RS-20-001, Request for License Amendment Regarding Automatic Operation of Transformer Load Tap Changer

Request for License Amendment Regarding Automatic Operation of Transformer Load Tap Changer

ML20014E719
Person / Time
Site:	Clinton
Issue date:	01/14/2020
From:	Simpson P Exelon Generation Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RS-20-001
Download: ML20014E719 (20)

Text

4300 Winfield Road Warrenville, IL 60555 630 657 2000 Office RS-20-001 10 CFR 50.90 January 14, 2020 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 NRC Docket No. 50-461

Subject:

Request for License Amendment Regarding Automatic Operation of Transformer Load Tap Changer In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," and 10 CFR 50.59, "Changes, tests, and experiments," Exelon Generation Company, LLC (EGC) requests approval for a change to the Updated Safety Analysis Report (USAR). The proposed change implements the use of an automatic load tap changer (LTC) on the emergency reserve auxiliary transformer (ERAT) that provides offsite power to Clinton Power Station, Unit 1.

This request is subdivided as follows.

• Attachment 1 provides a description and evaluation of the proposed change.

• Attachment 2 provides a markup of the affected USAR page with the proposed change indicated.

The proposed change has been reviewed by the Plant Operations Review Committee in accordance with the requirements of the EGC Quality Assurance Program.

EGC requests approval of the proposed change by January 14, 2021. Once approved, the amendment will be implemented within 60 days. This implementation period will provide adequate time for the affected station documents to be revised using the appropriate change control mechanisms.

In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b), EGC is notifying the State of Illinois of this application for license amendment by transmitting a copy of this letter and its attachments to the designated State Official.

There are no regulatory commitments contained in this letter. Should you have any questions concerning this letter, please contact Mr. Kenneth M. Nicely at (630) 657-2803.

January 14, 2020 U.S. Nuclear Regulatory Commission Page 2 I declare under penalty of perjury that the foregoing is true and correct. Executed on the 14th day of January 2020.

ectfully, ~

Patrick R. Simpson Sr. Manager Licensing Attachments :

1. Evaluation of Proposed Change

2. Markup of Proposed Updated Safety Analysis Report Page cc: NRC Regional Administrator, Region Ill NRC Senior Resident Inspector - Clinton Power Station Illinois Emergency Management Agency - Division of Nuclear Safety

ATTACHMENT 1 Evaluation of Proposed Change 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 No Significant Hazards Consideration 4.3 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

Page 1

ATTACHMENT 1 Evaluation of Proposed Change 1.0

SUMMARY

DESCRIPTION In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," and 10 CFR 50.59, "Changes, tests, and experiments," Exelon Generation Company, LLC (EGC) requests approval for a change to the Updated Safety Analysis Report (USAR). The proposed change implements the use of an automatic load tap changer (LTC) on the emergency reserve auxiliary transformer (ERAT). The ERAT provides offsite power to Clinton Power Station (CPS), Unit 1.

The LTC is a subcomponent of the ERAT. For the ERAT, the number of effective primary windings can be varied over a range of 1.06 per unit (pu) to 0.81 pu by a LTC mounted on the ERAT to provide a consistent 4.16 kilo Volt (kV) output.

The proposed change requests NRC approval to operate the ERAT LTC in the automatic mode (i.e., in lieu of the static VAR compensator (SVC)) to regulate the voltage at the safety-related buses. The LTC will be operated only in the manual mode, which does not require prior NRC approval, until the change requested herein is approved. Once the proposed change is approved, operation of the LTC in automatic mode will be allowed and the USAR description of the offsite power sources will be revised to describe the automatic LTC operation. Operation of the LTC in automatic mode, with the SVC secured, requires NRC approval in accordance with 10 CFR 50.59, since automatic LTC operation creates a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR.

2.0 DETAILED DESCRIPTION The ERAT provides power to the plant 4.16 kV safety buses from the 138 kV transmission network. Operating the ERAT LTC in the automatic mode, as proposed, introduces a potential failure involving an over-voltage condition on the Class 1E 4.16 kV buses that is not bounded by the over-voltage condition previously identified in USAR Section 8.3.1.1.2, "Unit Class 1E A-C Power System." As stated in USAR Section 8.3.1.1.2, the maximum steady state Class 1E bus voltage is 4300 volts alternating current (Vac), and operation above 4300 Vac but less than 4454 Vac is allowed for 30 minutes. A failure of the LTC to control voltage within the setpoints could exceed the analyzed high voltage condition of 4454 Vac. Therefore, operating the ERAT LTC in the automatic mode creates the possibility of a malfunction of an SSC important to safety with a different result than any previously evaluated in the USAR. NRC approval is requested to implement the activity.

The proposed USAR change revises section 8.3.1.1.2 to add a discussion of the automatic operation mode of the ERAT LTC. The USAR change markup is provided in Attachment 2.

Page 2

ATTACHMENT 1 Evaluation of Proposed Change

=

Background===

At CPS, power to safety related equipment is provided by three divisional load groups, with each division powered by an independent Class 1E 4.16 kV Engineered Safety Feature (ESF) bus. Each ESF bus has two separate and independent offsite sources of power and a dedicated onsite diesel generator (DG). The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.

Offsite power is supplied to the switchyard from the transmission network. From the plant switchyard, a 345 kV circuit provides AC power to each 4.16 kV ESF bus via the reserve auxiliary transformer (RAT). In addition, an electrically and physically independent 138 kV offsite power source provides a second completely independent circuit to each 4.16 kV ESF bus via the ERAT. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions.

For each of these circuits, a permanently installed SVC is provided which can be connected to the secondary side of the associated auxiliary power transformer (RAT or ERAT) via two in-series circuit breakers. The ERAT SVC and RAT SVC provide steady state, dynamic and transient voltage support to ensure that the Class 1E loads will operate as required during anticipated or postulated events. However, SVC support of the offsite power sources may not be required at all times, depending on prevailing grid conditions relative to the requirements of the facility.

To maintain operability of the offsite power circuit, the minimum required switchyard voltage is approximately 129.72 (0.94 pu) kV for the ERAT 138 kV line. This voltage ensures that the voltage is adequate at the Class 1E 4.16 kV ESF buses, under accident loading conditions.

The ERAT has onload tap changing capability. For the ERAT, the number of effective primary windings can be varied over a range of 1.06 pu to 0.81 pu by an LTC mounted on the ERAT to provide a consistent 4.16 kV output. Currently, the LTC is only operated manually. When operated manually, an operator can make tap changes locally at the ERAT, and the changes may be made with the ERAT in service.

The loss of power (LOP) instrumentation monitors the 4.16 kV emergency buses. Offsite power is the preferred source of power for the 4.16 kV emergency buses. If the monitors determine that insufficient power is available, the buses are disconnected from the offsite power sources and connected to the onsite DG power sources.

The SVCs at CPS are unique to the nuclear industry and obsolete due to the system's age.

Specifically, the SVC's control system is obsolete, and replacement parts are not readily available. As a result, alternative methods of providing voltage support are being pursued to ensure that Class 1E loads will operate as required during anticipated or postulated events.

Page 3

ATTACHMENT 1 Evaluation of Proposed Change EGC's current plan is to eliminate use of the SVCs for both the RAT and ERAT. As an alternative, a new control system for mechanically switched capacitor banks will be installed, in conjunction with an automatic load tap changer and over-voltage protection features, to regulate the voltage at the safety-related buses during transient conditions. However, based on current estimates, parts necessary to install this alternative solution will not be available until fourth quarter 2020.

In order to minimize the impact of an unforeseen failure of either the ERAT SVC or the RAT SVC (i.e., prior to installation of the new mechanically switched capacitor banks), EGC has developed an interim solution that could be used to regulate the voltage at the safety-related buses. The interim solution involves operation of the ERAT LTC in the automatic mode. This interim solution will be implemented in the event of an unforeseen failure of either the ERAT SVC or the RAT SVC, as discussed below, but would only remain in place until the alternative solution involving switched capacitor banks is installed.

• In the event of an unforeseen ERAT SVC failure that cannot be promptly remedied with existing spare parts, the ERAT SVC will be decommissioned and the ERAT load tap changer will be placed into the automatic mode of operation. In this situation, one of the qualified circuits required by Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.8.1, "AC Sources - Operating," would be inoperable. Condition A of LCO 3.8.1 would be entered for one offsite circuit inoperable, with a Required Action to restore the offsite circuit to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The ERAT would remain inoperable pending final testing of the automatic load tap changer.

• In the event of an unforeseen RAT SVC failure that cannot be promptly remedied with existing spare parts, the ERAT SVC will be decommissioned and the ERAT load tap changer will be placed into the automatic mode of operation. Parts from the decommissioned ERAT SVC would then be used to restore the RAT SVC to operable status. In this situation, Condition A of LCO 3.8.1 would initially be entered for one offsite circuit inoperable (i.e., the RAT). Efforts to decommission the ERAT SVC and commission the ERAT automatic load tap changer would commence, requiring entry into Condition C of LCO 3.8.1 for two offsite circuits inoperable (i.e., the RAT and ERAT),

with a Required Action to restore one of the offsite circuits to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The ERAT would be restored to operable status following final testing of the automatic load tap changer, and the RAT would be restored to operable status by repairing the RAT SVC with parts from the decommissioned ERAT SVC. Condition C of LCO 3.8.1 would be exited when either the ERAT or RAT is restored to operable status.

However, Condition A would continue to apply until the second offsite circuit is restored to operable status.

As discussed above, operation of the LTC in automatic mode requires NRC approval in accordance with 10 CFR 50.59, since automatic LTC operation creates a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR.

An engineering evaluation has been performed to determine the acceptability of using the ERAT LTC in automatic mode without the ERAT SVC. The plant alignment used in the evaluation requires the ERAT providing power to the three Class 1E 4.16 kV ESF buses. Due to Page 4

ATTACHMENT 1 Evaluation of Proposed Change equipment limitations (i.e., operating time) of the ERAT LTC drive mechanism, the fast transfer from the RAT to the ERAT is unavailable with the ERAT LTC in automatic mode. Key conclusions are listed below.

• The auxiliary power system will remain connected to offsite power during a bounding loss-of-coolant accident (LOCA) autostart transient. There are sufficient tap settings to regulate voltage for the entire range of analyzed switchyard voltages.

• LOCA autostart motors will successfully accelerate and power their respective loads.

• Safety related motors will continue to operate for the duration of LOCA autostart transients without stalling.

• Motor operated valves (MOVs) will have adequate voltage to perform their intended function. This includes any heating effects due to extended stall conditions until voltage recovers sufficiently to accelerate the MOV motor.

• None of the protective devices for any of the LOCA autostart loads will trip during the LOCA autostart transient. The fuses in the control circuits for MCC loads that autostart will not trip during the starting transient.

• Contactors have sufficient voltage to start their loads with few exceptions (i.e., some contactors drop out). Any contactors that drop out have been verified to automatically re-energize and start their loads in a time frame that supports the accident analysis.

Also, 120 V safety related distribution panel loads have adequate voltage to perform their intended functions during the LOCA transient.

• Adequate voltage exists at the LTC control circuits to provide voltage regulation during the LOCA autostart transient.

• There is adequate load current to reliably detect open phase conditions when the three ESF buses are connected to the ERAT.

• The existing ESF bus overvoltage alarm is currently set to 4230 V. This alarm setpoint will be changed to avoid nuisance alarms.

• The LTC tap operation primarily relies on the Voltage Regulating Relay (VRR). The Voltage Backup Relay (VBR) for the ERAT previously alarmed at the onset of an overvoltage condition (i.e., greater than 4300 V). The VBR is not relied on to regulate voltage during normal or accident conditions. It merely controls voltage when the primary VRR fails to control the voltage within its preset bandwidth. The VBR is set to control voltage at the low end to a value that is below that of the primary VRR. This lower voltage prevents the VBR from interfering with the primary VRR. The VBR setting is intended to prevent the LTC from running away and boosting voltage to the point of creating an extreme overvoltage condition. A new setting will initiate an alarm at a higher voltage.

Page 5

ATTACHMENT 1 Evaluation of Proposed Change Description of Transformer and LTC Modifications The CPS ERAT with the LTC in manual operation is currently installed and has been evaluated in accordance with 10 CFR 50.59 and determined to not require NRC approval prior to implementation. However, enabling the automatic function of the LTC requires NRC approval since automatic LTC operation creates a possibility for a malfunction of the ERAT, a structure, system, or component important to safety, with a different result than any previously evaluated in the USAR. Specifically, operating the ERAT LTC in the automatic mode, as proposed, introduces a potential failure that involves an over-voltage condition on the Class 1E 4.16 kV buses that is not bounded by the over-voltage condition previously identified in USAR Section 8.3.1.1.2, "Unit Class 1E A-C Power System." As stated in USAR Section 8.3.1.1.2, the maximum steady state Class 1E bus voltage is 4300 Vac, and operation above 4300 Vac but less than 4454 Vac is currently allowed for 30 minutes. A failure of the LTC to control voltage within the setpoints could exceed the analyzed high voltage condition of 4454 Vac. Therefore, operating the ERAT LTC in the automatic mode creates the possibility of a malfunction of an SSC important to safety with a different result than any previously evaluated in the USAR. NRC approval is requested to implement the activity.

The tap changer mechanism for the LTC is located in a separate enclosure attached to the transformer. A drive motor rotates the tap changer to increase or decrease the number of transformer windings in service. The LTC has two modes of operation, automatic and manual.

In the automatic mode, the LTC is controlled by a primary VRR and VBR. The function of the VRR/VBR is to control the ERAT's secondary voltage by adjusting LTC tap position on the primary winding. The VRR/VBR gets its voltage feedback signal from a potential transformer (PT) on the LTC ERAT secondary winding. The VRR/VBR requires user input setpoints for its voltage control point (i.e., Bandcenter), and tolerance around that voltage control point (i.e.,

Bandwidth). The feedback signal from the PT is compared to the Bandcenter and Bandwidth, and based on the comparison, the VRR/VBR control circuitry sends appropriate commands to the LTC to change taps as necessary to maintain the sensed voltage within the voltage Bandwidth.

The VRR obtains the power required for its operation from the PT which also provides it the feedback signal. Therefore, if the PT fails, the VRR will have no power to operate, and therefore cannot send commands to raise the secondary voltage based on erroneous feedback from a failed PT. The VRR is locally equipped with a green light emitting diode (LED) light (OK) which will remain lit whenever the power is applied to the unit and the controller is working properly.

The VBR obtains the power required for its operation from the LTC control power. Therefore, in the event of loss of voltage, the VBR will have no power to operate, and there is no concern on erroneous feedback from a failed PT. Both local and main control room trouble annunciation is activated after a three-minute fixed time delay.

The LTC drive assembly is fed from two sources: Service Building MCC B (0AP81E) or ERAT Panel (0AP155E). The primary feed will be from 0AP81E, but an Automatic Transfer Relay (i.e.,

ANSI 83 Relay) will switch to 0AP155E upon loss of the primary feed. In the event the transfer switch operates, an annunciator alarm is received in the main control room. In response to this Page 6

ATTACHMENT 1 Evaluation of Proposed Change alarm, an operator will be dispatched to the transfer switch to verify proper transfer of the power supply and actions will be taken to restore power from the normal supply.

The VRR is designed to regulate the 4 kV bus voltages under both normal and accident conditions. In the event this controller fails, and the voltage rises or falls outside its operating voltage band, the VBR will take over automatic operation of the LTC. The VBR also utilizes a redundant relaying scheme to ensure the LTC does not raise or lower the voltage beyond the limits set within the VBR itself. With the use of this redundant relaying scheme, a single relay failure cannot cause the LTC to operate outside the operating range of the VBR.

There will be no LTC control or tap position indication available in the control room. All manual tap changes will be performed locally at the transformer LTC control cabinet. Control room operators, however, do have both high and low voltage alarms for the buses that are fed by the ERAT. Actual bus voltages can be obtained from voltmeters on the control room panels or through computer points via the plant's process computer. In addition, the VRR and VBR controllers initiate control room and local panel alarms should their microcontrollers or power supplies fail.

The LTC is also equipped with a protection and monitoring system to ensure the current limiting resistors are operating properly during the tap changing process. The monitoring system will abort a tap change operation should a resistor fail to interrupt the current during a tap change or should the power supply to the monitoring system fail. The failure would be indicated on the local control panel and identified during operator rounds. The system must be verified to be operating correctly and will automatically reset upon the condition clearing prior to further tap changes.

An LED indicator on the controller serves as a display to verify "CPU OK" status, indicated locally at the control panel on the transformer. The tap changer can also be operated locally in a manual control mode, which also uses the drive motor to rotate the tap changer.

The LTC will provide a nominal range of 0.815 pu to 1.06 pu of the rated secondary voltage in 17 steps, each step being ~1.55%. The LTC has sufficient range to respond to the expected 138 kV system range of 0.94 pu to 1.05 pu of nominal. By providing automatic adjustment of the voltage to the CPS auxiliary power system from the offsite 138 kV system, the ERAT LTC will compensate for a wide range of 138 kV system operating voltages in the future.

The regulating relays controlling the LTCs are set with an initial delay of one (1) second. The voltage must be out of band for one second before the controls initiate a tap change. Once given a signal to change taps, either manually or automatically, the tap changer will complete a tap change in three seconds. If multiple taps are calculated to be needed, the initial one second delay will occur only once (1 second + 3 seconds for first tap + 3 seconds for each subsequent tap, if required).

In the event of a voltage dip, a race condition is created between the LTC and degraded voltage relay. If a loss-of-coolant accident were to occur at full power operations and the switchyard voltage were to stay within the voltage limits analyzed for the ERAT LTC operation, it has been determined that for the worst case analyzed in the ERAT LTC automatic operation evaluation, the ERAT LTC will correct the voltage in a maximum duration of 13 seconds. The second-level Page 7

ATTACHMENT 1 Evaluation of Proposed Change degraded voltage relays are bounded by the Division 3 nominal time delay which is set at 13.2 seconds (i.e., the degraded voltage time delay for Divisions 1 and 2 is longer than 13.2 seconds). If the voltage does not recover before 13.2 seconds, the safety buses will be disconnected from offsite power and will align to emergency DGs. The allowable value for the Division 3 degraded voltage time delay specified in Technical Specifications 3.3.8.1 is

> 13.2 seconds and < 16.8 seconds. Therefore, the LTC will be successful in preventing a trip of the degraded voltage relays in the event of a voltage dip, precluding unnecessary disconnection of the safety buses from offsite power.

Prior to enabling automatic operation of the LTC, the full range of tap positions will be verified.

Testing performed on the VRR/VBR controllers will include verifying with a simulated voltage input that the VRR provides the correct raise/lower response and the VBR provides the proper blocking function.

LTC Automatic Operation Failure Modes Evaluation An evaluation of the potential failure modes of the LTC and its control system has been performed. The evaluation results are discussed below and summarized in Table 1. Use of the LTC in automatic mode creates the possibility for a malfunction of the LTC mechanism or the primary microcontroller (i.e., VRR) that raises or lowers the voltage provided to the 4.16 kV safety related buses. A possibility for a malfunction is created when the VRR or the LTC mechanism automatically lowers or raises the voltage to the safety related buses.

The most severe potential malfunction would be a failure of the VRR that causes transformer output voltage to rapidly increase or decrease. The backup controller (i.e., VBR) prevents a defective LTC tap changer VRR from running the voltage outside established upper and lower limits by blocking the raise and lower logic of the tap changer. The VBR will also lower the voltage if the regulated voltage remains above the upper voltage limit past its time delay setpoint. The design also allows the operators to override both LTC controllers, taking local manual control if necessary.

The failure or possible misoperation of the LTC mechanism is unlikely to significantly affect output voltage for a prolonged length of time since the LTC mechanism is monitored by the LTC mechanism monitoring system, the VRR, and the VBR. Simultaneous failure of the LTC mechanism monitoring system, the VRR, and the VBR is unlikely. Therefore, a failure of the LTC mechanism should be detected and quickly offset by the monitoring system, the VRR, or the VBR. Furthermore, simultaneous failure of the ERAT LTC microcontrollers, resulting in loss of Divisions 1, 2, and 3 safety related buses at the same time, is even more unlikely.

EGC has obtained current data on the predicted mean time between failure rates of the controllers from the manufacturer. For the VRR, the predicted mean time between failures is 266.57 years and for the VBR, the predicted mean time between failures is 990.90 years. The calculations are based on figures current as of June 30, 2019, and June 30, 2018, for the VRR and VBR, respectively. Thus, the failure of both controllers simultaneously is unlikely. CPS controller maintenance and testing activities will provide reasonable assurance that these mean time between failure rates are maintained.

Page 8

ATTACHMENT 1 Evaluation of Proposed Change In addition, the failure probability of the ERAT LTC to spuriously operate or to have a failure of both controllers due to a failure common to both of the controllers has been calculated. The calculation used failure rates from the vendor for both the VRR and VBR. However, as discussed below, failure data for the LTC motor and motor control relays is limited. Therefore, generic and site-specific failure rates for motor operated valves were used as a surrogate to provide a representative assessment. The LTC circuit and operation are similar to that of motor operated valves in which generic and site-specific failure rates exist. The generic failure rate for typical components used in full power internal events (FPIE) probabilistic risk analysis (PRA) models are originally provided in NUREG/CR-6928; however, updated component reliability data from 2015 is published on the NRC website (https://nrcoe.inl.gov/resultsdb/AvgPerf/).

Based on engineering judgment, motor operated valve failure rates were assigned to the LTC motor because the NRC's generic data source document (NUREG/CR-6928) has no information specific to LTCs.

Assumptions used in the probability calculation are listed below.

• The LTC motor failure utilizes a site-specific failure rate for motor operated valve spurious operation.

• The VRR failure rates are based on controller failures and is not of the specific failure mode of sending a false raise signal. This leads to a conservative over estimation of the failure probability.

• For controller common cause, the averaged independent failure rate from the VRR and VBR is used for the common cause probability calculation.

• For controller common cause, the alpha factor is based on 2015 NUREG/CR-5497 (Section 3.1.2, "Generic Rate CCF" case).

Using these assumptions, the failure probability of the ERAT LTC to spuriously operate or to have a failure of both controllers due to a failure common to both of the controllers was calculated to be 9.77E-07. Based on the above, although automatic LTC operation creates a possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR, the likelihood of such a malfunction involving simultaneous failures of both controllers, or a failure of the LTC motor, is very low.

Failure Modes that Increase Voltage The 4.16 kV ESF buses are equipped with a process computer alarm that indicates an over-voltage condition has occurred. The control room computer alarm setpoint will be conservatively below the 110% voltage rating of the safety related motors fed from the bus, consistent with ANSI/NEMA Standard MG-1-2003, "Motors and Generators."

The simultaneous failures of both the VRR and VBR, or a failure of the LTC motor, that results in rapidly increasing voltage was deemed not credible based on the failure probability calculation discussed above.

Failure Modes that Decrease Voltage Failure to restore the bus voltage would cause the power source for these buses to transfer to the RAT (preferred, if available), or to the emergency DGs. A loss of offsite power is analyzed Page 9

ATTACHMENT 1 Evaluation of Proposed Change in the USAR. Again, the presence of the VBR makes this failure extremely unlikely, and a low voltage alarm at 4130 V alerts operators to take procedurally-guided action prior to reaching the degraded voltage relay setpoint.

A failure that results in decreasing voltage could initiate the timers on the 4.16 kV bus degraded voltage relays, and if sustained, would automatically connect the buses to the onsite DG power sources as required by Technical Specifications Limiting Condition for Operation (LCO) 3.3.8.1, "Loss of Power (LOP) Instrumentation."

Other Failure Modes Other LTC failure modes or malfunctions that could lead to an over-voltage or under-voltage condition or result in the tap changer failing to change the tap setting when expected (i.e., the tap setting remains "as is") are identified in Table 1. This can result from a failure of the controller when the LTC is operating in the automatic mode, or from a failure of the drive motor within the LTC, including a loss of power to the drive motor, when the LTC is operating in either the automatic or manual mode. An over-voltage or under-voltage condition could be created if transmission system voltage changed subsequent to the failure. For example, if the failure occurred during the afternoon of a day when high summer load demand existed, a high tap setting could lead to a high voltage condition later that evening when system load demand diminishes and grid voltage increases.

Failures of the tap changer to change settings when demanded are less severe than active failures of the LTC, since the overvoltage or under-voltage condition would evolve relatively slowly and the magnitude of the resultant change in voltage would be limited to the effect of the change in grid voltage. As noted previously, there are alarms that alert the operator to high voltage conditions on the 4160 V ESF buses, and procedures instruct the operators to take action to mitigate or correct the condition. Actions include contacting the transmission system operator and requesting that the voltage be increased or decreased as needed. Further actions include either securing/preventing the start of loads, or adding additional load based on the scenario. The operator can also arrange for manual operation of the tap changer to change the tap setting if required.

Page 10

ATTACHMENT 1 Evaluation of Proposed Change Table 1: LTC and Microcontroller Failure Modes and Effects LTC Automatic Operation Impact Response Potential Failure Mode LTC mechanism or Could cause overvoltage The VBR maintains acceptable tap microcontroller attempts to condition position by blocking the raise raise tap setting when not signal and attempting to return needed voltage to the control band.

Additionally, alarm on overvoltage will initiate operator action to place LTC in manual mode if necessary.

LTC mechanism or Could cause undervoltage The VBR maintains acceptable tap microcontroller attempts to condition position by blocking the lower lower tap setting when not signal. Additionally, alarm on needed undervoltage will initiate operator action to place LTC in manual mode. In the extreme case, a prolonged undervoltage results in a loss of offsite power, which has been evaluated as part of the design basis.

LTC mechanism or Could result in overvoltage Operator action to monitor voltage microcontroller malfunction or undervoltage condition if and respond by placing LTC in fails to change taps, grid voltage changes manual mode and lowering or causing tap setting to following the failure raising the voltage as desired.

remain as is.

LTC drive motor fails to Could result in overvoltage Operator action to monitor change taps (e.g., power to or undervoltage condition if "TROUBLE ERAT" annunciator motor is lost) causing tap grid voltage changes window in the control room and setting to remain as is. following the failure place LTC in manual mode as desired.

LTC drive mechanism fails Could result in excessive The simultaneous failures of both to stop changing taps after overvoltage (>4454V) or the VRR and VBR, or a failure of initiation of raise or lower by undervoltage condition, the LTC motor, that results in microcontroller. especially if grid voltage is rapidly increasing voltage was These failures are LTC near upper or lower limits deemed not credible based on the motor not operating, or a calculated combined failure runaway motor that probability of 9.77E-07.

continues to change taps without stopping until the end of the LTC tap range.

Page 11

ATTACHMENT 1 Evaluation of Proposed Change Evaluation of Offsite Circuit Operability with Non-Functional LTC Implementation of automatic operation of the ERAT LTC will compensate for variations in switchyard voltage that could otherwise render the offsite circuit inoperable. In the event the LTC is non-functional and unable to compensate for switchyard voltage variations, offsite circuit operability will be determined based on whether the actual and predicted post-trip voltage at the switchyard is adequate to provide voltage to the safety related loads while preventing the LOP instrumentation from transferring the safety bus source to the DGs.

Conclusion Implementation of automatic LTC operation will ensure that the voltage provided by the transmission system is adequate to maintain operability of the offsite power sources for CPS Unit 1 for the expected range of switchyard voltages and analyzed switchyard voltage drops.

LTCs have proven to be reliable, and the likelihood and consequences of each of the failure modes of the LTCs has been evaluated and determined to be acceptable. Thus, the proposed changes will increase overall reliability of the offsite power at CPS Unit 1.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants," Criterion 17, "Electric power systems," requires, in part, that offsite power be available to the facility to ensure that specified fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. Criterion 17 further requires that provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

To satisfy Criterion 17 of the General Design Criteria (GDC), adequate voltage must be maintained in order to ensure that the offsite power source remains available to provide power to safety related equipment. Providing adequate voltage ensures that the loss of power instrumentation, which protects the auxiliary power system from operating at low voltages that could damage equipment, would not actuate to separate the safety related buses from the offsite power sources as a result of the loss of output from the generating unit.

10 CFR 50.59 allows licensees to make changes to the plant as described in the USAR only if the changes do not result in a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR. As discussed in Section 3.0 above, the use of the ERAT LTC in automatic operation creates the possibility for a malfunction of a structure, system, or component important to safety with a different result than any previously evaluated in the USAR.

As demonstrated in Section 3.0 above, usage of the LTC automatic operation mode for the ERAT will ensure that the offsite power capabilities of CPS remain in compliance with the Page 12

ATTACHMENT 1 Evaluation of Proposed Change requirements of GDC 17 and ensure that the offsite power sources remain operable under all expected voltage variations in accordance with Technical Specifications requirements.

4.2 No Significant Hazards Consideration In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," and 10 CFR 50.59, "Changes, tests, and experiments," Exelon Generation Company, LLC (EGC) requests approval for a change to the Updated Safety Analysis Report (USAR). The proposed change implements the use of an automatic load tap changer (LTC) on the emergency reserve auxiliary transformer (ERAT). The ERAT provides offsite power to Clinton Power Station (CPS), Unit 1.

According to 10 CFR 50.92, "Issuance of amendment," paragraph (c), a proposed amendment to an operating license involves no significant hazards consideration if operation of the facility in accordance with the proposed amendment would not:

(1) Involve a significant increase in the probability or consequences of any accident previously evaluated; or (2) Create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) Involve a significant reduction in a margin of safety.

EGC has evaluated the proposed change, using the criteria in 10 CFR 50.92, and has determined that the proposed change does not involve a significant hazards consideration. The following information is provided to support a finding of no significant hazards consideration.

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The requested change allows the automatic operation mode of the LTC. The only accident previously evaluated for which the probability is potentially affected by the change is the loss of offsite power (LOOP). A failure of the LTC while in automatic operation mode that results in decreased voltage to the Engineered Safety Feature (ESF) buses could cause a LOOP. This could occur in two ways. A failure of the primary LTC controller (i.e., Voltage Regulating Relay (VRR)) that results in rapidly decreasing the voltage to the emergency buses is the most severe failure mode.

However, a backup controller (i.e., Voltage Backup Relay (VBR)) is provided with the LTC that makes this failure unlikely. A failure of the VRR to respond to decreasing grid voltage is less severe, since grid voltage changes occur slowly. In both of the above potential failure modes, operators will take manual control of the LTC to mitigate the effects of the failure. Thus, the probability of a LOOP is not significantly increased.

Page 13

ATTACHMENT 1 Evaluation of Proposed Change The proposed change has no effect on the consequences of a LOOP, since the emergency diesel generators provide power to safety related equipment following a LOOP. The emergency diesel generators are not affected by the proposed change.

The probability of other accidents previously evaluated is not affected, since the proposed change does not affect the way plant equipment is operated and thus does not contribute to the initiation of any of the previously evaluated accidents.

The LTC is equipped with a VBR, which controls the LTC in the event of VRR failure.

The only way in which the consequences of other previously evaluated accidents could be affected is if a failure of the LTC, while in automatic operation mode, led to a sustained high voltage condition, which resulted in damage to safety related equipment that is used to mitigate an accident. The simultaneous failures of both the VRR and VBR, or a failure of the LTC motor, that results in rapidly increasing voltage was deemed not credible.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change involves functions that provide offsite power to safety related equipment for accident mitigation. Thus, the proposed change potentially affects the consequences of previously evaluated accidents, but does not result in any new mechanisms that could initiate damage to the reactor and its principal safety barriers (i.e., fuel cladding, reactor coolant system, or primary containment).

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No The proposed change does not affect the inputs or assumptions of any of the analyses that demonstrate the integrity of the fuel cladding, reactor coolant system, or containment during accident conditions. The allowable values for the degraded voltage protection function are unchanged and will continue to ensure that the degraded voltage protection function actuates when required, but does not actuate prematurely to cause a LOOP. Automatic operation of the LTC increases margin by reducing the potential for transferring to the Emergency Diesel Generators during an event.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Page 14

ATTACHMENT 1 Evaluation of Proposed Change Based on the above evaluation, EGC concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92, paragraph (c),

and accordingly, a finding of no significant hazards consideration is justified.

4.3 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

EGC has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, "Standards for Protection Against Radiation." However, the proposed amendment does not involve: (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review,"

paragraph (c)(9). Therefore, pursuant to 10 CFR 51.22, paragraph (b), no environmental impact statement or environmental assessment needs to be prepared in connection with the proposed amendment.

Page 15

ATTACHMENT 2 Markup of Proposed Updated Safety Analysis Report Page Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 REVISED USAR PAGE 8.3-6

CPS/USAR minimum level conditions expected for the anticipated voltage range of the offsite sources. All three RATs and the ERAT have onload tap changing capability. For the ERAT, the number of effective primary windings can be varied over a range of 1.06 pu to 0.81 pu by a load tap changer (LTC) mounted on the ERAT to provide a consistent 4160-V output. The LTC is only operated manually. When operated manually, an operator can make tap changes locally at the ERAT, and the changes may be made with the ERAT in service.

INSERT For RAT B, the secondary winding taps can be varied over a range of 1.04 PU to 0.77 PU with an LTC mounted on the RAT B to provide a consistent secondary voltage output. The LTC is only operated manually. When operated manually, an operator can make tap changes locally at RAT B with the transformer in service.

After performing an extensive voltage analysis to determine the most voltage-sensitive element at each voltage level, it was determined that the selection of the second level undervoltage relay setpoint is governed by the minimum acceptable voltage at the following equipment:

a. Certain devices at the 120-Vac level that require a minimum pickup operating voltage at the relay terminals.

b. 480- to 120-Vac regulating transformers that among other things supply control power to the solid state NSPS control system.

c. Continuous duty motors at 460-Vac can continuously operate at + 10% of 460-Vac.

From the equipment critical voltage analysis, it was determined that a minimum of 4084-V at the 4160-V buses will prevent the voltage at the equipment terminals of the above items from falling below their minimum acceptable voltage levels for equipment protection, starting and continued operation. Degraded voltage for motor operated valves has been properly considered in evaluating motor operated valve capability under NRC Generic Letter 89-10.

Based on setpoint calculations, a relay pickup setting was selected that allows sufficient margin between the minimum expected offsite voltage and the minimum required voltage at the 4160-V buses in conjunction with SVC operation.

When no offsite power is available, the operating configuration is to have the diesel generators as the source of power to the Class 1E power system.

The transfer of a 4160-V Class 1E bus from one source (RAT B to ERAT, etc.) to another can occur by: (a) manual transfer, (b) automatic fast transfer, or (c) automatic slow transfer (after loads have been shed).

The procedure for manually transferring a bus from one source to another is as follows:

a. Turn the incoming breaker synchronizing switch to ON

b. Verify synchronism or bring the incoming source into synchronism (if a diesel generator) with the bus and adjust the incoming voltage to nominally match the bus voltage.

c. Turn the incoming breaker control switch to CLOSE.

CHAPTER 08 8.3-6 REV. 17, OCTOBER 2015

INSERT The ERAT LTC can be operated in a manual or automatic mode.

• In the manual mode, an operator can make tap changes locally at the ERAT, and the changes may be made with the ERAT in service.

• In the automatic mode, a controller in the ERAT LTC raises or lowers the tap setting in response to grid voltage. A backup controller provides oversight of the primary controller, preventing tap movement above or below prescribed setpoints.