automatically initiates the disconnec~i~n0 of the offsite power so~rces from the emergency buses whenever the vol.tageoD setooinc and time delay have been exceeded.e) Aithouzh designed =riort ,o the issuance of IEE 279-1971. the i protection logic satisfies the requirements of this standards.! f) Technical will be revised to make provisions for the~voltage protection moni ors.Position 2~The onsite emergency power for the Oconee Station is supplied by the~Keovee Hydro. Station as des~rlbed in the 7SAR Sect!on 8.2.3. Because of theI ~ample capability of the tvo;Keowee units C87.5 .qVA each), no load she~ddng-or sequencing of emergency is required. Therefore, no preventive inca:locks, automatic bypasses,lor re-instatement feat.ures are required.

iI* -' -J3The Technical Specificationstest requirements that demonindependence of tihe onsite ... .'"-3-wi].] be :evised as appropriate to includethe full functional. operab$iiy andpver sources at least one pwr 18 months.0I#"

Ct..,#.~-AITACI4MENT I..: :.

• Summary of the Analvsi;s !of Oconee Emercencv Pcwe r" Ost~ributlon SystemI. I NTROOUCT IONThe following analysissystem to determine ifincluding associated caffected by short ternThe evaluation has beeconditions (I.e., norndistribution system arvoltage condi tions.II. EViL UAT1!ONFigure 1 shows a one-~system which is the bthe distribution 2 are similar to UnitallI units.evaluates the Oconee emergency power distributionthe operability of safety-related equipment,ontrol circuitry and instrumentation is adverselyor long term degradation in grid system voltage.n.directed toward identifying all possible voltagea,1 and degraded) that can exist on the plant_.d comparing equipment operating limits to theseIne diagram of the Oconee Unit 3 distributionsis of our analysis of voltage profiles through-outm. Since the distribution systems for Units I and3, the results of this analysis are applicable to0C3In performing the ana ysis on the Oconee system, the limitations of thesafety-related equlpm,=nt, including associated control circuitry andinstrumentation; were lefined tO establish the voltage range over whichthe components could ,perate continuously in the performance of theirdesign function. The~e continuous operating voltage ranges are:ComoonentMotorsM 0 ValvesS Voltage1, .Rating'fO00 V575 V200 VLimiting 'Joltaae Rance(+1O%) 44OO/3600v(+/-0)22o/.l8ov575 VIi 200 V (j10%) Motor Controlles 600 V 51O'1208 V (a85%) I77'iThe voltage ranges defined for motor continuous operation are the restrictive operating~ conditions and, therefore, establish the boundsof continuous system pperation.. ..This.analysis adresse s the condition when the normal auxiliary loadsare being supplied byj 9ffsite power from Duke's 230 kV system. Thesenormal auxiliary loads are supplied from the offsite power systemduring refueling1 plant startup, plant shutdown, and abnormal trip"-of the unit. During accident conditions the offsite sour:e is t~.epreferred source to s~upply the required safety loads also. Thissource of supply in e~ither normal or accident conditions it avaiiablethrough startup transformer CT3 which supplies the 4.16 1V distrt~utionbuses.

the grid system is below the nominal 230 kV system voltage, startuptransformer CT3 Is set~ on the 218, 500 volt tap In order to optimizevoltage profiles throughout the auxiliary sy'stem. All load center* transformers as shown In Figure 1 are set on nominal taps. In order* to determine the voltage profiles at the safety-related buses for full-load and no-load condiltions and the range of normal grid voltagesdefined above, computyr studies were run for the following twoo cases:Case1: iththe voltage assumed operating at 227 kV and theauilary system undewi minimum loading conditions, the voltage profiles* for 'the safety-relate4 buses were calculated. This :ase provides thei highest expected volt~ges of 4252/613/212VI on the 'safety-reiated.buses -for the highest operating grid voltage. It should be noted thatsince a no load condi ion does not practically exist on the auxiliarysystem~the condition of minimum loading during cold shutdown has beenused instead. Figure 2. summarlzes the results of this case.Cae2 With the voltage assumed operating at 217 kV and-the-- auxiliary system under maximum loading (i.e., full, load) conditions,the voltage profiles the safety-related buses w~ere calculated.I'? This case provides th¶ lowest expected voltages of 9V onO ~the safety-related buses for the lowestc normal operating grid voltage.Figure 2. summarizes the results of this case.For all other possblbl auxiliary system loading conditions with the230 kY grid system operating between 227 kV and 217 kV), the voltageprofiles for the safety-related buses wi;ll 'be within the ranse.established by Case l and Case 2 defined above.Under normal conditions the Oconee Unit 3 auxiliary loads are carried~by the Unit 3 generatpr through unit auxiliary transformer 3T as sho~nin Figure 1. The normal operating range for the generator ter~iinalvoltage Is 18.94 kV to 17.68 kV. In analyzing the voltage profilesat the safety-related1 buses, computer studies were run for normalgenerator operating vpltages (i.e., Cases 3 and 4) as defined aboveand for degraded condtitionls (i.e., Cases 5 and 6) requiring generatorI trip. The case studies are as follows:'Case : With the senerator voltage at its normal maximum vaIue orkV and the aux?1liary system under minimum loading conditions: ~corresponding to the (condition of the unit tied to the transmission' system and under load,, the voltage profiles for the buses were determined. This provides the highest expected 'volcaces* of 4397/633/219V on the safety-related buses for the highest nor-.al: generator operating yoltage. Figure 3.summarlzes the results of thiscase.Case 4: Wilth the generator voltage at its normal minimum value ¢17.68 1V and the auximliary system under maximum loadir~g conditi~rs,* ~the voltage profiles for the safety-related buses "This provides the lov1est expected voltages of 3978/573/198V on t~e* safety-related buses for the lowest normal generator operaeing .'o!tage.* Figure 3 summarizes results of this case.

"1Case : 5 ' Wih genei~ator voltage assumed at" the overvoltagesetpoint of 19.91 kV requiring generator trip and the auxiliary,' system under minimum lgading conditions corresponding to theUnit tied to the transqiisslon system and under load1 the voltageprofiles for the safety-related buses were determined. This providesthe highest possible operatlng voltages of Lt.26/667/23OV on the safety-related buses witth theigenerator voltage at the overvoltage setpoint ofthe Volts/Hertz protective relaying. Figure L, summ~arizes the resultsof this case.Case__._6: With the 230 kV transmission system operating at its normalminimum value of 217 kV and with the generator assun-ed operating in adegraded loading condition (i.e., under-excited condition) correspondingto the loss-of-excitation relay setpoint, the voltage profiles (i.e.,3952/569/19711) for the1 buses were determined. Figure 4suuuarizes the results: of this.III. CONCLUSIONSI.'" All pert~inent combinatlions of operating conditions evaluated forthe Oconee auxili ary system, and was determined that il safety-rellated loads, including associated control circuitry and instrumentation,will perform their saf~ety functions as required.-. To ensure that the ope~rability of system components is not adverselyaffected by short or long tern degradation in system grid voltage,othe undervoltage relays that monitor the offsite power system are Letat 88% (3660V). This ;ensures that an acceptable-voltage level required~for continuous operatljon of non-safety, and safety-related equipnent will"" %- exist. The time delay inherent in these relays will el iminate spurious*trips and ensure that idegraded undervoltages are detected and clearedbefore they can adversely affect safety-related loads.o "Figure 5 shows the results of Case 7 which provides the voltage profi.lesS o on the safetyi-related ibuses under degraded offsite power conditionscorresponding .to the mndervoltage relay setpoint of 88%/ (3660V).This Case that voltages below the continuous operatingi ~limits of the safety-irelated loads cannot exist without :ausing a( ~Separation from the cond (tion.I -.

f~ 0034601933EU ~I4ny ~usI..SQ I4Ift~L'W.VC1,I .U.V(U,'lS.'S. *~*I S-I--.-4. 5. I/UIL ..114. 854.eI-.SJ"!*IIfl*' t.J AW455li 1.55;. -lI.

.................. ....... ......................2,-.,0/L.230 KVSWYDa/.6v BUS , (" rAP: 41C, ov TAP 400oV1"K (Vk- LOAD-I"IAP=21B.s I(CT 3VOLT.z h3lW-CASE 1I0.9870.944-Pu..-1.IOILos8I.oz22VOLT.£33ulI 'PU. VOLT.-1.IO 22q, -lO~q2201.021 l-I.O ZoS-P4.-l.0217 KV2o1KV--5.OO,.91540 Q13., .CASF. £ IWO O .IIL5 5158 o4~,3,. ItBoIll) li: , 'I i~dlh, Lhttd II ilim Ipl*51e1ulll I Lhi bt)IIIJb 4)1: c(il~lt iiuot*l.. equ ljNH4.IL Opld1,,l i (lie.0.9i0-0.90 4I~.IUV&.1a.1 KVILI .- IYIN Cq0 6 V jv 9I-.fLIMItT BN.(O9 VLOAD(CI(bkN RATINCG59 KVTAI~ 3- -lIm.-- L 0Ap': 1IliOV31-VOLT.I't. 9IKV1%.l K'II1".(,S KYI'll.VOLT. pt4.VOLT. PU.VOL1l PU.45"Ib L.ICASE 3133J1.10I.505.046 -'4loo 2,'0-I --.-- ---- -'13tJ. I .oS753 .O5'4a. 1 )-I.00 --0.')17'-.0uOO -I- i.O2,i)i -~- 1.0$730.955IJ) O.'j'a.f_ ,qo144, -"-

• t3W0~xO.BG5581 -Sil~ohie O.lfl5IIR'OLIE~:. lheit di Lead Ii i .tc r Ili+/-sei taL LIhe l)oundih of t*uint Iaieu~ up. .gawl~ si,,u ,m~i5..it Lio.VIGWi(E 3 -C SE 3 A!ND I'ViiiL.:IJL Prol~lles on Sdfiety"RelL.tud I~l~UICL. r ~iorhutSI sili I: i 3owLur coidi I Liu 0 I1~.IK'~JI-I YAP-Ai6OV Ll9) :[,AJl20snVo18 V.i.)'ADLoADSEN. RAT'IN&Il IKvTAP-- -1 7. 45 jLv "3V4c)9(OVVOLT.1t991 gv18.IKv.17.5 KVIPU.VOLT.PU. """ VOLT. PU. 45"/6 "CASE 5 4'400[.b7I I.III230iu. IO71.10O-.o104- 4-1.10'4)4)0 +/-I.I01,OS.633 2 e0.Io,014)0o l.O1.bOO1.0I.O0.94)9:5'J5~~CASt~ 60.9-I'I 'ii.0.')3"IqQ 0.9.iq 0.9113~ I-. 0.9S.Q S3600 JOdI4)5'19J .8'9.84)5NOTE; Thi' dot ted l i'dpI t+/-segtL Ehe bouncl 5J c4 orLi nuoais L'dtujInaip,,pn , mtL-4[Iuf,.F I(GUItE Iitluju Profi leIttiitdk r dwj~idonidd-CASIE 5ANQ6ftllll L *1dl IL Iolns MAIN FE[bER EIMIII4"3O/")I/4bKY', 0 °u 4 KVSVJIY)LIHiITING.I- "AP: 41(,oY!,-~ LOAD"T-APL6)oovCI3-l45*l/.I.10 _ _ ,bO i. i~i __ __ __ __ _ ___.lO__4400 1I.Obi 1I13 jt.054 ~ ZO 1.058ks3OKV J.O1.41W,-1,01.0o .II.O1.0z.o'/)vv0.91114 i3L3L3L00LA~d /0..i0 5400.117l 524-----,0.900.wi.pIUl0.90o.1371oo. 13iLIfs I'I .-I~'NOtf "l *hu duit ttd IlIu itl e~pr.ecILt 1hu of contlIn~u.u £UUI i p..ILE1t IIEt lIoi'.ll-FIGUIJIE !' -CASFI /I ,.1V.)IdUuaj Prufi l-si ()fl 5salty-ltaultud IkueSutllldI4l" de(JIcldtui 1) tlfsi Ie Id,LbW-r Ct)Id i l .eu. ol' p0l d l IO llJ 10Lo ildeL'vu I .90 L'I Ii REGULA TORY COMMISSION,** , 1978Dockets Nos.: 50-269ad50-270nd50-287Mr. William 0. Parker, Jr.Vice President -Steam ProductionDuke Power Company422 South Church StreetCharlotte, North Carolina 28242

Dear Mr. Parker:

-- By our letter dated June 3, 1977, we requested you to assess thesusceptibility of the Class IE safety related electrical equipmentto: (1) sustained degradation voltage conditions at the offsltepower supply and (2) interaction between the offsite and onsiteemergency power systems. By letters dated July 21, 1977 and October 7,-1977, you submitted the detail design of the Oconee Nuclear Station'semergency power systems.The Oconee Nuclear Station originally had an undervoltage protectiondesign to protect the Class XE equipment from a loss of voltage or asustained degradation of grid voltage on the emergency buses. Theprotection system includes undervoltage relays with inverse timecharacteristics which have a trip setpoint set at 88% of the rated busvoltage, i~e., 4160 volts and with a five second time delay. ThisSundervoltage protection design provides for two out of three coincidentlogic, monitoring the offsite power voltage on each 4160 volt bus. Theundervoltage protection will initiate separation of the onsite emergency.. buses from the offsite power systems iluediately upon complete loss ofoffsite power or at a time delay depending on the extent of the degradedvoltage condition below 88% of nominal voltage. The lower the voltagethe faster the trip.For the conditions when the emergency buses must be separated from theoffsite power systems due to a degraded voltage condition, the emergencybuses are supplied power from the Keowee Hydro The two 87.5MVA hydroelectric generating units, power transmission systems (overheadand underground), and the transformers and circuits have adequate capa-* bilities to serve the emergency buses with an acceptable voltage and.therefore, no load shedding nor sequencing of the emergency loads arerequired,.......0000LN781220AB68 i .UMr. William 0. Parker, Jr.-2-In addition, we have determined through discussions with your staffthat you have performed an acceptable voltage drop calculation of the4160 volt and the 600 volt buses of the onsite system. As a resultof your analysis, the transient (inrush) voltages were calculated tobe 89% of the rated voltage on the 4160 volt bus and 82% of the ratedvoltage on the 600 volt bus. This voltage calculation was based onthe assumptions of automatic transfer of plant loads from the unit auxil-iary transformer to the start-up transformer or to the Keowee Hydrounits and with the worst case of allowable combination loading. Thevoltage levels are adequate for starting all the engineered safetyfeature (ESF) loads when being started from either the start-uptransformer or the Keowee ilydro units.We have completed our review of the existing system design and have* determined that the design affords adequate protection against degradedgrid undervoltage conditions in accordance with the NRC letter of... June 3, 1977, and is therefore acceptable.~Sincerely,-cc: See next pageRobert WV. Reid, ChiefOperating Reactors Branch #4Division of Operating Reactors D1:KE POWsa C~OMPAN',Y,Oztober 7 , .97Mr. .do 3. =ae c.ngDr~~: .:ie ,': ".;.tz.ear .e :.. e u. z.n.C, C. '555 /"Mr. A. S,:hwenzer. Thte.;-.: "* ne .',ic~et" .:a:3r.i0Ceir Mr. 'as?:= e~r: u: 1 .* :" .~ d ha the -ks o: t-he ,'Th-nee emergencycwer ;7.Atem his and ;r.o:ec-.ive ec'2a&;en: te thosereee in t.he stat:fsf ~ ninyu 7et-eo. ,~ .9 1r.Ad oa~ .,t *4 .1- _. ::.qes.ted a :rnosed amendment. to In-zor.rorate "ecn.+/-n:al 5vecLfi-:t%r;'. :'cmpaa.'bi to those in the staff ?ostt'on A.. .... i, ad ursan22.9').. o:'4xs'ei.e fi:nd, attzached a :.-oocsed a-endment to The "Thonee;.r:clear :att/..'- -zln' :a:l:73e.a:In; License. T'his change re-rises secttcns:n tiiar' e;:rt.-:ai and -iner~ernc', ?:wer ?eriodt- Te'.n".e:.'n::a1 Sc:e-ift:::;:.s.L "t i.n.,:"des tie :ondi'torns for ..:erarti~nmni :-'e requirene.n:s 5cr t-he s.-arzuom s.ucue ",co:a~e mcnitors,ibriz -itth a ncdtifcaticn t.e zn-size tower source zest.in; recuiraenents.M:case %zte that ".he attachec-" :;-zs have been re':tsed to Incude the .-han.nesthat tad been 7:r-vtzus>:? .u:umie:e as C .-rozesed am-.end-ent in ,-- :.etter -f'aA~t "ac.n~en :100777B109 3.73.7 AL'XILIARY ELECTRICAL AppI icabilltvApplit.- to the availability of ofU-qite and en-site electrical power forstation operation and for operation of station auxiliaries.CbjItte.To define thcse conditie..s of electrical pewer availability necessary toprovide for safe reactor operation and to provide for continuing availabilityof enigineered safety features systems in an unrestricted manner and to pre-scribe safety evaluation and reporting requirements to be followed in theevent that the auxiliary electric power systems become degraded.3.7.1 Except as per'nit:el. by 3.7.2, 3.7.3, 3.7.4, 3.7.5, 3.7.6, and3.7.7, the reactor shall not be heated above 2000F unless thefollowing conditions are met.(a) At least two 230kV transmission lines, on separate towers,shall be in service.(b) Two startun transformers shall be operable and available tothe unit's 4160 volt .Main Feeder Buses No.. I and No. 2.(c) One operable Keowee hydro unit shall be available to supplypower through the Underground Feeder Bus, Transformer CT4 andthe 41L0 volt Standby Buses No. 1 and No. 2 to the units416,0 volt Main Feeder 3uses No. 1 and 2. The second Keoweehydro unit shall be available to supply power automaticallythrough .1 startup transformer to the units 4160 volt MainFee~er Buses No. I and 2.('I) The two volt main feeder buses shall be energized.(en The three A160 volt Engineered Safety Features switchgearbuses shall be energized.(f) Three 600 volt load centers plus the three 60') volt-2OSVEngineered 5-ifety Features MCC Buses shall be energized.(g) For each unit, all 125 VflC instrumentation and controlbatteries with their respective chargers, buses, diode moni~tors,and diodes supplying the unit's vital instrtwnentat£on and thefour instrum~entation and control panel boards shall be operable.(h) The 125 VDC svitching station batteries with their respectivechargers, buses, and isolating diodes shall be operable.3.7-12911190o~

(I) The Keowee batteries with their respective chargers, buses andisolating diodes shall be operable.(i) The level of the K~owee Reservoir shall be at least 775 feetabove sea level.(k) For each unit, three start-up source voltage monitoring channelsshall be operable.3.7.2 During hot standby or power operation, provisions of-3.7.1 may bemodified to allow any one of the following conditions to exist:(a) One of the two required startup transformers may be removedfrom service for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> provided it is expected to be restoredto service ,"ithin 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> and the other required startup trans-former is available for automatic connection to the unit's mainfeeder bus.(b) One Keowee hydro unit may be inoperable for periods not ex-ceeding 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for test or maintenance provided the operableKoewee hydro unit 19 connected to the underground feedercircuit and is verified operable within one hour of the lossand every eig~ht hours thereafter.(c) The undergro~und fecler circuit ma:: be inoperable for periodsnot exceeding 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> far test and maintenance.(d) In each unit, the following items may be inoperable fornot 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s:'. he 4160O volt main feeder bus.2. On~e :omplete single string of any unit's Enginee~red Safety4160 volt switchgear bus, 60'1 volt load center -MOC and their loads.string of anw; unit's 125 VDC Instru-mentation and control batteries, char~ers, buses, and allassocIated isolating and transfer diodes.,.One 125 instrumentation and control panel board and/orfts assocIated loads.(e) One complete singLe string of the 125 VDC switching stationbatteries, buses, chargers, and the related diode assembliesma: be de-encrgtzed for test or maintenance for periods notexceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.(f) %ne ccmplete single string of the Keowee batteries, chargers,buses, and diodes may be de-energlzed for test orfor periods not exceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3. 7-2 (g) One 4160 volt standby bus may be inoperable for test: ofmaintenance for periods not exceeding 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.3 In the event that the conditions of Specification 3.7.1 are notmet within the time specified in Specification 3.7.2, except asnoted below in Specfifcation 3.7.4, 3.7.5, 3.7.6, and 3.7.7 thereactor shall be placed in a hot: shutdown condition within 12hours. If these requirements are not net: within an additional48 hours, the reactor shall be placed in the cold shutdown condi-tion within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.4 In the event that all conditions in Specification 3.7.1 are metexcept that one of the two Keowee hydro units is expected to beunavailable for longer than the test or maintenance period of 72hours, the reactor may be heated above 20° if previously shutdownor be per-ritted to remain critical or be restarted provided thefollowing restrictions are observed.(a) Prior to heating the reactor above 200°F or prior to the* restart of a shutdown reactor or within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of theLoss of one Keowee hydro unit, the 4160 volt: standby busesshall be energized by a Lee gas turbine through the 100 kVcircuit. The Lee gas turbine and 100 kV transmissioncircuit shall be electrically separate from the system gridand non-safety-related loads.(b) The remaining Keowee hydro unit: s~hall be connected to theunderground feeder circuit and this path shall be verifiedoperable~ within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and weekly thereafter.(c) The remaining Keowee hydro unit shall be available to theoverhead transmission circuit but generation to the systemgrid shall be prohibited except for peziods of test.(d) Operation in this node is restricted to periods not to exceed45 days and the provisions of this specification nay beutilized without prior NRC approval only once in three yearsfbr each Keovee hydro unit. Office of Inspection and En-:orcement, Region II, will he notified within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.3.7.5 In the e~vent that all conditions of Specification 3.7.1 are netexcept that all 230 kV transmission lines are lost, the reactorshall be permitted to remain critical or be restarted providedthe following restrictions are observed:[a) Prior to the restart of a shutdown reactor or within 1 hourof losing all 220 kV transmission lines for an operatingreactor, the 4160 volt standby buses shall be energized byone of the Lee gas turbines through the 100 kV transmission~circuit. The Lee gas t~urbine and the 100 kV transmis~ioncircuit shall be completely separate from the system grid andnon-safety-related loads.3.7-3 (b) The reactor coolant Taw shall be above 525°0F. Reactorcoolant Rump power may used to elevate the temperaturefrom 500v to 525 F in the case of restart. if T de-creases below 500°F, restart is not permitted 3,7,6 In the event that all conditions of Specification 3.7.1 are met,and planned tests or maintenance is required which will make bothKeowee units unavailable, the 4160 volt standby buses shall firstbe energized by a Lee gas turbine through. the 100 kV transmissioncircuit and shall be separate frcm the system grid and non-safety-related loads. The reactor shall then be permitted to remaincritical for periods not to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with both Keowee unitsunavailable.3.7.7 In the event that all conditions of Specification 3,7.1 are metexcept that both Keowee hydra units become unavailable for un-planned reasons, the reactor shall be per-nitted to remain criticalfor periods not to exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the 4160 volt standbybuses are energized within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> by tee gas turbine through the100 kV transnission circuit and it shall be separate from thesystem grid and all offsite non safety-related loads.3.7.8 An', degradation beyond Specification 3.7.2, 3.7.4, 3.7.5, 3.7.6or 3.7.7 above shall be reported to the Office of Inspection andEnforceioent, Region Ii, within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. A safety evaluationshall be performed by Duke Power Company for the specific sftua-tion involved which Justifies the safest course of action to betaken. The results of this evaluation together with plans forthe return to che unrestricted operating conditionsof Specification 3.7.1 above shall be submitted in a writtenreport to the Office of Nuclear Reactor Regulation with a copyto the Office of Inspection and Enforcement, Region II, withinfive days.3,7.9 In the event that one channel of the unit's startup source voltagemonitoring becomes inoperable, the reactor shall be permitted toremain critical or be restarted provided the inoperable channel isplaced in the tripped condition within one hour.BaseThe auxiliary electrical power systems are designed to supply the requiredEngineered Safeguards loads in one unit and safe shutdown loads of the othertwo units and are so arranged that no single contingency can inactivate enoughengineered safety features to jeopardize plant safety. These systems weredesigned to meet the following criteria:"Alternate power systems shall be provided and designed withadequate independency, redundancy, capacity and testabilityto permit the functions required of the engineered safetyfeatures of each unit."3.7-4 The auxiliary power system meets the above criteria and the intent of AECCriterion 17. The adequacies of the AC and DC systems are discussed belowas are the bases for permitting degraded conditions for AC peer.Capacty~fAC SystemsThe auxiliaries of two units in hot shutdown (6.0MJa each) plus the auxiliariesactivated by ESC signal in the other unit (4.8 MVa) require a total. AC powercapacity of 16.8 M.'a. The continuous AC power capacity available from theon-site power systems (K~eowee Hydro Units) is 20 M%'a (limited by transformerCT4) if furnished by the underground circuit or 30 MVa (limited by CTI. or CT2)if furnished through the 230 kV off-site transmission lines. Capacityavailable from the backup 100 kV off-site transmission line (Lee Station GasTurbine Generator) is 20 M%'a (lim~ted by CT5).Thus, the minimum available capacity from any one of the multiple sources ofAG power, 20 MVa, is adequate.The startup source voltage monitors automatically initiate the disconnectionof the offsite power sources from the safety-related buses upon either asustained degradation of the offsite power system voltage or a complete lossof offslte power.Capaicity: of DC SystemsNcr-mallv, for each unit AC power is rectified and supplies the DC systembuses as well as keeping the storage batteries on these buses in a chargedstate. Upon loss of this normal AC source of power, each unit's DC auxiliarysystems important to reactor safety have adequate stored capacity (ampere-hours) to independently supply their required emergency loads for at leastone hour. One hour is considered to be conservative since there are redundantof AC pcwer providing energy to these DC auxiliary systems. The lossuC ill. AC pcwer t.o any DC system is expected to occur very infrequently, andfo~r very short periods of tine. The following tabulation demonstrates themria.1n of installed battery charger rating and battery capacity when compared.o one hour of operation (a) with AC power (in amps) and (b) without AC power'Li am~pere hours) for each of the three safety-related D)C systems installedA. 125 'VDC Instrumentation and Control Power SystemChar~er XCA, XCB, or XCS a. 600 amps each3attery ICA and 1CB Combined Capacity b. 698 ampere-hoursaX 1 , 2, or 3)Actual active loads on beth 125 %'DC a. First mmn. -1371 ampsI & C buses XDCA and X(DCB next 59 rai. -568.3 ampsduring 1st hour of LOCA b, 581.9 ampere-hours(X 1 , 2, or 3)S. 125 VDC Switching Station Power SystemCharger SY{-l, SY-2, or SY-s ,Rating a. 50 amps eachBattery SY-l or SY-2 Capacity b. 14.4 ampere-hours3.7-5

-nww~~~ -Actual active load per battery a. First min. -130 ampsduring 1st hour of LOCA next 59 mmn. -10 ampsb. 12 ampere-hoursC. 125 VDC Keowee Station Power Syste~mCharger No. 1, No. 2 or Standby Rating a. 200 amps eachBattery No. 1 or No. 2 Capacity b. 233 ampere-hoursActual active load per battery a. First mmn. -1031 ampsduring 1st hour of LOCA next 59 min. -179.4 ampsb. 193.6 ampere-hoursRedundancy of AC SystemsThere are three 4160 engineered safety feature switchgear buses per unit.Each bus can receive power from either of the t-#o 4160 main feeder buses perunit. Each feeder bus in turn can receive power from the 230 kY switchyardthrough the startup transformers, through the unit auxiliary, transformer bybackfeeding through the main transformer, or from the 4160V standbybus. Another unit's startup transformer serving as an alternate supply canbe placed in service in one hour. The standby bus can receive power from Hy.dro Station through the underground feeder circuit or from a combustionturbine generator at the Lee Steam Station over an isolated 100 kV trans-mission line. The 230 kV swvitchyard can receive power from the on-siteKeowee Hydro station or from several off-site sources via transmission lineswhich connect the Oconee Station with the Duke Power system'power distributionnetwork.Redundancy of DC SystemsA. 125 V.DC Instrument and Control Power SystemAll reactor protection and engineered safety features loads on thissystem can be powered from either the Unit l and Unit 2 or Unit 2 andUnit 3 or Unit 3 and Unit 1 125 VDC Instrument and Control Pc'wer Buses.The units' 125 VDC Instru~ment and Control. Power Buses can be powered fromtwo ba-ttery banks and three battery chargers. As shown above, one battery(e.g., iCA) can supply all loac~s for one hour. Also, one battery, chargercan supply all connected ESF anl reactor protection loads.3. 125 VflC Switching Station Powe~r SystemThere are two essentially indepe'ident subs::stems each complete with anAC/DC power supply (battery charger), battery bank, a battery chargerbus, motor control center (dltr~ibutz. panel). All safet',-relatedequipment and the relay house in Which it is located are Class I (seismic)design. Each subsystem prov'des the neztessary DC pcwer to:a. Continuously monitor operations of the protective relaying.b. Isolate Oconee (including from all externa: 230 kV cridfaults,3.7-6

c. Connect an-site power to Oconee from a Ke'owee hydra unit or,d. Restore off-site power to Oconee from non-faulted portions of theexternal 2)0 kV grid.Provisions are included to manually connect a standby battery charger toeither battery/charger bus.C. 125 VDCKeowee Station Power SystemThere are essentially two independent physically separated Class I(seismic) subsystems, each complete with an AC/DC power supply (charger)a battery, bank, a battery/charger bus and a DC distribution center. Eachsubsystem provides the necessary power to automatically or manually Start,control and protect one of the hydrounits.An. open or short in any one battery, charger of DC distribution center,cannot cause loss of both hydro units.The 230 KV sources, while expected to have excellent availability, are notunder the. direct control of .the Oconee station and, based on past experience,cannot belassumed to be available at all tines,. However, the operation of*the on-site hydro-station is under the direct control-of the Oconee Station.and reqixtres no off-site power to startup. Therefore, an on-site backup sourceof auxiliary power is provided in the form of twin hydro-electric turbinegenerators powered through a common penstock by water taken from Lake Keowee.The use of a common penstock is justified on the basis of past hydro plantexperience of the Duke Power Company (since 1919) which indicates that thecumulative need to dL'water the penstock can be expected to be ifmited to aboutone day a year, principally for inspection, plus perhaps four days every, tenth* a r.Operation with one Keowee Hydra unit out of service for periods less than 72hours is permnitted .The operability of the remaining Keowee hydra unit isverified within one hour by starting the unit and energizing the standby busesthrough the underground feeder circuit. This action is repeated once everyei,~ht hours thereafter until the Keowee hydra unit is restored to service andwill provide additional assurance of the operability of the remaining unit.Pr.wvisions have been established far those in Which long termpre2ventative maintenance or a Keowee Hycro unit ar necessary. The long tern maintenance items are expected to be hydro turbine runner and dis-charge ring welding repairs which are estimated to be necessary every six toeight years.. Also, generator thrust and guide bearing replacements will benecessary. Other items which manifest as failures are expected to be exJtremely rare and could possibly be performed durinR the permitted .maintenanceperiods. Tine periods of up to 45 days for each Keowee Hydra unit are permittedevery: three years. During these outages the remaining Keowee Hydro unit willbe verified to. be operable within one hour and weekly thereafter by starrinethe umnit and energizirng the underground feeder cftcuit. The remaining Keoweehydro unit Will also be available through the overhead transmission path andwill not be used for system peaking. Additionally, the standby buses will beenergized continuously by one of the Lee gas turbines through the 100 kY trans-mission circuits3. 7-?

This transmission circuit would be electrically separated tram the systemgrid and all off-site non-safety-related loads. This arrangement providesa high degree of reliability, for the. emergency power systems.Operation with both Keowee Hydro units out of service is perm~itted for plannedor unplanned outages for periods of 72 or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> respectively. Planned outagesare necessary for the inspection of conmmon underwater areas such as the penstockand to enable the removal of one Keowee unit from service. This would be acontrolled evolution in which the availability and condition of the off-siteRrid, startup transformers and weather would be evaluated and a Lee gas turbinewould be placed in operation on the isolated 100 kV transmission line prior toco~encemicnt of the outage.A trn.' period of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for unplanned outages of both Keowee units is accept-all since a Lee gas turbine will be started within one hour and will energizethe standby buses through the dedicated 100 kV transmission line. This periodof time Is reasonable to determine and rectify the situation which caused theloss of both Keowee units.In the event that none of the sources of off-site power are aval~able and it isconsidered important'to continue to maintain an Oconee reactor critical or re-turn it to criticality from a hot shutdown condition, one of the Lee gas turbinescan be .made available as an additional backup source of power, thus assuringcenttnu'd availability as an auxiliary power to perform an orderly shutdown ofa unit should a problem develop requiring shutdown of both hydro units.3.7-8 4.6.6E.MERGENCY POWER PERIODIC TESTINGApplies to the periodic testing surveillance of the emergency power sources.OblectiveTo verify that the emergency power sources and equipment will respond promptlyand properly when required.Spec if£cait~on4.6.1 Monthly, a test of the Keowee Hydro units shall be performed to verifyproper operation of these emergency power sources and associated equip-ment. This test shall assure that:a. Each hydro unit can be automatically started from the Unit 1 and2 control room.b. Each hydro unit can be synchronized through the 230 kV overheadcircuit to the startup transformers.c. Each hydro unit can energize the 132.8 kV underground feeder.d. The 4.160 volt startup transformer main feeder bus breakers andstandby bus breaker shall be exercised.".6.2 Annually, the Keowee HIydro units shall be started using the emergencystart circuits in each control room to verify that each hydro unitand associated equipment will carry the equivalent of the ,maximumsafeguards load of one flconee unit within 25 seconds of a simulatedrequirementn for engineered safety features.&. .3 Monthly, the Keowee Underground Feeder Breaker Interlock shall beverified to be operable.4.6., Annua~l:, a simuhited emergency transfer of the 4160 volt main feederbuses to the startup transformer (CTI, CT2 or CT3) and to the-.16') volt standby buses, and a retransfer to the startup transformersshall be made to verify proper cperation.,.6.5 uarterly, the External Grkd Trouble Protection System logic shall betested to demonstrate its ability to provide an isolated power pathbetween Keowee and Oconee.Annually and prior to p'.anned extended Keowee outages, it shall bedemonst~rated that a Lee Station combustion turbine can be started andconnected to the 100 k';? llne. It shall be demonstrated that the 100kV line can be separated from the rest of the system and supply, po've2to. the 4160 volt amai feeder buses.*.6-1 4.6.7 Annually, it shall be demonstrated that a Lee station combustionturbine can be started and connected to the isolated 100 kV lineand carry the equivalent of the maximum safeguards load of oneOconee unit (4.8 XVA) within one hour.4.6.8 Annually, it shall be demonstrated that a Lee station combustionturbine can be started and carry the equivalent of the maximumsafeguards load of one Oconee unit plus the safe shutdown loadsof two Oconee units on the system grid.&.6.9 Batteries in the 125 'JDC systems shall be tested as follows:a. The voltage and temperature of a pilot cell in each bank shallbe measured and recorded five times per week for *the Instrumentand Control, Keowee Hydra, and Switching Station batteries.b. The specific grivity and voltage of each cell shall he measured~and recorded monthly for the Instrument and Control, Keowee*Hydro, and Switching Station batteries.c. Annually, a one-hour discharge test at the required maxinumsafeguards load shall be made on the instrument and controlbatterleq.d. Before initial operation and annually thereafter, a one-hourdischarge test shall b2 made on the Keowee lHydro and SwitchingStation batteries.&..[ The operability of the individual diode monitors in the Instrumentand Control and Keowee Station 125 VDC systems shall be verifiedmonthly by -imposing a simulated diode failure signal on the monitor.The peak inverse voltage capability of. each auctianeering diode inthe Instrument and Control, Switchyard and Keowee Wydro 125 VDCsystems shall be measured and recorded semiannua~llv.The tests specified in 4.6.9, 4.6.10, and 4.6.11 will be consideredsatisfactory if control room indication and/'or visual examinationdemonstrate that all components have operated properly.4.O).i1 Monthly, it shall be ed that each startup source voltagemonitoring channel is operable.tAnnually, the startup source monitors shall be calibratedto ensure that they ca:b r.i.~ite a trip of the startup sourcebreakers upon both a complete loss of voltage and a degradedvoltage condition.4.6-2 BasesThe Keowee Hydro units, in addition to serving as the emergency power sourcesfor the Oconee Nuclear Station, are power generating sources for the Dukesystem requirements. As power generating units, they are operated frequently,normally on a daily basis at loads equal to or greater than required byTable 8.5 of the FSAR for ESF bus loads. Normal as well, as emergency startupand operation of these units w~ill be frem the Oconee Unit 1 and 2 ControlRoom. The frequent starting and loading of these units to meet Duke systempower requirements assures the continuous availability for emergency powerbor the Oconee auxiliaries and engineered safety features equipment. It willbce verified that these units will carry the equipment of the maximum safeguardsload within 25 seconds, including instru~mentation lag, after a simulated re-quirement for engineered safety features. To further assure the reliabilityof these units as emergency power sources, they will be, as specified, testedfor automatic start on a monthly basis from the Oconee control room, Thesetests wili include verification that each unit can be synchro~nized to the230 kV bus and that each unit can energiae the 13.8 kV underground feeder.The interval specified for t esting of transfer to emergency power sources isbascd on maintaining maximum availability of redundant power sources.a Lee Station gas turbine, separation of the 100 kV line from therenjinder of the system, and charglng of the 'i160 volt main feeder buses areled to assure the continuity and operability of this equipment. The onehour tine limit is consi'Jpred the absolute maximum time limit that would berequilred to accomplish thiS.The source+/- volta~e monitors are provided to detect and initiate properaction for either a sustahned degradation of offsite power system voltage oricomplete loss of offsite power. Monthly these monitors will be functionallychecke'd and annuall'y they will be calibrated to ensure proper operation with-in the required trip settings.EF'3AR .ection 84.6-3.

il IDuhe Pouer Cmpany HALE TuckP0.Box 33198 Vice PresidentCharlotte, N C 28242 Nudeer Production(704)373.4531OllllO dlMay 8, 1990U. S. Nuclear Regulatory Commission --ATTN: Document Control DeskWashington, D.C. 20555

Subject:

Oconee Nuclear StationDocket Nos. 50-269, -270, -287Switchyard Degraded Voltage

Dear Sir:

On April 26, 1990, a conference call between members of my staff andmembers of the NRC staff. was held. The purpose of the call was to discussthe switchyard degraded voltage issue. During this phone call, the staffrequested that information regarding the proposed modification to resolvethe problems identified be submitted to them for their information. Tpthis end, a description of the modification is provided. En addition,simplified one line drawings to aid in the understanding of themodification are also provided.The initial concern was discovered as a result of the 230KV Design BasisDocumentation (DBD) effort. It was discovered that during a LOCA eventconcurrent with a 230KV switchyard voltage less than 219KV, the unit couldbe vulnerable to a single failure event, due to the relative setpoint ofthe undervoltage relaying of the startup source breakers and theundervoltage relaying of the switchyard isolate circuitry. This situationis fully described in LER 269/90-04 submitted April 30, 1990. This LERprovides detailed information regarding this event, the root cause, thecorrective actions taken and to be taken, the basis for continued safeoperation of the units, and an assessment of the safety consequences andimplications of the event. In addition, the LER also stated that anotheYconcern was identified. This new concern had identified the possibilitythat the E breakers could close when the 230KV switchyard voltage isdegraded (less than 219KV). This finding was also determined to bereportable. A separate LER on this problem will be submitted May 24,1990. Please note that the operability evaluation provided by LER269/90-04 is also applicable to the new concern identified.B4 O000LD900508A Document Control DeskMay 8, 1g90Page 2 -...As I stated earlier, to resolve the problems identified, a modification tothe plant was proposed. This modification is to install threeundervoltage relays to monitor the switchyard voltage on the line side ofeach of the three startup transformers. Each of the undervoltage relayswill be connected to one of three existing single phase spare potentialtransformers. These relays will, be connected in a two out threeconfiguration and timed to provide a permissive in each of the tworedundant switchyard isolate circuits through one of two redundant CutlerHawaer relays. This logic will provide inputs for alarms via the OperatorAid Computer, the Event Recorder, an annuniciator in the unit 1 and 2control room, an alarm in the Power System Control Area Operation Center,and would initiate switchyard isolate if an ES signal is present on any ofthe three units. This logic which is safety related, will be fed from theswitchyard 125VDC system.For your information, every effort is being made to implement thismodification in a timely manner° I currently anticipate that the abovemodification will be installed on afl three units by no later than July 1,1990. An outage of the units is not required to implement themodification. If further discussion is desired regarding this issue orthe modification, please don't hesitate to contact us through normallicensing channels.Very truly yours,Hal B. TuckerSYDVOLT / PEGxc: Mr S. D. Ebneter -Regional AdministratorU. S. Nuclear Regulatory CommissionRegion II101 Marietta St. NWAtlanta, GA 30323Mr. P. H. SkinnerNRC Resident InspectorOconee Nuclear StationMr. L. A. WiensOffice of Nuclear Reactor RegulationU. S. Nuclear Regulatory CommissionWashington, DC 20555 MODIFICATION DESCRIPTIONThe modification will install equipment that will provide an annuniciatoralarm in the Unit 1 and 2 control room, an alarm via the unit Operator AidComputer an alarm to the Power Systems Control Area Operation Center andan event recorder point and, if an ES signal occurs on any unit while thevoltage is at or below the setpoint, will automatically isolate theswitchyard by initiating the External Grid Trouble Protection (EGTPS)system. The new logic will ensure the overhead power path from Keoweeis available during an ES event, even if the switchyard voltage is below219KV. The modification will install several relays to accomplish thislogic.The EGTPS is designed to detect undervoltage or underfrequency conditionson both buses in the 230KV switchyard and to isolate the yellow bus, (andthus the Keowee overhead path), from the transmission system if theseconditions occur. To address the difference between the minimum analyzedvoltage for starting L.OCA loads and the voltage at which the EGTPS is.automatically initiated, the above modification was proposed.The voltage will be measured by existing potential transfornmers (PTs)..The failure modes of these PTs are in the safe direction. The safetyrelated voltage relay contacts used in the switchyard isolation logic willbe arranged in a 2 out of 3 (2/3) logic. The output of the 2/3 logic w~illbe connected to actuate two redundant safety related relays. If this 2/3logic is satisfied and an ES signal occurs on any of the three units, bothchannels of the EGTPS will be activated. If the EGTPS is actuated by afailure of this new logic, unit generation would not be interrupted sincethe EGTPS does not operate the unit tie breakers.The Engineered Safeguards Protective System (ESPS) is a three Channelredundant system employing 2/3 coincidence between measured variables.The ESPS consists of eight 2/3 coincidence logic networks for actuatingthe equipment in four safeguards systems, thus each system is actuated bya pair of 2/3 logic. Therefore a failure within one channel of the ESPSwill not result in an ES signal being provided to the 230KV SwitchyardDegraded Voltage Protection Circuitry (230KV SDVP). Further detailsregar'ding the ESPS at Oconee is provided by section 7.3.2 of the OconeePSAR. An inadvertent EGTPS actuation would allow the units to continue tooperate safely, since the generator output breakers would remain alignedto the system grid through the 230K(V Switchyard red bus (units 1 and 2) or525KV Switchyard (unit 3). In this condition, the units' auxiliaryelectrical power would continue to be supplied from auxiliary transformerlT, 2T, or 3T, respectively. An EGTPS actuation due to degraded gridvoltage and a concurrent ESPS signal would, allow the unaffected units tocontinue to operate in the manner just .described, while power to theaffected unit would be automatically available through:

a) standby buses if previously powered from the dedicated lineteoth Lee Ga Turbines,b) The 4160V standby buses from the underground on-site emergency powerpath from Keowee, orc) The overhead on-site emergency power path from Keowee.

IPRELiMI NARY4ESG 1BSG 2EBG 3U. V. TripRelay27CT18wyd. I;IIApIOM.co4 PT. 'LE. R.Iniatesvyd. isolationchrome1 2ESG 1 (ch lor2)tESG 2ESG 3' 9ePR ELMIAROconee Nuclear StationPreliminary Logic Diagram230KV Switchyard Degraded Voltage ProtectionNSN ON-52850Kay 4. 1990-.

S I,I'h.,,lef.r .N C' 2 Piucl'ru Pm )dij im nnDUKE DJWERJune IB, 1990Document Control DeskU. S. Nuclear Regulatory CommeissionWashington. D.C. 20555

Subject:

Oconee Nuclear StationDocket Nos. 50-269, -270, -287Switchyard Degraded Voltage

Dear* Sir:

By my letter of May 8, 1990. 1 had provided preliminary informationregarding a conceptual design of a proposed modification to resolveproblems concerning the 230KV switchyard that my staff recentlyidentified. On June 6, 1990, a conterence call between members of mystaff and members of the NRC staff was held. During the phone call, thestaff raised a concern about the impact of degraded voltage on safetyrelated equipment during normal plant operation. To address this concern,Please find attached a discussion of the impact that degraded voltage hason safety related equipment during normal plant operation.Thc resolution of the problems that we have identified through our DesignBasis Documentation effort is a high priority item at Duke Power. Theproposed modification to be implemented is moving forward. My. staff isdeveloping a revision to the technical specification, which will besubmitted in the near future. Your continued cooperation and assistancein resolving this issue is greatly appreciated.Very truly yours,Hal B. TuckervoltOllpfg* F'ji4061890Bl13 INFORMATIOtN CONCERNING GRID VOLTAGE ADlEQUACYThe N&E breakers utilize the Westinghouse CV-? relays forundervoltage detection. Relays associated with these breakersare set at 105V tap with 3 sec time delay at 84 volts andtolerance of +/- 3%. Based on this setting and considering thetolerance factor, this setting could effectively be as low as84.875% of the 4160V bus rating. These relays are inverse-timeinduction type relays.According to westinghouse type CV-7 relay published informationand at the present relay setting, these relays would trip inapproximately 6 seconds at 90% of relay setting. No informationis provided on time required for relay to trip while voltage isat relay setting value. relay curves attached (AttachmentU).Considering 84o875% cf bus voltage and normal unit loads running ananalysis was performed to determine voltage levels atsafety-related buses and load terminals.An evaluation of the impact of this voltage on safety-relatedunit equipment was performed utilizing existing power systemcalculations and using engineering judgement. A justification ofvoltage adequacy is summarized below:-4KV Motors:with 84.815% bus voltage the minimum voltage on asafety-related 4KV motor would be approximately 84.4% (4160Vbase) which is equivalent to 87.75% (motor base). Ananalysis was performed using Westinghouse information toexamine impact of continuously running the motors at 80%voltage on motor life. This analysis concluded that thiscondition would not have significant impact on motor life.Copy of analysis is attached. (Attachment 2)-Overcurrent protective relaying on 4KV Motors:Safety-related motor overcurrent relays are set for motorstarting. The adequacy of these settings were examined formotor starting at voltages significantly less than 84.87%.The current values associated with continuously running at84.87% are considerably below the overcurrent relaysettings.-Bus & Cable:These are current sensitive equipment. Lower voltage shouldnot have any impact on them. Current capacity of buses &cables are not exceeded.-600V &208V Contactors:84.875% of bus voltage should not impact contactor coils.see attached manufacturer test information. (Attachment 3)

-600/208VAC Motors:Based on an evaluation of the 600V RBCF motors andsimilarity to the 4KV motors, the 600/208V safety-relatedmotors which are normally running should not be impacted bythis condition.Overload Heaters:In safety-related applications, one overload heater is sizedproperly for the load but it only provides alarm indicationin the control room. Overload heaters capable of trippingthe motors are considerably oversized for the load and isprovided to protect the cable.Fuses associated with 600V & 208V Circuits:Generally, fuses are only provided to protect the controltransformers. Control transformers are sized significantlylarger than what is recommended by starter manufacturer.Control transformer and fuse current rating should not beexceeded due to lower voltage. Attachment 3 provides moreinformation on this.DC Equipment:The Battery Chargers are designed to provide rated output DCvoltage with input voltage as low as -15% of nominal voltage(575V). With 84.875% of 4KV bus voltage, the input voltageat the chargers would be approximately 82.5% (600V base) or86% (575V base).Based on that the DC system should be at rated voltage.(See attached manufacturer data sheet).AC Vital:Since the DC is at rated voltage this condition should nothave any impact on the AC vital bus.

Ipr .-" --* TYPE CV RELAYS~L4~I.L. d1.3')zP ~'IU2:2..2.2* .rS.... I344 3 t'+/-1atLL~.z+/-.+/-+/-~flL..uzhrJ.-_____________ .-406C883Fig. 16. T'yp6CuI 6O.Cycle #fine CV'V* S~of f~i tpe CV7 T~m. 0.e, o.d LUndetvo!Iage Relay,13

(, oO(~UNITED STATES "o NUCLEAR REGULATORY COMMISSIONWASHINGTON, D. C. 20555/14, 1990Docket Nos. 50-269, 50-27050-287 4#1Mr. H. B. Tucker, Vice PresidentNuclear Production DepartmentDuke Power CompanyP.O. Box 1007Charlotte, North Carolina 28201-1007

SUBJECT:

SAFETY EVALUATION FOR DEGRADED GRID PROTECTION(TACs 76743/76744/76745)Your Licensee Event Reports (LERs) 269/90-04 dated April 30, 1990,269/90-04 dated May 24, 1990, and 269/90-05 dated May 24, 1990, reportedsituations related to design deficiencies of the degraded grid protectionhardware and provided corrective actions. These deficiencies may leave thestation vulnerable to a single failure and/or render safety-related equipmentinoperable or damaged during a degraded voltage condition. However, your letterof May 8, 1990, described conceptually a new permanent degraded grid protectionmodification to be installed in the near future that would, to a great extent,resolve these design deficiencies. The NRC staff has completed a review of thesesubmittals. Enclosed is the related Safety Evaluation.The staff has concluded that the proposed modifications to the design wouldprovide additional Undervoltage protection. Also, in consideration of the*complexity of the plant's existing undervoltage protection system and theon-site electrical distribution system, the staff finds the proposed degradedgrid protection modification acceptable.Sincerely,.LoadA. Wiens, Project ManagerProject Directorate 11-3Division of Reactor Projects -I/IIOffice of Nuclear Reaction Regulation

Enclosure:

As statedcc w/enclosure: iSee next page .,-.i.NOV 20 7.,990DUKE FPOWER CO.REG__ULATOF-B12 O000LN9O1114A

.. .. UNITED STATES/) £{ ' NUCLEAR REGULATORY COMMISSIONSAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATIONRELATED TO DEGRADED GRID PROTECTIONDUKE POWER COMPANYOCONEE NUCLEAR STATION. UNITS 1. 2 AND '3DOCKET NOS. 50-269. 50-270 AND 50-28

71.0 INTRODUCTION

By Licensee Event Report (LER) 269/90-04 dated April 30, 1990, the licensee forOconee Nuclear Station reported a situation where one of the two required onsiteemergency electrical paths could be rendered inoperable during a degraded gridcondition leaving the station vulnerable to a single failure. Also in LER269/90-04 and LER 269/90-OS dated May 24, 1990, the licensee reported an additionalsituation where safety-related equipment could be subjected to low voltageswhich could render them inoperable or damaged during degraded grid conditions.The root causes for these conditions were determined to be design deficiencies.In a letter dated May 8, 1990. the licensee provided a description of theconceptual design for a degraded grid protection hardware modification Intendedas the permanent corrective action. Wie have reviewed the conceptual designand find it acceptable as discussed below.2.0 DISCUSSIONDuring normal operation, electrical power to each of the three Oconee units issupplied through Its corresponding auxiliary transformer and N breakers (seeattached figure). If a unit's normal path is unavailable, electrical power isthen supplied through the E breakers via the unit's startup transformer whichis fed from the 230 kV switchyard.On a loss-of-offsite power condition (230 kVY grid voltage below 160 kY)1undervoltage relays, which are part of the External Grid Trouble ProtectionSystem, start the onsite Keowee hydroelectric units and isolate the-230 kVswitchyard from the offsite electrical grid. Emergency electrical power isthen-available from Keowee to each unit through the underground feeder circuitvia transformer CT 4 and the SK breakers or through the overhead path via .the 230 kV switchyard and each unit's startup transformer and E breakers. For theoverhead path to be established through Keowee breakers, a "Switchyard IsolateComplete" signal must be generated when the necessary breakers in the 230 kVswitchyard isolate the switchyard from the offsite grid and align theswitchyard to the Keowee overhead path.For a degraded grid condition (230 kV grid voltage less than 211 kV)undervoltage relays (1 per phase with 2 out-of-three logic) on the secondaryside of each unit's auxiliary transformer open the unit's N breakers.Similarly, undervoltage relays on the secondary side of each unit's startuptransformer open the unit's E breakers. Upon opening of the N and E breakers,non-safety related undervoltage relays on each unit's 4 kV main feeder busessense a loss-of-voltage condition and start the Keowee hydroelectric units.Emergency power is available through the Keowee underground Path and, if thegrid voltage continues to decrease below 160 kV, through the Keowee overheadpath by the protective action of the External Grid Trouble Protection System.2.1 LER 269/90-04In LER 269190-04, the licensee reported a design deficiency in the degradedgrid protection circuitry. As can be seen from the above discussion, when thegrid voltage falls below 211 kV, emergency power is supplied to each unit viathe underground path from the Keowee hydroelectric station but the redundantKeowee overhead path for emergency power is not available until the gridvoltage falls below 160 kV. If the grid voltage should remain below 211 kVbut above 160 kV, only the single underground path is available leaving allthree Oconee units vulnerable to a single failure. During degraded gridconditions this could cause the inability of safety systems to mitigate theconsequences of a design basis accident/transient unless the operator tookaction to manually align switchyard breakers for the overhead path. 2.2 LER 269/90-04 AND LER 269/90-05In LER 269/90-04 and LER 269/90-05, the licensee reported an additional designdefect involving the inability of the degraded grid protection circuitry toprotect against electrical distribution system voltages falling below minimumvalues recommnended by equipment manufacturers and possibly causing equipmentinoperability and/or damage. Between 1979 and 1982, the licensee submittedvarious analyses and justification to support the selection of 219 kV as theundervoltage relay setpoint for degraded grid protection. The documentationsubmitted by the licensee established that with a grid voltage as low as 217kV, corresponding voltages at class IE equipment input terminals would besufficient to start and continuously operate the equipment within theirvoltage ratings for the worst case electrical System loading. With the actualsetpoint placed at 211 kV (or as low as 203 kV considering instrument errors),the class lE equipment performance and/or condition was questionable fordesign basis scenarios occurring with grid voltages degraded between 217 kVand 203 kV. In LER 269/90-05 the licensee stated that all post-trip equipmentexcept for post-LOCA 208 V MOVs (high and low pressure injection valves,building spray valves) would operate and that the reduction in 4 kY motor lifeis insignificant. Operator action would be necessary to restore adequate voltageto the valves or to manually operate the MOVs during the degraded grid condition.3.0 EVALUATIONFor inmiediate corrective action of the design deficiencies, the plantoperators will monitor the 230 kV switchyard voltage every two hours. If thevoltage drops below 225.2 kV, an attempt to increase the grid voltage will bemade, the Keowee underground path will be verified to be operable, electricalpower from the Lee gas turbines will be made available to the units' standbybuses, and Technical Specification 3.0 will be entered. If grid voltageremains degraded, the units will be in hot shutdown in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and coldshutdown within the next 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In a letter dated May 8, 1990, the licensee provided .a conceptual descriptionof the permanent hardware modification intended to eliminate the design defi-ciencies. New undervoltage relays with setpoints of 222.5kV will be installedutilizing existing potential transformers in one phase on the primary side ofeach unit's startup transformer. Two-out-of-three logic will be used togenerate an undervoltage signal. After a 9 second time delay this signal willthen generate alarms in the control rooms and, if an ES signal from any unit'sEngineered Safeguards Protective System exists, will then isolate the 230 kYswitchyard from the offsite 230 kV electrical grid.The guidance for the staff's review of the proposed modification is containedin Branch Technical Position (BTP) PSB.-1, "Adequacy of Station ElectricalDistribution System Voltages." The specific requirements of the BTP fordegraded grid undervoltage protection of Class 1E equipment and our evaluationof the proposed design modification against those requirements are as follows:1. Setpoints and time delays shall be determined from an analysis ofClass lE equipment voltage requirements.The licensee has selected a setpoint of 222.5 kV for the newundervoltage relays. This setpoint is based on the value 219 kY,which the staff previously approved, plus 1.6% to account forinstrumentation errors. The time delay for the downstream timershas been fixed at 9 seconds to allow for short-duration voltagetransients to occur without initiation of undervoltage alarms andequipment protective action.2. A short time delay shall be provided to allow motor startingtransients to occur. Following this delay, a control room alarmshould sound to alert the operator to the degraded grid condition.If a subsequent LOCA should occur, the onsite Class 1E electricaldistribution system should be separated immnediately from the offsiteelectrical grid. As stated above, the licensee has selected a 9 second time delaywhich should be adequate to allow for voltage transients duringmotor startup. After the 9 seconds have passed, a subsequentLOCA will result in immediate separation of the Class IEdistribution from the offsite grid.3. A longer time delay, of limited duration such that Class lE equipmentwill not be damaged, shall be provided to allow the operator toattempt to restore adequate voltages to the Class lE equipment.Following this delay, the Class LE distribution system should beseparated from the offsite electrical grid if adequate voltageis unavailable.The design modification has the 9 second fixed delay. Asecond, longer time delay has not been incorporated into thedesign. Also, the undervoltage condition in itself does notresult in the separation of the Class lE distribution system fromthe offsite grids, an ES (LOCA, NSLB) signal must exist coincidentallybefore undervoltage protective action occurs.In response to a staff question, the licensee stated, in a phoneconference call, that after a degraded grid alarm is received,steps will be taken to re-establish an adequate voltage level onthe grid. For a sustained degraded grid condition, analyses (seelicensee's letter dated June 18, 1990) related to LERs 269/90-04and 269/90-05 have been performed covering equipment and plantperformance down to the worst setpoint (203 kV) of the existingdegraded grid protection circuitry. This circuitry will remaininstalled and will provide automatic separatlon from the grid forscenarios without an ES signal and where voltages drop, to levelsnear where equipment/plant performance is unanalyzed.

L ---'-6-4. The voltage sensors of the undervoltage circuitry shall be Class 1Eand shall be located at and electrically connected to Class lEswi tchgea r.In response to a staff question, the licensee stated in a phone callthat all relays, timers, and auxiliary relays used in the newundervoltage scheme would be Class 1E. Although it is derived froma Class lE source, the 125 vdc control power will be non-Class 1Eutilizing components similar to Class 1E components. The non-ClasslE potential transformers (PTs) are also similar to Class 1E PTs andare seismically mounted.5. An independent undervoltage scheme shall be provided for each Class lEdivision.The new degraded grid protection circuitry is not divisionalized andis shared by all three Oconee units. This is consistent with theoverall design of the emergency electrical power system at Oconeewhich has two hydroelectric units shared by all three units with theoverhead path from Keowee having some couinon components with thepreferred offsite source. The overall design philosophy at Oconeeis to ensure that all the emergency 4 kV buses are fed from the samereliable source selected by a "good voltage" seeking, automatictransfer scheme.6. Coincident logic on a per bus basis shall be utilized.The proposed degraded grid protection circuitry utilizes 2-out-of-3coincident logic to preclude spurious trips. As stated above, thecircuitry and its logic are not divisionalized and are not on a perbus basis. The coincident logic is shared by all three Oconeeunits. 7. Test and calibration capability during power operation shall beprovided for the voltage sensors.aSince 2-out-of-3 coincident logic is utilized in the new design,it appears that the undervoltage sensors (PTs and relays) should betestable without interfering with normal operation.8. Bypass annunciation shall be provided in the control room.The staff's review of the proposed design modification indicatesthat bypasses are not used in the design.9. Technical specifications shall include limiting conditions foroperation, surveillance requirements, and trip setpoints and allowablevalues for undervoltage relays and time delay devices.In response to a staff question, the licensee stated that technicalspecifications will be proposed but setpoints and time delays willnot be specifically identified.

4.0 CONCLUSION

From the discussion above, it can be concluded that the licensee's proposedmodification does not fully meet BTP PSB-1 in several areas. Requirementssimilar to those contained in the BTP were generically applied to every plant(circa 1978). In the northeastern part of the country, low grid qualitynecessitated the staff to back away somewhat from the BTP requirements,particularly for the requirement to automatically separate the onsite Class IEelectrical distribution system from the degraded grid. For the northeast plants,the staffmpermitted the use of alarms, procedures and manual operator actions,in lieu of automatic action, to ensure that the safety-related components ofthe Class 1E systems would not be adversely affected during low voltage conditions.This compromise to the requirements of the BTP was granted due to the knownweakness of the New England grid whereby the forced shutdown of one nuclear plantcould lead to shutdown of other plants in a cascading manner. For Oconee, the proposed modification will add another layer of undervoltageprotection to the existing, degraded grid protection circuitry. Due to thecomplexity of the plant's existing undervoltage protection scheme and the onsiteelectrical distribution system coupled with the speculation that the quality ofthe grid servicing the Oconee site may have similar weaknesses to what exists inthe Northeast, we conclude that-it is not prudent to impose the completerequirements of the BTP. Therefore, we find that the licensee's proposeddegraded grid protection modification (excluding Technical Specification changeswhich will be evaluated In a separate SE) is acceptable.

IOCONEE NUCLEAR STATIONPower System230/525KVSwitchyardsKeowwoOHydroelectricGeneratorsLeeCTGenerators Adequacy of Oconee Nuclear Station Electric Distribution System Undervoltage ProtectionDuring Postulated Degraded Grid Voltage Events1. Executive SummaryDuring the 2014 NRC Component Design Basis Inspection (CDBI) the NRC teamidentified an unresolved item (URI) to determine whether a performance deficiencyexists with respect to the licensee's degraded voltage relay scheme (Degraded VoltageRelay Scheme [05000269, 270, 287/2014007-04 URI Section [R21 .2.b.iv)).This paper will address both the current and historical licensing and technical issuesrelated to the systems that are credited for both the detection and mitigation of a degradedgrid event.The Oconee Nuclear Station (ONS) was originally constructed with two layers of off-sitepower degraded voltage protection. These layers consisted of the Oconee 4kV SafetyRelated Power Undervoltage Protection. System (4kV UV) and the Oconee External GridTrouble Protective System (EGTPS).The Oconee Degraded Grid Undervoltage (DGUY) System was added in the 1990s dineframe to correct an issue identified in an April 30, 1990 License Event Report (LER)concerning unanticipated system interactions during an undervoltage condition in the230kV switchyard. These unanticipated interactions could have caused the KeoweeOverhead path to be unavailable during certain postulated degraded grid scenarios andthus result in the failure of one of two power paths (Keowee Overhead and Undergroundpaths) from the onsite emergency AC source. (Keowee). This system alerts OconeeNuclear Station operators and Duke Energy grid system operations to degraded gridvoltage conditions prior to the actuation of the 4kV Undervoltage protection system.This system will also isolate the switchyard and start Keowee in the event of anEngineered Safeguards (ES) system actuation during the degraded grid condition asfurther explained in this document.An operating experience (OE) review was performed and it was determine that somenuclear power plants ultimately rely upon manual or administration actions (via theircontrol rooms or their grid operation center) to protect safety related buses from adverseundervoltage effects related to degraded grid conditions.Ultimately, Oconee relies upon the automatic actions of safety related components toprotect Class iE equipment from adverse impacts due to undervoltage during postulateddegraded grid conditions.Page 1 of 15FOR INFORMATION ONLY

2. Overview of ONS Degraded Off-site Voltagre Protectiona. Oconee External Grid Trouble Protective System Overview (EGTPS)The External Grid Trouble Protective System Undervoltage system consists of tworedundant channels. Each channel is physically and electrically separated. Each channelconsists of six undervoltage relays which are each connected to a phase of both the redand yellow buses. When 2 relays on the same phase actuate, this will then actuate a localred light and another event recorder point. If two out of three relays are actuated, thesetwo relays will energize four tripping relays which will initiate the operation of theExternal Grid Trouble Protective System and automatically initiate a start of the KeoweeHydro units. Also, this will actuate a computer point, event recorder point, and statusalarm.b. Oconee Degraded Grid Undervoltage (DGUV) System OverviewThe Degraded Grid Undervoltage relays consists of three undervoltage relays which areconnected to the 230 kV Yellow Bus in a 2 out of 3 logic scheme. One relay is connectedto each phase to detect any abnormal conditions. When 2 out of 3 relays operate, thiswill start a 9 second timer. If the UV conditions recover above the relay setpoint, the 9-second timer will de-energize. This is designed to eliminate any voltage transients thatoccur during switching and faults external to the Oconee switchyard. If at the end of 9seconds the undervoltage condition has not recovered, a signal will be sent to thestatalarm, OAC, Dispatcher and Event Recorder. If an undervoltage condition is presenton 2 out of 3 phases along with an Engineered Safeguards (ES) signal, the 230 kVYellow Bus will isolate and automatically initiate a start of the Keowee Hydro units toenergize the startup transformers.This system was added as an additional degraded voltage protection system to clear theonsite emergency power source overhead path. See section 3.d of this document foradditional history regarding this system.c. Oconee 4kV Safety Related Power Undervoltage Protection System (4kV1V) OVerviewThe 4kV normal incoming breakers provide power during normal operation to the MainFeeder Bus (MEB) from the respective unit's auxiliary transformer (l/2/3T). The normalsource of power to the unit auxiliary transformer is the unit generator, although thecapability is provided for providing power to 1/2/3T from the switchyard.If an undervoltage is sensed on two out of three phases of the normal source, the normalbreakers will trip and isolate the safety related Main feeder Bus from the grid. Theemergency source "E" breakers utilize the same logic.The 84.77% nominal voltage analysis is performed at the "must drop out" value of the27N & E relays, 97% tap. At the 97% tap value, the 27N & E relays will begin to operatePage 2 of I5FOR INFORMATION ONLY the disc and after a time delay will provide a trip to either the normal or startup breakers.This trip will isolate the safety related buses from the degraded source of power.A Source voltage of 84.77% nominal will bound all degraded Conditions due to thefollowing:1. It has been analyzed that all operating safety related equipment will survive a degradedvoltage of 84.77% nominal.2. Uncertainty associated with the 84.77% nominal voltage setting (97% tap) is bounded bytesting that is performed at 99% tap.3. It has been demonstrated that the undervoltage relays will drop out and actuate on 4kVundervoltage at 84.77% nominal.In. a July 21, 1977 letter from Oconee to the NRC regarding the assessment of thesusceptibility of safety related equipment to sustained degraded voltage, it was shownanalytically that the safety related loads are protected from degraded grid voltageconditions. Attachment 1, Section Ill "Conclusions" states the following:To ensure that the operability of system components is not adversely affected by shortterm or long term degradation in system grid voltage, the undervoltage relays thatmonitor the offsite power system are set at 88% (3660V) .This ensures that an acceptablevoltage level required for continuous operation of non-safety, and safety-relatedequipment wvill exist. The time delay inherent in. these relays will eliminate spurioustrips and ensure that degraded undervoltages are detected and cleared before they canadversely affect safety-related loads.Figure 5 shows the results of Case 7 which provides the voltage profiles on the safety-related buses under degraded offsite power conditions corresponding to the undervoltagerelay setpoint of 88% (3660 V).This Case demonstrates that voltages below the continuous operating limits of the safety-related loads cannot exist without causing a separation from the degraded condition."In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the designaffords adequate protection against degraded grid undervoltage conditions in accordancewith the NRC letter of June 3, 1977, and therefore is acceptable.See sections 3.a and b of this document for additional history regarding this system.Page 3 of 15FOR INFORMATION ONLY

3. Licensing Historya. Original Plant Design for the Class 1E Electrical Distribution SystemUndervoltage ProtectionNo original licensing documentation could be located that explicitly describes andevaluates the undervoltage protection features of the Class 1E electrical distributionsystem. The Oconee Nuclear Station originally had an undervoltage protection design(4kV UV) to protect the Class IE equipment from a loss of voltage or a sustaineddegradation of grid voltage on the emergency buses. This undervoltage protection designprovides for two out of three coincident logic, monitoring the offsite power voltage oneach 41 60 volt bus. The undervoltage protection will initiate separation of the onsiteemergency buses from the offsite power systems immediately upon complete loss ofoffsite power or at a time delay depending on the extent of the degraded voltagecondition. Due to the inverse time trip characteristics of the undervoltage relays, thelower the voltage, the faster the trip.b. August 12, 1976 to December 20, 1978 Correspondence Related to theMillstone EventIn an August 12, 1976 letter from the NRC to Oconee, the plant operation and equipmentfailures during a degraded grid voltage condition events that occurred at Millstone UnitNo. 2 were described. At that time the NRC requested that Oconee investigate thevulnerability of their facility to similar degraded voltage conditions and provide aresponse by telephone.In a June 3, 1977 letter from the NRC to Oconee, the NRC felt that it was necessary forall licensees to conduct a thorough evaluation of the problem and submit formal reportsregarding the design of their respective Class IE electrical distribution systems and theirvulnerability to both long and short term degradation in the grid system voltage withinthe range where the offsite power is relied upon to supply important equipment.As requested, Oconee provided multiple responses to the NRC describing the operationof our Class lE electrical distribution systems. In a July 21, 1977 letter from Oconee tothe NRC, an evaluation performed that showed the Class 1E system is not vulnerable tothe same conditions that were experienced during the Millstone event. The letter statesthe following:"To ensure that the operability of system components is not adversely affected by shortterm or long term degradation in system grid voltage, the undervoltage relays thatmonitor the offsite power system are set at 88% (3660 V). This ensures that an acceptablevoltage level required for continuous operation of non-safety and safety-relatedequipment will exist. The time delay inherent in these relays will eliminate spurious tripsand ensure that degraded undervoltages are detected and cleared before they canadversely affect safety-related loads."Page 4 of 15FOR IN FORMATION ONLY In a December 20, 1978 letter from the NRC to Oconee, the NRC stated that, "the designaffords adequate protection against degraded grid undervoltage conditions in accordancewith the NRC letter of June 3, 1977, and therefore is acceptable. The NRC further statedin this letter, "The Oconee Nuclear Station originally had an undervoltage protectiondesign to protect the Class IE equipment from a loss of voltage or a sustaineddegradation of grid voltage on the emergency buses. The protection system includesundervoltage relays with inverse time characteristics which have a trip setpoint set at88% of the rated bus voltage, i.e., 4160 volts and with a five second time delay. Thisundervoltage protection design provides for two out of three coincident logic, monitoringthe offsite power voltage on each 4160 volt bus. The undervoltage protection will initiateseparation of the onsite emergency buses from the offsite power systems immediatelyupon complete loss of offsite power or at a time delay depending on the extent of thedegraded voltage condition below 88% of nominal voltage. The lower the. voltage, thefaster the trip."c. August 8, 1979 to*March 21, 1983 Correspondence Related to the ArkansasNuclear One (ANO) EventIn an August 8, 1979 Generic Letter from the NRC to all Power Reactor Licensees, anevent was discussed that occurred at the Arkansas Nuclear One (ANO) station onSeptember 16, 1978 that brought into question the conformance of the station electricdistribution system to GDC-1 7, in two separate regards. Specifically, licensees mustconfirm the acceptability of the voltage conditions on the station electric distributionsystems with regard to both (1) potential overloading due to transfers of either safety ornon-safety loads, and (2) potential starting transient problems in addition to the concernsexcpressed in our June 2, 1977 correspondence with regard to degraded voltage conditionsdue to conditions originating on the grid.GDC- 17 requires, in part, that (1) electric power from the transmission networkfor the onsite distribution system shall be supplied by two physically independent circuits(not necessarily on separate-rights of way) designed and located so as to miimze to theextent practical the likelihood of their simultaneous failure under operating andenvironmental conditions and (2) provision shall be included to minimize the probabilityof losing electric power from any of the remaining supplies as a result of, or coincident*with, the loss of power generated by the nuclear unit, or the loss of power from thetransmission network. The ANO station did not fully meet these requirements.In a letters from Oconee to the NRC on March 13, 1980 and June 4, 1980, Oconee furtherdescribed Class 1E electrical distribution system operation and analyses in light of theANO event and GDC-17. Oconee is not a GDC-17 plant due to its licensing priorto General Design Criterion.In a March 21, 1983 letter from the NRC to Oconee, the NRC stated that they hadcompleted their review and determined the following:Page 5 of 15FOR INFORMATION ONLY "Based on the results of your distribution system voltage verification tests, performed inaccordance with our guidelines, for the Unit 3 distribution system, we find your voltageanalysis acceptable, Due to the close similarity of the design and loading of thedistribution systems for all 3 units, we agree to accept the results of the Unit 3 tests asbeing valid for Units 1 and 2 also. Therefore separate verification testing for Units 1 and2 will not be necessary. The voltage analysis you submitted, indicates that thedistribution voltages at the safety buses were unacceptable when one unit startuptransformer is shared between two units. Your staff has agreed to implement TechnicalSpecifications (TSs) to prohibit the connection of more than one unit auxiliary and Class1E loads to a single startup transformer." Oconee Technical Specification 3.8.1Condition A states the following, "Both required offsite sources and the overheademergency power path inoperable due to inoperable unit startup transformer."NRC ConclusionsWe have reviewed the EG&G Technical Evaluation Report and concur in the findingsthat:1. The voltages are within the operating limits of Class 1 E equipment for projectedcombinations of plant load and offsite power grid conditions provided one startuptransformer is used for one unit.2. Spurious separation from the offsite power system due to the operation of voltageprotective relays will not occur (with the offsite grid voltage within its expected limits) asa result of starting safety loads.3. DPC has determined (by analysis) that no potential for either a simultaneous orconsequential loss of both offsite power sources exists.4. The tests performed by DPC verifies the accuracy of their analysis.We, therefore, find Oconee Nuclear Units 1, 2 and 3 design to be acceptable with respectto adequacy of station electric distribution system voltages subject to the implementationof technical specifications change prohibiting the use of one startup transformer for morethan one unit."d. April 30, 1990 to November 14, 1999 Correspondence Related to the OconeeLicense Event ReportsIn a April 30, 1990 Licensee Event Report (LER) from Oconee to the NRC, it wasreported that Oconee Design Engineering, while developing a Design Basis Document,determined that the switchyard voltage could drop below the minimum voltage level(219kV) required for worst case loading during a unit trip and Loss-Of-Coolant-Accidenton the tripped unit. Further review of the degraded voltage scenario revealed that one ofthe two required on-site emergency power paths, the Keowee Overhead, could beunavailable for automatic connection to the Oeonee 230 kV switchyard because ofthe relative setpoints of the under voltage relays serving the startup breaker logic and theexternal grid trouble protection system. In addition, this same undervoltage conditionPage 6 of 15FOR INFORMATION ONLY could prevent the startup transformer 4160 V breakers from closing in causing the 230kV switchyard and its associated incoming transmission lines to be unavailable toprovide their required support function.These conditions are possible because the 230 kV switchyard bus must be greater than219 kV in order to adequately supply ES loads while the automatic actuation voltagesetpoint for the Keowee Overhead emergency power path is less than 160 kY. If adegraded switchyard voltage exists between these relative set-points, then power to the ESbuses may not be automatically available from either source.Design Engineering also initiated a Station Problem Report which resulted in the laterdevelopment of Nuclear Station Modification (NSM) 52850. This NSM detailed theinstallation of an additional two out of three logic arrangement of undervoltage relayswhich sense the 230 kV input to each units startup transformers. The NSMprovided an annunciator, digital computer and events recorder indication to plantoperators as well as input to the Operator Aid Computer (QAC) when 230 kYswitchyard degraded voltage conditions exist. This modification automatically initiatedexisting switchyard isolate logic if degraded voltage conditions and an engineeredsafeguards (ES) signal on any Oconee unit occur concurrently. This system is knowntoday as Oconee Degraded Grid Undervoltage (DGUV) System.In a November 14, 1990 Safety Evaluation for Oconee Degraded Grid Protection, theNRC concluded the following:"Your Licensee Event Reports (LERs) 269/90-04 dated April 30, 1990, .269/90-04 datedMay 24, 1990, and 269/90-05 dated May 24, 1990, reported situations related to designdeficiencies of the degraded grid protection hardware and provided corrective actions.These deficiencies may leave the station vulnerable to a single failure and/or rendersafety-related equipment inoperable or damaged during a degraded voltage condition.However, your letter of May 8, 1990, described conceptually a new permanent degradedgrid protection modification to be installed in the near future that would, to a great extent,resolve these design deficiencies. The NRC staff has completed a review of thesesubnmittals. Enclosed is the related Safety Evaluation. The staff has concluded that theproposed modifications to the design would provide additional undervoltage protection.Also, in consideration of the complexity of the plant's existing undervoltage protectionsystem and the on-site electrical distribution system, the staff finds the proposeddegraded grid protection modification acceptable."4. NRC Regzulatory Issue Summary, 2011-12. Revision 1. Adequacy of Station ElectricDistribution System VoltagesCriteria a) The selection of voltage and time delay set-points shall be determined froman analysis of the voltage requirements of the safety-related loads at all station electricpower system distribution levels;Page 7 of 15.FOR INFORMATION ONLY Note: Voltage requirements of all safety-related loads should be determined based onmanufacturers design and operating requirements. For example, safety injection motorshave starting and running voltage requirements. Motor operated valves have minimumoperating voltage requirements. Motor Control Center contactors have minimum pickupand operating voltages. All voltage requirements for all safety-related loads need to bepreserved by the DVR circuit(s) during all operating and accident conditions.Oconee's Design to Criteria a) The voltage setpoints for the 4kV Safety Related PowerUndervoltage Protection System relays were shown via analyses to automatically protectthe connected eqluipment during a postulated degraded grid scenario.Criteria b) The voltage protection shall include coincidence logic to preclude spurioustrips of the offsite power source;Oconee's Design to Criteria b)The 4kV Safety Related Power System Undervoltage Protection and Degraded GridUndervoltage (DGUV) Systems utilize 2 out of 3 logic. This requires that 2 out of the 3phases are in a degraded voltage condition prior to actuation.Criteria c) ThI~e time delay selected shall be based on the following conditions:Criteria c-i) The allowable time delay, including margin, shall not exceed the maximumtime delay that is assumed in the final safety analysis report (FSAR) accidentanalyses;Note: Time delay condition (1) indicates that the DVR circuits should be designedassuming coincident sustained degraded grid voltage and accident events. Upon the onsetof the coincident accident and degraded grid event, the time delay for the DVR circuitshould allow for separation of the IE buses from the offsite circuit(s) and connection tothe 1E onsite supplies in time to support safety system functions to mitigate the accidentin accordance with the FSAR accident analyses.Oconee's Design to Criteria e-i)The DGUV system, as stated in Section 2 of this paper, will actuate if an undervoltagecondition is present on 2 out of 3 phases along with an Engineering Safeguard (ES)signal, the tripping relays (94V Channel 1 or 2) located in the External Grid ProtectionSystem (EGPS) will operate isolating the 230 kV Yellow Bus and starting Keowee Hydroto energize the startup transformers. The time delay for this postulated event is wellbounded by LOCA/LOOP analyses. The 9 second degraded voltage relay timer + 11second (transfer to standby bus) is less than the 23 seconds required by the UFSAR.Keowee will start from an ES signal and not walt for the 9 second timer.Page 8 of 15FOR INFORMATION ONLY If an accident signal (ES) is not present, the buses will be protected by the 4kV UVsystem at each respective unit's 4kV bus. Evaluation showed that the 4kV UV systemresponse time is one minute or less.Criteria c-2) The time delay shall override the effect of expected short duration griddisturbances, preserving availability of the offsite power source(s).Oconee's Design to Criteria c-2)For the DGUV system, a 9 second delay is utilized to override the effect of expectedshort duration grid disturbances, preserving availability of the offsite power source.The 4kV UiV system voltage setpoints arelower than the DGUV .setpoints. Expected -short duration grid disturbances would not reach the lower setpoints. Due to the inversetime trip characteristics of the undervoltage relays, the lower the voltage, the faster thetrip. This provides an inherent mechanism which is resistant to nuisance tripping.Criteria e-3) The allowable time duration of a degraded voltage condition at alldistribution system levels shall not result in failure of safety-related systems orcomponents.Oconee's Design to Criteria c-3)Due to the design of the 4kV UiV system, during a degraded voltage below 87.33% -nominal it has been demonstrated that all operating equipment will survive and beavailable iffneeded for an ES actuation. It has also been demonstrated that a safetyrelated load can be started and survive to be able to operate at this degraded voltage.Additionally, it has been shown that the undervoltage relays would actuate at 84.77%nominal to separate the safety related loads from the degraded source of power. Thisactuation has been shown to occur in less than two minutes. It is also important to notethat once the undervoltage relays drop out the voltage has to recover to 100% tap (105volts) or higher to reset the relay. Although analysis demonstrates that all safety relatedloads would survive during a sustained degraded voltage condition of 84.77% nominal,the relays would automatically separate the ES buses from the degraded source or thevoltage would have to recover to an acceptable level, 100% tap (87.5% nominal) orhigher.Criteria d) The voltage monitors (or DVRs as defined above) shall automatically initiatethe disconnection of offsite power source(s) whenever the voltage and time delay limitshave been exceeded.Oconee's Design to Criteria d)The 4kV UV system undervoltage protection relays would actuate at 84.77% nominal toseparate the safety related loads from the degraded source of power.Page 9 of 15FOR INFORMATION ONLY The Oconee Degraded Grid Undervoltage (DGUV) system will isolate the switchyardand start Keowee in the event of an Engineered Safeguards (ES) system actuation duringthe degraded grid condition.Any proceduralized manual actions for DGUV alarms are prel"iminary actions. The classlE buses are automatically protected by the 4kV UV system.Criteria e) The voltage monitors (DYRs) shall be designed to satisfy the requirements ofIEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power GeneratingStations"Oconee's Design to Criteria e)All relays, timers, and auxiliary relays used in The Oconee Degraded Grid Undervoltage(DGUV) system are Class lE. Although they are derived from a Class 1E source, the 125vdc control power are non-Class lE utilizing components similar to Class 1Ecomponents. The non-Class lE potential transformers (PTs) are also similar to Class lEPTs and are seismically mounted.The 4kV UV system satistfies the requirements of IEEE 279-197 1 per a July 21, 1977from Duke to the NRC.Criteria I) The Technical Specifications shall include limiting conditions for operation,surveillance requirements, trip setpoints with minimum and maximum limits, andallowable values for second-level voltage protection DVRs.Oconee's Design to Criteria f)The current Oconee Technical Specifications (TS) 3.3.19 include limiting conditions foroperation (LCOs) and Surveillance Requirements (SRs). No trip setpoints are included inthe TS.ONS Operating License and Technical Specifications were issued in the early 1970's. 10CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technicalspecifications that are included in any license issued before August 18, 1995, to satisfythe criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required tomodify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Notethat 10 CFR 50.36 was modified to include criteria for inclusion of items in TechnicalSpecifications in 1995. See section S.d of this document for additional backgroundinformation.The DGUV system channel redundancy limitations and setpoints are included in OconeeTS 3.3.19.Page 10 of 15F OR iNFORMATION ONLY

5. NRC CDBI Questions/Concernsa. Does scheme meet AEC 39 (UFSAR 3.1.39), 1977 letter?ONS Response to 5.aCriterion 39 (Emergency Power for Engineered Safety Features) states the following,"Alternate power systems shall be provided and designed with adequate independency,redundancy, capacity, and testability to permit the functioning required of the engineeredsafety features. As a minimum, the on-site power system and the off-site power systemshall each, independently, provide this capacity assuming a failure of a single activecomponent in each power system.ONS UFSAR section 3.1.39 states:"The electrical systems meet the intent of the criterion as discussed in UFSAR Chapter 8.Three alternate emergency electric power supplies are provided for the station fromwhich power to the engineered safety feature buses of each unit can be supplied. Theseare the 230 KY switching station with multiple off-site interconnections and two on-siteindependent 87,500 KVA hydroelectric generating units. Each nuclear unit can receiveemergency power from the 230 KY switching station through its start-up transformer as apreferred source. Each unit can receive emergency power from one hydroelectricgenerating unit through a 13.8 KY underground connection to standby transformer CT4.The other hydroelectric generating unit serves as a standby ~emergency power sourceand can supply power to each unit's startup transformer when required. Both on-sitehydroelectric generating units will start automatically upon loss of all normal power orupon an engineered safety feature action.Two additional sources of alternate power are available, as each nuclear unit is capableof supplying any other unit through the 230 KV switching station. In addition, aconnection to the 100 KY transmission network is provided as an alternate source ofemergency power whenever both hydroelectric generating units are unavailable."No single active failure could prevent the ability of the on-site power system and the off-site power system, independently, to provide power to the engineered safety features."b. Do manual actions "after a DG (Degraded Grid) Alarm steps t-o resolve" -are these required to protect 4kV,etc.?ONS Response to 5.bNo. As described in sections 2(a-c) of this paper, the degraded voltage relay protectionsystems provide automatic isolation initiation prior to Class 1E electrical distributionsystem bus voltages reaching any analyzed limits. Proceduralized actions by Oconeeoperators are considered conservative and prudent measures to be taken prior to theinitiation of automatic protective actions.Page 11 of 15FOR INFORMATION ONLY C. Does the automatic systems each meet the requirements (1977, BTP,RIS)? (Analysis vs. set points)ONS Response to 5.cYes. Past and current analyses show that the setpoints of the automatic system (4kV UV)are adequate to protect the Classl1E electrical distribution systems during postulatedperiods of degraded grid voltage. See section 3.b of this document for additionalinformation.d. Are 4kV set points credible since not in TS, and should they be per 10 CFR50.36 (c)(2)('ili)?ONS Response to $.dONS Operating License and Technical Specifications were issued in the early 1970's. '10CFR 50.36 (c)(2)(iii) states that a licensee is not required to propose to modify technicalspecifications that are included in any license issued before August 18, 1995, to satisfythe criteria in paragraph (c)(2)(ii) of this section. As such, ONS was not required tomodify technical specifications to include items that meet Criterions 1, 2, 3, and 4. Notethat 10 CER 50.36 was modified to include criteria for inclusion of items in TechnicalSpecifications in 1995.The ONS Technical Specifications currently require three channels of each of thefollowing EPSL voltage sensing circuits to be OPERABLE: a) Startup Transformer, b)Standby Bus 1; c) Standby Bus 2: and d) Auxiliary Transformer in MODES 1, 2, 4,4, 5,Sand 6, and during movement of irradiated fuel assemblies. The EPSL voltage sensingcircuits are required for the engineered safeguards (ES) equipment to function in anyaccident with a loss of offsite power. Per the ONS TS 3.3.18 Bases the EPSL voltagesensing circuits satisfy Criterion 3 of 10 CFR 50.36. SR 3.3.18.1 requires a CHANNELFUNCT[ONAL TEST be performed every 24 months (per SFCP). The test is afunctional test of the logic and does not verify the setpoint. This verification isperformed by testing not controlled by Technical Specifications. The exclusion of thesetpoint verification from TSs is addressed below under TS history.EPSL TS HistoryOn March 11, 1993, Duke Energy Submitted a complete rewrite of Section 3.7, AuxiliaryElectrical Systems, using a format consistent with standard technical specifications(NUJREG 1430). The custom Technical Specifications (CTS) that existed at the time ofsubmittal did not include surveillance requirements for the EPSL voltage sensing circuits(4kV UV). As such, Duke Energy proposed to add surveillance requirements to require arefueling frequency CHANNEL TEST as an additional restriction that was not currentlyincluded in Technical Specifications. The proposed TS Bases for the SR very clearlystated that the actual setpoints for the undervoltage relays on the N and E breakers areverified independently as a prerequisite to the TS SR. As a result of NRC Requests forPage 12 of 15FOR INFORMATION ONLY Additional Information (RA~s) and associated Duke Energy RAT responses and to make.the LAR adhere to the STS Writers Guide and associated NUREG, Duke Energy re-submitted the proposed TS on September 3, 1997. No changes were made to theproposed TS on EPSL Voltage Sensing Circuits and the NRC issued the TS and Bases asoriginally proposed (Amendment No. 232, 232, and 231). NRC evaluated proposed TS3.7.4 for EPSL Voltage Sensing Circuits starting on page 28 of the Safety Evaluation(SE) restating in their summary of proposed SR 3.7.4.1 that the actual setpoint values forthe undervoltage relays for the N and E breakers are to be verified independently as aprerequisite to the this SR. The NRC concluded based on the bases of the discussion andevaluation provided in Section 4.0 of the SE that the technical requirements contained inTS 3.7 are consistent with design requirements, the current ONS TS 'with differencesjustified, the Bases for TS 3.7 and technical requirements contained in the revised STS(refer to Section 5.0 Stummary on page 46 of SE). Section 6.0 of the SE addresses ITSInvolvement stating that the SE also provides the review for the technical changes thatare included in Section 3.8 of the ONS ITS that is currently under review, but are beyondthe scope of the ITS program indicating that both sets of specifications (3.7 for thisamendment and 3.8 for the ITS conversion) address the same provisions of the electricalTS. As a result the NRC staff determined that it was satisfactory to approve TS 3.7 anddelay implementation so that implementation was coincident with the ITS amendments.Note that EPSL instrumentation was located in the instrumentation Section Of TechnicalSpecification during ITS conversion so the TS for EPSL Voltage Sensing circuit. is3.3.18 and for EPSL 230kV Switchyard DGVP is 3.3.19.e. Commitments to IEEE-603 / 279 for Emergency Power / Off-site connectionONS Response to S.eIn a July 21, 1977 letter from Oconee to the NRC, regarding the 4kV UV system, it wasstated that, "Although designed prior to the issuance of IEEE 279-1971, the undervoltage(4kV UV) protection logic satisfies the requirements of these standards."All relays, timers, and auxiliary relays used in The Oconee Degraded G-rid Undervoltage(DGUV) system are Class lE. Although they are derived from a Class lE source, the 125vdc control power are non-Class lE utilizing components similar to Class 1Ecomponents. The non-Class lE potential transformers (PTs) are also similar to Class !EPTs and are seismically mounted.6. Degraded Voltage Protection Industry Precedence and Operating Experience (OE)Summary: As shown below, due to the reliance on manual and administrative actions(instead of automatic actions) for the protective of safety related buses, the NRC decidedto issue a backflt to implement modifications to bring these facilities in compliance withBTP PSB-1, "Adequacy of Station Electric Distribution System Voltages." Per atelephone conservation with Southern Nuclear Operating Company personnel on August4, 2014, plants Farley and Hatch relied exclusively upon manual actions (either by plantoperations or the transmission control department) to protect Safety related componentsPage 13 of 15FOR INFORMATION ONLY w qfrom the adverse effects of degraded grid voltage protection. Their argument wasprimarily based upon the improbability of such a degraded grid voltage condition.a. Farley Nuclear Plant Backfit IssueFollowing a July 1976 event at Millstone involving a degraded voltage condition, theNRPC staff developed generic positions on power systems for operating reactors..Sincedegradation of the offsite power system can lead to or cause the failure of redundantClass I E safety-related electrical equiipment, the NRC required that licensees installdegraded voltage protection as described in NRC letter dated June 2, 1977, "Statement ofStaff Positions Relative to Emergency Power Systems for Operating Reactors" (ADAMSLegacy No. 4007002656). The letter states that "the voltage monitors shall automaticallyinitiate the disconnection of offsite power sources whenever the voltage setpoint and timedelay limits have been exceeded." The letter further states that "the voltage monitors shallbe designed to satisfy the requirements of IEEE Std. 279-1971, "Criteria for ProtectionSystems for Nuclear Power Generating Stations." This automatic feature ensures theadequacy of the offsite power system and the onsite distribution system and ensures thatthe electrical system has sufficient capacity and capability to automatically start andoperate all required safety loads.Contrary to the June 2, 1977 letter, an NRC Safety Evaluation Report (SER) for FNP(ADAMS Legacy No. 951211 0043) accepted manual operator actions to compensate fordegraded grid conditions.b. Hatch Nuclear Plant Backfit IssueIn a letter dated June 17, 2011!, SNC disagreed with the conclusion in the May 25, 2011,report and appealed the NRC's decision to issue the backfit under the "complianceexception" provision of 10 CFR 50.109(a)(4)(i). In your appeal, you stated that a costjustified substantial safety backfit analysis, per 10 CFR 50.109(a)(3), was required. Atissue was the reliance on administrative controls and manual actions at HNP, as approvedin the 1995 NRC Safety Evaluation Report (SER), for maintaining adequate voltage toprotect Class 1E (safety-related) electrical equipment in the event of degraded voltageconditions.Aider review and consideration of SNC's response, the NRC has concluded that thedecision to use the "compliance exception" provision as allowed by 10 CFR50.109(a)(4)(i) was appropriate. The staff maintains its position that SNC's electricalanalysis for I-INP' must show that the existing setpoints and time delays are adequate toensure that all safety-related loads have the required minimum voltage measured at thecomponent terminal to start and operate safety related equipment necessary to mitigatethe consequences of the worst-case design basis event (DBE), without any credit foradministratively controlled bus voltage levels. The staff maintains that this position isconsistent with regulatory requirements specified in 10 CER 50.55a(h)(2) and GDC-17.This staff position is also consistent with the guidance provided in Standard Review Plan,NUREG-0800 (July 1981), Branch Technical Positions (BTPs) of Appendix 8-A (PSB),containing BTP PSB-1, "Adequacy of Station Electric Distribution System Voltages."Page 14 af 15FOR INFORMATION ONLY 4Further, the staff concludes that the NRC change in position, from that in the 1995 SER,regarding the acceptability of relying on manual operator action to demonstratecompliance with SNC 2 the applicable provisions of GDC-17 and 10 CFR 50.55a(h)(2),*constitutes backfitting as defined in 10 CFR 50.109(a)(1). The backfitting action isnecessary for compliance with GDC-17 and 10 CFR 50.55a(h)(2) and is consistent withapplicable guidance and practices in effect at the time that the NRC staff erroneouslyapproved the use of manual actions responding to degraded grid voltage condition in1995.c. Operating Experience (OE) SummaryIn summary, the above backfit OE does not apply to Oconee due to the. fact that Oconeeultimately relies upon the automatic actions of the undervoltage relays on the incomingbreakers for the safety related 4kV buses to protect the Class IE electrical powerdistribution system from degraded grid conditions. As described in sections 2(a-c) of thispaper, the degraded voltage relay protection system (4kV UV) provide automaticisolation initiation prior to Class 1E electrical distribution system bus voltages reachingany analyzed limits. Any manual actions by ONS are only conservative and p)rudentmeasures taken prior to reaching these limits.Page 15 of 15FOR INFORMATION ONLY