ML17150A302

Proposed License Amendment Request Open Phase Protection Per NRC Bulletin 2012-01

ML17150A302
Person / Time
Site:	Surry
Issue date:	05/23/2017
From:	Mark D. Sartain Dominion Energy Virginia, Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
17-188, BL-12-001
Download: ML17150A302 (56)

Text

....

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 May 23, 2017 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 PROPOSED LICENSE AMENDMENT REQUEST Serial No.:

NRA/GDM:

Docket Nos.:

License Nos.:

OPEN PHASE PROTECTION PER NRC BULLETIN 2012-01 10CFR50.90 17-188 RO 50-280/281 DPR-32/37 Industry operating experience and NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," identified industry issues involving the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01, Virginia Electric and Power Company (Dominion Energy Virginia) informed the NRC that plant design changes were being planned to address the potential for an open phase condition (OPC) at Surry Power Station (Surry) Units 1 and 2. Furthermore, by letters dated October 9, 2013 and March 16, 2015, the Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

As discussed in Attachment 1, Class 1 E negative sequence voltage (open phase) protective circuitry is being installed on the Surry Units 1 and 2 4160V emergency buses to address the potential for a consequential OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme. Therefore, pursuant to 10 CFR 50.90, Dominion Energy Virginia is submitting a license amendment request for Surry Units 1 and 2 to add operability requirements, required actions, instrument settings, and surveillance requirements to the TS for the 4160V emergency bus negative sequence voltage (open phase) protection function. provides a discussion and evaluation of the proposed change.

Marked-up TS pages and typed TS pages indicating the proposed change are provided in Attachments 2 and 3, respectively.

We have evaluated the proposed amendment request and have determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for this determination is included in Attachment 1.

We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released off-site or any significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion from an environmental assessment as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed ADDI N~~

Serial No.17-188 Docket Nos. 50-280/281 Page 2 of 3 change. The proposed TS change has been reviewed and approved by the Facility Safety Review Committee.

Dominion Energy Virginia requests approval of the proposed TS change by April 30, 2018. The typical time frame for implementing license amendments is 30 days after issuance. However, the 4160V emergency bus negative sequence voltage (open phase) protection function will be implemented during a different outage for each unit necessitating a different implementation schedule for Surry Units 1 and 2.

Consequently, Dominion Energy Virginia requests implementation of the proposed TS revisions to coincide with the completion of the spring 2018 refueling outage for Surry Unit 1 and the fall 2018 refueling outage for Surry Unit 2.

Should you have any questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.

Respectfully, Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support Commitments contained in this letter: None Attachments:

1. Discussion of Change

2. Marked-up Technical Specifications Pages

3. Proposed Technical Specifications Pages COMMONWEAL TH OF VIRGINIA

)

)

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mr. Mark D. Sartain, who is Vice President -

Nuclear Engineering and Fleet Support, of Virginia Electric and Power Company.

He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

/J/l, /

Acknowledged before me this

'.3'"1day of~*

2017.

My Commission Expires:

3.

~*X:$au Notary Public

cc:

U.S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Avenue, NE Suite 1200 Atlanta, GA 30303-1257 State Health Commissioner Virginia Department of Health James Madison Building - ih floor 109 Governor Street Suite 730 Richmond, VA 23219 Ms. Karen R. Cotton Gross NRC Project Manager - Surry U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 Mr. James R. Hall NRC Senior Project Manager - North Anna U.S. Nuclear Regulatory Commission One White Flint North Mail Stop 08 G-9A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Surry Power Station Serial No.17-188 Docket Nos. 50-280/281 Page 3 of 3 DISCUSSION OF CHANGE Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Station Units 1 and 2 Serial No.17-188 Docket Nos. 50-280/281

TABLE OF CONTENTS 1.0 Summary Description 2.0 Detailed Description 2.1 Existing System Design and Operation 2.2 Current Technical Specifications Requirements 2.3 Reason for Proposed Change 2.4 Description of Proposed Change 2.5 OPC Relay Surveillance Frequencies 3.0 Technical Evaluation 3.1 Open Phase Conditions Case Summary 3.1.1 Open Phase Conditions Considered 3.1.2 Open Phase Locations Considered 3.1.3 Generating Conditions Considered 3.1.4 Loading Conditions Considered 3.2 Calculations and Plant Analysis Methodology 3.2.1 Negative Sequence Analysis 3.2.2 Motor Analysis 3.2.3 Open Phase Event Timing 3.2.4 Security Cases 3.2.5 Setpoints 3.3 Design Solution 3.3.1 Class 1 E Design Solution Serial No.17-188 Docket Nos. 50-280/281 Page 1 of 38 3.3.2 Existing Plant Protection and Unique Operating Conditions 3.3.2.1 GSU Transformer Operating Conditions 3.3.2.2 EOG Test Configuration 3.3.3 Non-Class 1 E Design Solution 3.4 Failure Modes and Effects Analysis 4.0 Regulatory Evaluation

4.1 Background

4.2 Applicable Regulatory Requirements/Criteria 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion 4.2.2 General Design Criteria 4.2.3 10 CFR 50.55a(h)(2) Protection Systems 4.2.4 NRC Generic Letter 79-36 4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System 4.3 No Significant Hazards Consideration Analysis 5.0 Environmental Consideration 6.0 Conclusion 7.0 References

DISCUSSION OF CHANGE 1.0

SUMMARY

DESCRIPTION Serial No.17-188 Docket Nos. 50-280/281 Page 2 of 38 Industry operating experience and NRC Bulletin (NRCB) 2012-01, "Design Vulnerability in Electric Power System," (Reference 7.1) have identified industry issues that involve the loss of one or two phases of an off-site power circuit (i.e., an open phase condition) at certain nuclear power stations both nationally and internationally. In response to an NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Virginia Electric 'and Power Company (Dominion Energy Virginia) stated that plant design changes were being planned to address the potential for an open phase condition (OPC) at Surry Power Station (Surry) Units 1 and 2.

By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), tt:ie Nuclear Energy Institute (NEI) notified the NRC that the industry's Chief Nuclear Officers (CNOs) had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors.

As discussed below, Class 1 E negative sequence voltage (open phase) protection circuitry is being installed on the Surry Units, 1 and 2 4160V emergency buses to address the potential for a consequential OPC to exist on one or two phases of a primary off-site power source that would not currently be detected and mitigated by the existing station electrical protection scheme.

Consequently, appropriate operability requirements, required actions, instrument settings, and surveillance requirements (SRs), are being added to the Surry Technical Specifications (TS) to address this additional level of voltage unbalance protection for consequential OPCs.

2.0 DETAILED DESCRIPTION 2.1 EXISTING SYSTEM DESIGN AND OPERATION The "Surry station electrical power distribution system is shown in Figure 1. As depicted in Figure 1, there are four 4160V AC Engineered Safety Features (ESF) buses (two per unit (1 H and 1 J, and 2H and 2J)).

The circuits that supply power to the ESF (i.e., emergency) buses through System Reserve Transformer (SRT) Nos. 1, 2, and 4 are known as primary (or preferred) sources. Transformer No. 4 serves as a backup for loads supplied by either Transformer No. 1 or No. 2. Each primary source is capable of providing power to an ESF bus at each unit. Surry TS require a primary source for each ESF bus during power operation and startup.

The 34.5kV buses receive power from the three SRT transformers that ar~ provided power from the point of interconnect on the 500kV and 230kV levels. The 500-34.5kV Transformer No. 1 in the switchyard normally supplies 34.5kV Bus 5. Bus 5 normally supplies 34.5-4.16kV Reserve Station Service Transformer (RSST)-A and 34.5-4.16kV RSST-B, which are the preferred sources for ESF buses 1J and 2H, respectively.

Serial No.17-188 Docket Nos. 50-280/281 Page 3 of 38 The 230-34.5kV Transformer No. 2,in the switchyard normally supplies 34.5kV Bus 6.

Bus 6 normally supplies 34.5-4.16kV RSST-C, which is the preferred source for ESF buses 1 H and 2J.

The 230-34.5kV Transformer No. 4 in the switchyard normally supplies 34.5kV Bus 7. Bus 7 is normally energized and has the capability to supply the loads serviced by Transformer No. 1 or Transformer No. 2. The RSSTs then feed the 4160V Transfer Buses D, E, and F, and finally, the Transfer Buses supply the ESF buses and, alternately, the Station Service Buses.

Due to the electrical alignments discussed above, an OPC will not affect both emergency buses on one unit.

The RSSTs are normally available to the ESF buses and also have the necessary control logic and capacity to power certain station auxiliaries in the event of a loss of the normal AC power supply. The normally open feeder breakers from the RSSTs to the normal station service buses (1A, 1 B, 1 C, 2A, 2B, and 2C) are also depicted in Figure 1.

In addition to the "primary sources," each unit has an additional off-site power source, which is called the "dependable alternate source." This source can be made available within eight hours by removing a unit from service, disconnecting its main generator from the isolated phase bus, and feeding its off-site power source through the main step-up transformer and normal station service transformers to the emergency buses.

Both the primary off-site power sources and the dependable alternate source supply the emergency buses through the normal supply breakers (15H8, 15J8, 25H8, and 25J8).

Consistent with the current licensing basis and 10 CFR 50, Appendix A, General Design Criteria (GDC) 17, the existing safety related protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, degraded grid voltage and automatically transfer to an onsite alternate power supply (i.e., the Emergency Diesel Generators (EDGs)). The first level of undervoltage (UV) protection is provided by the loss of voltage relays, the function of which is to detect and disconnect the Class 1 E buses from the preferred power supply upon a total loss of voltage (75% of 4160V). Two of three UV relays are required to sense the loss of voltage condition to initiate tripping of the preferred off-site power supply. The second level of undervoltage protection is provided by the degraded voltage (DV) relays, which are set to detect a low-voltage condition (92.7% of 4160V). Two of three DV relays are required to sense the low voltage condition to initiate tripping of the preferred off-site power supply.

The onsite alternate power supply consists of three EDGs. Each EOG has sufficient capacity to power the required safe shutdown equipment for a single unit. The Unit 1 EOG and the Unit 2 EOG are dedicated to ESF buses 1 H and 2H, respectively. The third EOG is a "swing" diesel and is shared by Units 1 and 2. The swing EOG aligns to either ESF bus 1J or 2J. The EDGs are connected to the 4160V emergency buses and are able to pick up load within 10 seconds of a start signal. The Class 1 E loads are loaded onto the diesel generators sequentially.

Serial No.17-188 Docket Nos. 50-280/281 Page 4 of 38 2.2 CURRENT TECHNICAL SPECIFICATIONS REQUIREMENTS The Surry Units 1 and 2 TS currently contain operability requirements, required actions, instrument settings, and SRs for the 4160V Emergency Bus Loss of Power protective circuitry for loss of voltage and degraded voltage conditions as follows:

TS Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions," Items 4.a and b, specify the instrument operating conditions, TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting," Items 7.a and b, specify the required instrument settings, and TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations, and Test of Instrument Channels," Items 33.a and b, specify the protective circuitry SRs.

As discussed in Section 2.4, the proposed TS LCOs and SRs to address the new negative sequence voltage (open phase) protection function will be included as an additional item in the existing Loss of Power TS noted above (i.e., TS Tables 3.7-2, 3.7-4, and 4.1-1).

2.3 REASON FOR PROPOSED CHANGE An OPC is a single or double open electrical phase in a three phase circuit, with or without ground, that is located on the primary or high voltage side of a transformer connecting a credited off-site power circuit to the transmission system. The potential for an OPC to exist in an off-site power source was not previously recognized as a design vulnerability in the nuclear power industry and, therefore, was not considered in the original design of the Surry electrical power distribution system. However, based on an internal review of the January 2012 event at the Byron Nuclear Power Station, and the issuance of and response to NRC Bulletin 2012-01, Dominion Energy Virginia determined that Surry Power Station could also be susceptible to an OPC. Specifically, a consequential OPC could result in the affected off-site power source (i.e., the primary or preferred power source) being incapable of supplying sufficient power to perform its safety function.

While many OPCs would be addressed by the existing UV relays, some consequential OPCs are not readily detectable by the existing station electrical protection scheme at Surry Units 1 and 2. Without the implementation of design modifications, these OPCs may go undetected and unisolated using existing plant protection equipment. If the failed circuit remains connected to the Class 1 E ESF 4160V buses downstream, it could

• render the downstream onsite emergency power system incapable of performing its designated safety function.

As a result, as part of its design effort to detect and mitigate a potentially undetected consequential OPC, Surry is installing a Class 1 E protective relaying scheme on the ESF buses that provides an additional pathway for actuating the existing undervoltage protection functions and directly interfaces with the ESF actuation logic. Therefore, the

---

~

Serial No.17-188 Docket Nos. 50-280/281 Page 5 of 38 necessary operability requirements, required actions, instrument settings, and SRs for the negative sequence voltage (open phase) protection function are being incorporated into the Surry TS to ensure this protection circuitry is capable of performing its design safety function.

2.4 DESCRIPTION

OF PROPOSED CHANGE The proposed TS change adds the 4160V emergency bus negative sequence voltage (open phase) protective circuitry operability requirements, required actions, instrument settings, and SRs to the TS. A description of the proposed revision is provided below:

Surry TS Table 3.7-2, Engineered Safeguards Action Instrument Operating Conditions, Item 4, "Loss of Power," is revised to add Item 4.c, "4.16 kv emergency bus negative sequence voltage (open phase)," instrument operating condition requirements.

Operator Action 27 is also being added to identify the actions required when the number of operable negative sequence voltage (open phase) relay channels is less than the total number of channels, similar to the existing loss of voltage and degraded voltage protection circuitry. An additional action item "c" is included to address the condition where the OPC negative sequence voltage protection function cannot be performed (e.g., due to its Potential Transformer (PT)

Blocking Device being tripped.) Specifically, Action 27.c states that the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an OPC does not exist on the primary side of transformer TX-2, transformer TX-4, and the RSSTs, as well as the Unit 1/Unit 2 main step-up transformers when power is supplied by the dependable alternate source, until the negative sequence voltage (open phase) protection function has been returned to service.

If the negative sequence voltage (open phase) protection function has not been returned to service within 90 days, the plant shall be in at least HOT SHUTDOWN within the next six hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. Refer to Section 3.3.1 for additional discussion of the PT blocking device. In addition, Action 27.a notes that it does not apply if the OPC negative sequence voltage protection function cannot be performed.

Surry TS Table 3.7-4, "Engineered Safety Feature System Initiation Limits Instrument Setting," Item 7, "Loss of Power," is revised to add Item 7.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)," instrument setting limit.

An unbalanced voltage setting limit of less than or equal to 7% was determined based on the 6% relay setpoint with an applied 1 % device uncertainty (consistent with the Basler Relay Instruction Manual -

Reference 7.9.)

Surry TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," Item 33, "Loss of Power," is revised to add Item 33.c, "4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase),"

Serial No.17-188 Docket Nos. 50-280/281 Page 6 of 38 surveillance requirements.

Relay calibration and testing requirements will be added to the Surveillance Frequency Control Program (SFCP). The proposed OPC negative sequence voltage relays' calibration and testing frequencies to be included in the SFCP are "once per 18 months."

Marked-up TS Tables 3.7-2, 3.7-4, and 4.1-1 indicating the proposed changes and the typed proposed TS pages are provided in Attachments 2 and 3, respectively.

2.5 OPC RELAY SURVEILLANCE FREQUENCIES Surveillance of the OPC negative sequence voltage relays is required as defined in 10 CFR 50.36(c)(3) to "assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions for operation will be met." The proposed change revises TS Table 4.1-1, "Minimum Frequencies for Check, Calibrations and Test of Instrument Channels," to add a "Loss of Power" surveillance requirement for the negative sequence voltage (open phase) relays. Relay calibration and testing requirements are also added to the Surveillance Frequency Control Program (SFCP). As discussed in Section 3.0, Basler BE1-47N relays are being used in the negative sequence voltage (open phase) protection circuitry.

As noted above, the negative sequence voltage relays' calibration frequency to be included in the SFCP will be "once per 18 months." This calibration frequency is consistent with the existing Loss of Voltage and Degraded Voltage relays' calibration frequency.

However, while the existing test frequency for the loss of voltage and degraded voltage protective circuitry is "once per 92 days" in the SFCP, a test frequency of "once per 18 months" is specified for the negative sequence voltage relays* based on the following considerations:

1) The negative sequence voltage (open phase) protection function design includes a Plant Computer System (PCS) alarm to alert operators when a relay loses power, suffers a power supply failure, or experiences another failure that de-energizes the relay.

2) To trip the emergency bus and start the EOG, the negative sequence voltage relay scheme uses existing Loss of Voltage auxiliary relays which are tested every 92 days in accordance with the surveillance requirements for that relay scheme.

3) In accordance with the Basler relay instruction manual (Reference 7.9), the negative sequence voltage relays require no preventive maintenance other than a periodic operational check.

Although the manufacturer does not specify a periodicity for the operational check, the following information supports the selection of an 18-month test frequency for the negative sequence voltage relays:

Serial No.17-188 Docket Nos. 50-280/281 Page 7 of 38 The Basler relay being used (Model No. BE1-47N) is a solid state relay (SSR) device that has certain advantages over the electro-mechanical relays (EMR) used in the Loss of Voltage I Degraded Voltage protection schemes. These advantages include the absence of mechanical moving parts, less heat generation, less susceptibility to shock and seismic events, no inrush current, and no contact resistance issues. Also, SSRs are not susceptible to open and shorted coils, which can be a mechanism for mechanical relay failure. In addition, contacts on EMRs can have contact contamination, bounce, and arcing. These particular issues do not apply to the Basler SSRs.

The maximum electrical life of an EMR is the maximum permissible number of switch operations at a specified contact load under specified conditions.

SSR data sheets do not carry an electrical life specification like EMRs. Unlike the EMR, where life is dependent on actual switching load and number of cycles, SSR reliability is not associated with the number of switching cycles.

An SSR's lifetime expectation is considered "very long" versus "medium" for EM Rs.

Therefore, although the proposed test frequency for the negative sequence voltage relays is longer than the Loss of Voltage and Degraded Voltage relays' test frequency, the "once per 18 months" test frequency is reasonable and justified based on these considerations.

3.0 TECHNICAL EVALUATION

At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability, and manual actions were necessary to restore ESF functions.

Following the OPC events at BNPS in 2012, the NRC issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1).Bulletin 2012-01 requested information regarding the facilities' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2.Bulletin 2012-01 required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A... to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 10 CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

Consistent with the current Surry licensing basis and GDC 17 requirements, existing protective circuitry is sufficiently sensitive to detect design basis conditions such as a loss of voltage condition or a sustained degraded grid voltage condition and will separate the ESF buses from a connected failed source.

However, the existing protection schemes at Surry may not detect some consequential single or double OPCs on an off-site power source, and this design vulnerability may preclude electric power systems from adequately performing their intended safety functions.

Serial No.17-188 Docket Nos. 50-280/281 Page 8 of 38 By letters dated October 9, 2013 and March 16, 2015, NEI notified the NRC that the industry's CNOs had approved a formal initiative to address OPCs (References 7.3 and 7.4).

To address the possibility of an OPC on an off-site power source at Surry, design changes _are being developed to implement new protection schemes to protect plant equipment from a consequential OPC event, thus ensuring safety functions are preserved during an OPC. Specifically, Dominion is installing an open phase detection and protection system at Surry that uses Class 1 E voltage unbalance (negative sequence) relays (Basler BE1-47N relays) that will provide consequential OPC detection and protection on the 4160V Emergency Switchgear 1 H, 1 J, 2H, and 2J buses. The relays will be configured in a two out of three logic scheme that will detect consequential OPCs, trigger an annunciator in the control room indicating an OPC exists, and automatically initiate protection actions to mitigate the event. A blocking feature is also being included in the logic scheme to enhance the reliability of the protection system and to prevent undesired actuation in the event of a failed or degraded potential transformer (PT) as further discussed below.

In support of the planned OPC design changes, Dominion developed a series of models and analyses to determine: 1) the OPC vulnerabilities of the existing Surry onsite protection schemes for the safety buses, non-safety buses, and off-site power sources given various power source alignments and operating conditions, and 2) the plant and component responses to a consequential OPC.

The models and analyses are discussed below and provide the technical bases for the implementation of the planned negative sequence voltage (open phase) protection function.

3.1 OPEN PHASE CONDITIONS CASE

SUMMARY

NRC Branch Technical Position (BTP) 8-9 (Reference 7.8) provides guidance that was used to define Surry's OPC vulnerabilities. An OPC occurs when one or two phase conductor(s) become(s) disconnected from the transmission interconnections while the other phase conductor(s) remain(s) intact resulting in one of the following three conditions:

1. The energized line shorts to ground on the transmission side, so there is fault current to be detected and cleared by the switchyard protection scheme.

2. The energized line does not short to ground on the transmission side, so there may not be enough fault current to be detected and cleared by the switchyard protection scheme. The disconnected phase conductor(s) shorts to ground on the transformer end, connecting the transformer high-voltage (HV) winding to ground.

In those cases where two phase conductors open, one or two phase conductors may be connected to ground.

3. The energized line does not short to ground on the transmission side, so there is no fault current to be detected and cleared by the switchyard protection scheme. The

Serial No.17-188 Docket Nos. 50-280/281 Page 9 of 38 disconnected phase conductor(s) remains suspended above the ground at the transformer end and does not short to ground on the transformer end.

Each power source alignment or operating condition represents a unique case with the cases collectively representing the known configurations and alignments encountered during licensed operations. The OPCs, locations, generating conditions, and loading conditions considered in the cases are provided in the following sections. To address the potential OPCs and locations, the Surry licensed operating electrical system configurations and loading conditions were considered with and without a high impedance ground fault condition.

OPCs concurrent with an accident were also considered.

3.1.1 Open Phase Conditions Considered The analyses considered the following OPC conditions:

Single open phase on phases A, B, or C without a ground connection Single open phase on phases A, B, or C with a ground connection (on the transformer side)

Double open phase on phases A and B, B and C, or C and A without a ground connection Double open phase on phases A and B, B and C, or C and A with a ground connection (on the transformer side) 3.1.2 Open Phase Locations Considered The analyses considered the following OPC locations:

High side terminals of the Unit 1 Generator (Main) Step-up (GSU) Transformer High side terminals of the Unit 2 Generator (Main) Step-up (GSU) Transformer High side terminals of the #1 Switchyard Transformer High side terminals of the #2 Switchyard Transformer High side terminals of the #4 Switchyard Transformer High side terminals of the RSST-A Transformer High side terminals of the RSST-B Transformer High side terminals of the RSST-C Transformer 3.1.3 Generating Conditions Considered The analyses considered the following generating conditions:

Unit 1 online with Unit 2 offline

Unit 2 online with Unit 1 offline Both units offline Serial No.17-188 Docket Nos. 50-280/281 Page 10 of 38 Cases with both units online are bounded by the generating conditions considered above.

3.1.4 Loading Conditions Considered The analyses considered various transformer loading conditions (zero load through maximum) and plant alignments. The following conditions were considered:

Maximum RSST loading, which is presented with Unit 1 in Hi-Hi Consequence Limiting Safeguards (CLS), Unit 2 in Shutdown, and with both units Station Service buses supplied from the RSSTs.

Intermediate RSST loading (25%, 50%, and 75%); these loadings are based on the above maximum RSST loading scenario and modeled on each of the F, D, and E transfer buses.

No RSST loading; Emergency Switchgear 1 H, 1J, 2H, and 2J are energized but unloaded.

Maximum load on Unit 1 Station Service transformers during GSU1 backfeed scenario (Generation offline).

Maximum load on Unit 2 Station Service transformers during GSU2 backfeed scenario (Generation offline).

Diesel testing of EOG 1 (See section 3.3.3.2).

3.2 CALCULATIONS AND PLANT ANALYSIS METHODOLOGY The models and analyses developed to determine and evaluate the Surry OPC vulnerabilities are discussed below.

3.2.1 Negative Sequence Analysis Calculations were prepared to analyze the above OPCs to determine the levels of negative sequence voltage on the ESF buses from a connected failed source due to a single or double OPC.

The levels of unbalanced voltage determined to potentially affect plant operating equipment are discussed below.

A model was developed using the ElectroMagnetic Transients Program -

Restructured Version (EMTP-RV). This model includes a 3-phase representation of the system components including the transmission system source, generators, transformers, cables, and plant loads.

The model is used to determine the emergency system (Switchgear 1H, 1J, 2H, and 2J) voltages during various station events (faults, open phase, motor start, etc.) The various plant configurations,.

which include medium and low-voltage faults, motor starts, diesel testing, and open

Serial No.17-188 Docket Nos. 50-280/281 Page 11 of 38 phase events under various loading levels and operating scenarios were evaluated. The analysis evaluated *the plant's bounding electrical operations (low and high load cases) to ensure all OPC events were considered. This addressed both normal and accident operating conditions including diesel testing, backfeed, and Loss of Coolant Accident (LOCA) conditions.

The analytical limits and time delay of the negative sequence voltage (open phase) relays were also developed. These limits and time delays are used as input for the open phase relay setting calculation.

The negative sequence voltage relay settings should protect important to safety equipment on the 4kV emergency buses from consequential OPCs (with the exception of some OPCs on the primary side of non-safety-related Transformer TX-1) and remain secure for the maximum level of steady-state voltage unbalance at the switchyard bus.

The analytical limits were also determined for the negative sequence voltage protection relay settings that will ensure the safety functions are preserved during an OPC. The cases considered and signals monitored were selected for testing the open phase protection relays. The following steps were used to determine open phase detection analytical limits for the protection negative sequence voltage relays on the emergency system 4.16 kV Switchgear (1H, 1J, 2H, and 2J) for OP Cs:

Determine the case list to test the negative sequence voltage protection relaying scheme for an OPC concurrent with a LOCA.

Simulate these cases using the EMTP-RV model.

Analyze and tabulate the auxiliary system behavior (e.g., voltages, motor heating, and existing protective relay response) for each case.

Determine the analytical limits for the negative sequence voltage protection relays to ensure the safety functions are preserved during an OPC.

An OPC causes a voltage unbalance to the induction motors and motor-operated valves (MOVs), which introduces a negative sequence voltage.

This negative sequence voltage produces a flux in the air gap that opposes the rotation of the rotor. The resulting induced currents in the rotor are at twice the line frequency, which can cause additional heating in the rotor due to the skin effect (for higher frequency currents, the skin effect will increase the apparent rotor resistance, resulting in additional rotor heating).

This thermal capability also has to consider that Class 1 E motors restart on the EDGs after tripping from the unhealthy source. To account for this motor starting sequence, a total thermal limit (12

• t) of 20 pu (40 pu/2 starts) for Class 1 E motors during the open phase event concurrent with a LOCA is used as a bounding condition to ensure the motors have enough thermal capability to perform their safety functions.

Serial No.17-188 Docket Nos. 50-280/281 Page 12 of 38 National Electrical Manufacturers Association (NEMA) Standard MG-1 (Reference 7.5) states that for a voltage unbalance above 1 % of motor nameplate voltage, motor horsepower should be de-rated to account for the additional heat.

Conservatively (without including the effects of motor cooling), for a voltage unbalance greater than 5% (on the motor nameplate voltage base), the negative sequence voltage protection relays will trip and isolate the motor loads before the integrated negative sequence current squared times time (12

• t) is equal to 20 pu to allow for sufficient remaining thermal capability for the motors to restart on the ED Gs.

For a voltage unbalance between 1 % and 5%, the NEMA MG-1 de-rating factor was applied to the motor rating. If the brake horsepower (BHP) of the motor is less than the de-rated horsepower rating, then continuous operation of the motor was determined to be acceptable. In cases where the BHP is greater than the de-rated horsepower rating, the motor must be isolated from the faulted source.

3.2.2 Motor Analysis The Surry accident analyses were reviewed to determine the operational requirements for the motors and pumps. A review was performed to determine if operator action or plant response would allow the motors to be secured within the calculated specified motor heat-up times. The results of the review concluded this could not be achieved.

A review of the manufacturer data was also performed to determine if additional operational margin could be justified. This review concluded no additional margin could be provided.

Since no additional margin could be provided by these methods, the design solutions discussed in Section 3.3 were pursued for motor protection.

3.2.3 Open Phase Event Timing Based on Section 8.5 of the Surry Updated Final Safety Analysis Report (UFSAR),

for an OPC coincident with a Safety Injection (SI) or Consequence-Limiting Safeguards (CLS) signal, the emergency buses should be re-energized by the diesel generator within 10 seconds (the time delay assumed in the accident analysis), including a 2.2 second residual voltage time delay. To be within the time-frame considered in the accident analysis, the open phase protection relay tripping time delay should be less than or equal to 7 seconds for an ope coincident with an SI or CLS signal. This is consistent with the time delay used for degraded voltage protection during accident conditions. For the open phase cases in which the negative sequence protection relay trips, the tripping time of the combined negative sequence voltage relay and the existing undervoltage protection is less than 5 seconds after the OPC occurs.

For cases where the tripping time of the negative sequence voltage relay is 5 seconds or longer, the bus voltages on at least two of the three phases are less than the 2975V TS limit for actuation of the Loss of Voltage relay. Thus, for these cases, the Loss of Voltage

Serial No.17-188 Docket Nos. 50-280/281 Page 13 of 38 relay will dropout and trip after a two second time delay. This is within the time considered in the accident analysis for a loss of off-site power coincident with an accident.

It should be noted the channel statistical analysis (CSA) for the negative sequence voltage relay may delay the relay response time. A 6% relay pickup setting with a 10.0 time delay setting account for both positive and negative CSA and will ensure the relay would trip within the time considered in the accident analysis for a loss of off-site power coincident with an accident.

3.2.4 Security Cases The design of the negative sequence voltage (open phase) function needs to ensure that it will not actuate for non-OPCs, such as during normal operating conditions, unbalanced faults on the auxiliary system, and motor starts under various loading conditions. These normal operating conditions need to consider both time and magnitude of the negative sequence generated.

Plant cases identified in supporting calculations were used with the various transmission system unbalances discussed in Section 3.1 to test the negative sequence voltage (open phase) function algorithm's security.

The negative sequence voltage relay includes an inverse timing characteristic feature that is adjustable from 01 to 99 in increments of 1. The timing is based on the percent difference from the nominal system voltage. The calculated results show that with a time dial setting of 10.0, the negative sequence voltage relay was secure (i.e., would not issue an alarm) for the simulated unbalanced faults on the medium-voltage and low-voltage systems. The time dial setting of 10.0 provides sufficient time to allow existing overcurrent relaying to trip on the unbalanc'ed fault condition.

The calculated maximum negative sequence voltage on buses 1H, 1J, 2H, and 2J for steady state grid unbalance is 4.20V. This is less than the minimum negative sequence voltage relay pickup including CSA (4.28V for buses 1J and 2J and 5.35V for buses 1 H and 2H); thus, the relays will not pick up on maximum expected steady-state grid unbalance.

3.2.5 Setpoints Table 1 provides a summary of the maximum and minimum steady-state negative sequence voltages seen at Buses 1 H, 1 J, 2H, and 2J for OP Cs on the high voltage side of each transformer, which was then used to determine the appropriate setpoints.

Open Phase Location TX-1 TX-2 TX-4 RSST-A RSST-8 RSST-C GSU1 (Gen On)

GSU2 (Gen On)

GSU1 (Backfeed)

GSU2 (Backfeed)

Serial No.17-188 Docket Nos. 50-280/281 Page 14 of 38 Table 1 - Summary of Negative Sequence Voltages for Open Phase Conditions on Each Transformer Negative Sequence Voltage.(L-L rms, at 4200:120 PT Secondaries) t = 8s SWGR1H SWGR 1J SWGR2H SWGR2J MinV2 MaxV2 MinV2 MaxV2 MinV2 MaxV2 MinV2 MaxV2 0.17 66.57 0.17 68.46 14.82 58.8 14.84 58.89 14.82 58.82 '

15.05 59.64 13.39 61.27 14.53 58.91 18.62 59.64 16.45 61.5 16.86 58.82 16.88 58.92 1.28 10.45 0.13 10.61 0.17 10.96 1.28 10.46 0.12 2.11 0.16 6.69 0.2 6.91 0.12 2.11 0.74 31.7 0.74 31.83 0.74 31.62 0.74 31.7 0.85 35.68 0.85 35.57 0.85 35.63 0.85 35.68 The minimum negative sequence voltage seen at the emergency buses for an OPC on the primary side of Transformers TX-2, TX-4, RSST-A, RSST-B, and

• RSST-C that is not currently detected and cleared by existing relaying schemes is 13.39V (11.2% unbalance).

Considering the uncertainty of the channel, the lowest negative sequence voltage, and the highest security case negative sequence voltage, a setpoint of 6% was selected. A calculation was performed to determine the CSA for the Basler BE1-47N voltage phase sequence relays. The relay and PT inaccuracies and the final relay settings for the negative sequence voltage detection scheme were evaluated.

The maximum uncertainty (i.e., CSA) for the Basler relay at the 4kV emergency buses was calculated to be +/-2.4% of span (69.3V) or 1.68V. This is equivalent to 2.92V (~3*1.68) of line-to-line (120V) voltage.

With a 6% relay pickup setting (7.2V), the relay could pick up anywhere in the range of 4.28V to 10.12V as indicated in Figure 2.

3.3 DESIGN SOLUTION The aforementioned analyses demonstrate that two separate OPC systems are required to ensure important to safety components are protected and remain available to perform their design basis functions. These systems are the Class 1 E Basler voltage unbalance relays for protection of the 4kV emergency buses, and a non-Class 1 E

Serial No.17-188 Docket Nos. 50-280/281 Page 15 of 38 Alstom Open Phase Detection (OPD) System for OPC protection at switchyard Transformer TX-1.

The Class 1 E and non-Class 1 E OPC protection systems will protect plant equipment from the levels of negative sequence voltages as shown in Figure 2 below.

Figure 2 -OPC Negative Sequence Voltage Protection Negative Sequence Voltage 112%

t (13.39V)

The Basler relays are calculated to ak.vaystrip whenseeing>10.12V. ForOPCsatlX-2, TX-4and RSST A/B/C, the lowest negative sequence voltage seen is 13.39V, whichensuresthe OPCisdetected.

8.4%

{10.12V)

A 6% setpoint was chosen for the Basler BE-*nN relay and calculated to have a ;t2.4% maximum uncertainty. Theselevelsofvoltage unbalance are seen on the ESF buses during an OPCat the primaiv side of the GSU transformers.

r 3.6%

' ~

{4.28V}

These levels of voltage unba.lance are produced onlyatTX-1 during normal and accident conditions.

These levels are high enough to affect plant equipment. TX-1 is removed as a station off~ite power source when this condition is detected by the Alstom OPDSystem instalEed by the non-Class 1E solution.

1%

(1.2V)

I Inconsequential I

• ~

(Vz min p).;1 analyses)

/

---

r---

Margin to trip

_________ J 6%

{7.2V) setpoint l

+2.4%

lX-1

3.3.1 Class 1 E Design Solution Serial No.17-188 Docket Nos. 50-280/281 Page 16 of 38 The Surry open phase detection and protection system design is similar to the UV/DV protection scheme. The Class 1 E design solution consists of twelve Basler BE1-47N negative sequence relays arranged such that three relays are connected to each of the Emergency Bus (1 H, 1J, 2H, and 2J) PTs.

Three negative sequence relays and associated auxiliary relays will be used to develop a two out three logic scheme such that two or more relays must sense an unbalanced voltage greater than 6% (i.e., a consequential OPC) to initiate protection of the emergency bus.

A feature that blocks actuation of the negative sequence voltage (open phase) protection function is also included in the logic scheme. This feature enhances the reliability of the protection system and prevents the protection scheme from actuating in the event of a failed or degraded PT. To achieve this feature, one ASEA Brown Boveri (ABB) 60 voltage balance relay is installed per bus. The relay compares 4kV emergency bus PT three phase voltages with three 480V emergency bus PT single phase voltages. In summary, actuation of the negative sequence voltage (open phase) protection function for any given emergency bus requires the following events to be true:

A voltage imbalance greater than 6% has been sensed by two out of three negative sequence relays, The protection scheme is not blocked due to a failed or degraded PT, and The emergency bus is being fed from the normal supply breaker.

As noted in Section 3.2.4, the CSA for the proposed Basler relays was calculated to be +/-2.4%. Comparing the upper and lower limits of the trip setpoint to the minimum and maximum negative sequence voltages shown in Table 1 confirms the relay will provide adequate protection with an approximate 3.3V margin to trip, as the lowest negative sequence voltage not currently protected against is 13.39V.

As discussed in Section 2.4, the proposed TS change to Table 3.7-2, "Engineered Safeguards Action Instrument Operating Conditions", includes new Operator Action 27 for the negative sequence voltage (open phase) protective function.

New Operator Action 27 is being added to identify the actions required when the number of operable OPC negative sequence voltage relay channels is less than the total number of channels, similar to the existing loss of voltage and degraded voltage protection circuitry. An additional action item "c" is included to address the condition where the OPC negative sequence voltage protection function cannot be performed _(e.g., due to its PT Blocking Device being tripped.) Specifically, Action 27.c states that the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least

Serial No.17-188 Docket Nos. 50-280/281 Page 17 of 38 once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an OPC does not exist on the primary side of transformer TX-2, transformer TX-4, and the RSSTs, as well as the Unit 1/Unit 2 main step-up transformers when power is supplied by the dependable alternate source, until the negative sequence voltage (open phase) protection function has been returned.to service. If the negative sequence voltage (open phase) protection function has not been returned to service within 90 days, the plant shall be in at least HOT SHUTDOWN within the next six hours and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Refer to Section 3.3.1 for additional discussion of the PT blocking device. In addition, Action 27.a notes that it does not apply if the OPC negative sequence voltage protection function cannot be performed.

The acceptability of the addition of Action 27.c is supported by the following considerations:

A PT failure is considered a passive failure. An OPC is also considered a passive failure. Two independent, coincident, passive failures are not deemed credible.

The 480V and 4160V PTs have been inservice for over 40 years at Surry. No PT failure or OPC has been experienced to date and are highly unlikely to occur.

If an OPC is detected during the once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> verification activity, operations can transfer the loads to an alternate source (e.g., Transformer TX-4 or the EDGs).

Even if an OPC were to occur while the open phase protection function cannot be performed, e.g., if the PT blocking device is tripped thereby rendering the negative sequence voltage protection function inoperable, only one train of emergency power per unit would be affected.

As noted in the NEI letter from Anthony Pietrangelo to William M. Dean of the NRC, dated March 22, 2016 (Reference 7.10), Section 4.2 states, "Although precise probability numbers do not exist, analyses performed for the Byron Station indicated that, subsequent to the installation of the OPIS [Open Phase Isolation System], the core damage frequency (CDF) associated with an OPC and failure of an OPIS coupled with the failure of operator actions is on the order of 1 E-8 per year." Section 4.4 also states that, "... even without the consideration of an OPIS, when considering the training and compensatory actions that were completed in response to the Byron Station, Unit 2 event, the change in CDF for Byron Station OPCs is estimated to be 6E-7 per year, indicating that the addition of an OPIS is not a safety-significant change."

The March 22, 2016 NEI letter (Reference 7.10) states in Section 4.3, Table 1, that if the OPIS is non-functional, temporary compensatory measures can be

Serial No.17-188 Docket Nos. 50-280/281 Page 18 of 38 used until the OPIS is restored to functional status. A verification required once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an OPC does not exist while the open phase protection function cannot be performed is specified in proposed TS Table 3.7-2, Action 27.c, and is consistent with this criterion. This action is also consistent with the interim corrective actions that Surry implemented in response to the NRC RAI for NRC Bulletin 2012-01 (Reference 7.2).

Specifically, a Daily Operations Rounds procedure was revised to visually verify that the lines to the switchyard off-site supply transformers are intact.

3.3.2 Existing Plant Protection and Unique Operation Conditions 3.3.2.1 GSU Transformer Operating Conditions With the generator online, an OPC on the high voltage side of a GSU transformer results in voltage unbalance at the switchyard bus, which can be seen at the 4kV emergency buses fed from the RSSTs.

The generators have negative sequence current protection and impedance relay schemes which would operate and mitigate single and double OPCs on the high voltage side of a GSU transformer to trip the generator and clear the unbalance.

With the generator offline and the emergency buses in backfeed configuration, for single OPCs on the primary side of GSU1 and GSU2 transformers, the highest negative sequence voltage seen at the 4kV switchgear is 1.19V, which corresponds to a 1 % voltage unbalance.

Based on the requirements of NEMA MG 1, induction motors can operate continuously without de-rate for a voltage unbalance of 1.0% or less.

These inconsequential OPCs are not required to be detected or mitigated as they do not affect operating equipment.

With the generator offline and the emergency buses in backfeed configuration, for double OPCs on the primary side of GSU1 and GSU2 transformers, the lowest negative sequence voltage seen at the 4kV emergency buses is 31.51V.

The Basler negative sequence voltage relays will detect the OPCs and initiate transfer of the safety related buses to the onsite emergency power system to protect plant equipment for these cases.

3.3.2.2 EOG Test Configuration For an EOG test concurrent with a single ungrounded OPC, the diesel test could mask the OPC by balancing the voltage at the 4kV buses.

Consequently, the negative sequence voltage relays would not mitigate the voltage unbalance during a parallel EOG test.

However, the 'OPC would only affect one 4kV emergency bus per unit since the off-site power sources are independent of one another. If an accident were to occur during EOG testing, the alternate 4kV emergency bus would be available

Serial No.17-188 Docket Nos. 50-280/281 Page 19 of 38 to mitigate the accident. When the EOG is taken offline after completion of testing, the voltage unbalance at the 4kV emergency bus would increase above the 6% pickup setting and initiate protection of the bus.

During non-accident conditions, the operating safety related motors have a BHP of less than or equal to nameplate horsepower. Therefore, the motors would be capable of operating continuously for an OPC during non-accident conditions.

This conclusion is based on the negative sequence voltage unbalance expected at the bus, the corresponding NEMA MG-1 de-rating factor, motor service factor, and nameplate horsepower.

3.3.3 Non-Class 1 E Design Solution As shown in Table 1 and Figure 2 above for switchyard Transformer TX-1, there are OPCs that result in a negative sequence voltage between 1 % and 3.66% on the safety buses. This is above the 1 % unbalance threshold (which means it could affect plant equipment), and below the Basler relay capabilities (which means it could potentially go undetected). Therefore, a non-Class 1 E Alstom OPD system is required on Transformer TX-1 because consequential OPCs on the primary side of the transformer would otherwise go undetected. This section is provided for information only as no TS changes are required for the non-Class 1 E system.

3.4 FAILURE MODES AND EFFECTS ANALYSIS The purpose of the Failure Modes and Effects Analysis is to identify potential negative sequence voltage (open phase) protection function failure modes and evaluate their impact on the design to preclude subsequent operational concerns.

The protection relays are configured in a two out of three logic scheme such that the failure of or false indication from any one relay will not actuate the open phase protection circuitry.

The protection relays can have a contact set fail open or fail closed. Coils can fail to energize or de-energize. The result of a coil failure is the same failure impact as a contact failing to change state. The relays can fail to operate when a consequential OPC exists or operate when a consequential OPC does not exist. However, there is minimal impact since a two out of three relay logic is being used such that one failed relay does not cause inoperability of the negative sequence voltage (open phase) protection function.

If one protection relay fails to operate when a consequential OPC occurs, the other relays in the two out of three logic scheme provide protection. If one protection relay operates inadvertently, there is no impact since the actuation of protection features requires the operation of two out of three relays.

If a voltage balance relay used for open phase protection blocking fails to operate, the protection logic may engage due to an event other than an open phase such as

Serial No.17-188 Docket Nos. 50-280/281 Page 20 of 38 a PT failure. Failure of the blocking feature does not prevent actuation of the open phase protection scheme. If a voltage balance relay used for open phase protection blocking operates inadvertently, then an alarm will be provided on the PCS alerting operators of the condition. During this time, open phase protection will be disabled.

Fuses in the logic circuits can fail open or fail shorted (Fails to Interrupt). Fuses are installed on each phase at the input to each relay. One failed open fuse will actuate the negative sequence relay with which the fuse is associated. However, the open phase protection logic will not engage due to the two out of three logic scheme. In a fail to interrupt scenario, an upstream protective device would actuate thereby protecting the integrity of the circuits. The impact of this failure is consistent with a blown fuse at the PT.

Emergency bus PTs contain separate windings for each of the three phases. Each phase can suffer loss of power input, loss of power output, and phase degradation failures.

For two out of three phases experiencing a loss of-power failure, the existing Undervoltage protection relays sense the failure as a loss of off-site power and start the EOG, trip the normal supply breaker, and take other actions according to that protection scheme. A degraded PT phase or single phase failure would not be sensed by the Undervoltage/Degraded Voltage protection scheme since those schemes sense voltages from all three phases and engage on two out of three logic.

For the open phase protection scheme, a voltage balance relay senses emergency bus PT loss of power output or PT phase degradation and blocks the open phase protection logic from actuating.

The new relays require DC power and are powered from the emergency 125 voe distribution system. the 125 voe used to power these new relays is obtained from the same 125 VDC battery source supplying the control circuit for undervoltage protection. A new branch circuit from this source with a new set of fuses is implemented for the open phase relay scheme. Since they are fed from the same source, a loss of the DC power supply affects both the Undervoltage and OPC schemes. Energization and de-energization of an open phase or voltage balance relay does not cause the output contacts to change state; therefore, an open phase tripping signal or protection scheme block is not actuated upon loss of power. If loss of power occurs after an output contact has changed state, the contact will revert back to its shelf state. Upon de-energization of an open phase relay, a PCS alarm indicates the loss of power via closure of a power supply status contact and OPC protection would be disabled.

Cable failures are classified as passive failures. The result of a cable failure is the same as the failure of the component to which it is connected. Power cable failures would result in an equipment loss of power. Control cable failures would result in a failure of the specific component (e.g., change of state of a relay contact) and are therefore encompassed by the failures discussed above.

4.1 BACKGROUND

Serial No.17-188 Docket Nos. 50-280/281 Page 21 of 38 NRC Bulletin 2012-01 -At Byron Nuclear Power Station (BNPS), both off-site and onsite electric systems were not able to perform their intended safety functions due to the OPC design vulnerability.

Manual actions were necessary to restore ESF functions.

Following the OPC events at BNPS in 2012, the NRC issued Bulletin 2012-01, "Design Vulnerability in Electric Power Systems" (Reference 7.1 ).

NRC Bulletin (NRCB) 2012-01 requested inforr:nation regarding the facilities' electric power system design in light of the OPC events that involved the loss of one of the three phases of the off-site power circuits at BNPS Unit 2. The bulletin required licensees to "comprehensively verify their compliance with the regulatory requirements of General Design Criterion (GDC) 17, 'Electric Power Systems,' in Appendix A... to 10 CFR Part 50 or the applicable principal design criteria in the updated final safety analysis report; and the design criteria for protection systems under 10 CFR 50.55a(h)(2) and 10 CFR 50.55a(h)(3)."

In accordance with the Surry licensing basis and consistent with GDC 17, existing protective circuitry will separate the ESF buses from a connected failed source due to a loss of voltage or a sustained, degraded grid voltage.

However, while the existing protective devices are sufficiently sensitive to detect design basis conditions such as loss of,voltage or degraded voltage, they were not designed to detect consequential single or double OPCs.

NEI Industry Initiative on Open Phase Condition - By letters dated October 9, 2013 and March 16, 2015 (References 7.3 and 7.4), NEI notified the NRC that the industry's CNOs had approved a formal initiative to address OPCs, and that the initiative represented a formal commitment among nuclear power plant licensees to address the OPC design vulnerability for operating reactors. An OPC is defined by the initiative as an open phase, with or without a ground, which is located on the high voltage side of a transformer connecting a GDC 17 off-site power circuit to the transmission system. The initiative provides the following criteria for dealing with an adverse OPC:

Detection, Alarms, and General Criteria, Actuation Circuits, and Protective Actions.

Table 2 provides a comparison of the Surry negative sequence voltage (open phase) protection function design to the NEI industry initiative criteria.

The March 16, 2015 NEI letter specified December 31, 2018 as the completion date for implementation of the actions required to resolve the OPC design vulnerability. As noted in the initiative, this date assumed license amendments are not required to install any design changes. This is not the case for Surry as a Class 1 E modification is being installed, with the commensurate need for additional TS requirements. In addition, in

Serial No.17-188 Docket Nos. 50-280/281 Page 22 of 38 Surry's response to the NRC request for additional information (RAI) associated with NRCB 2012-01 (Reference 7.2), Dominion stated that the NEI initiative completion date could not be met for the OPC modifications at Surry and instead specified a December 31, 2019 completion date.

However, Dominion is currently planning to complete the Surry Units 1 and 2 OPC modifications by the completion of the 2018 fall Unit 2 refueling outage, which would meet the December 31, 2018 completion date specified in the NEI Initiative.

4.2 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA 4.2.1 Comparison to 10 CFR 50.36 Criteria for TS Inclusion The need to include the proposed negative sequence voltage (open phase) protection function operability and surveillance requirements into the Surry TS was evaluated against the 10 CFR 50.36(c) criteria, and it was it was determined to meet Criterion 3 of 10 CFR 50.36(c)(2)(ii) as discussed below.

Criterion 3 states:

A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

The operability of the station electric power sources is part of.the primary success path for mitigating an accident assuming a loss of all onsite AC power sources (e.g., loss of all EDGs). An operable off-site power circuit must be capable of maintaining rated frequency and voltage while connected to the Emergency Safeguards Features (ESF) buses and accepting required loads during an accident. Similar to the loss of voltage and degraded voltage protective circuitry, the negative sequence voltage (open pha~e) protection circuitry is integral to the operability of the off-site power system and ensuring that it is capable of performing its design function of powering the 4160V ESF buses.

Therefore, the Surry negative sequence voltage (open phase) protection circuitrY satisfies Criterion 3 for inclusion in the TS.

4.2.2 General Design Criteria The regulations in Appendix A to Title 10 of the Code of Federal Regulations (10 CFR)

Part 50 establish minimum principal design criteria for water-cooled* nuclear power plants, while 10 CFR 50 Appendix B and the licensee quality assurance programs establish quality assurance requirements for the design, manufacture, construction, and operation of structures, systems, and components. The current regulatory requirement of 10 CFR 50 Appendix A applicable to the proposed change is GDC 17 (Electric Power Systems).

Serial No.17-188 Docket Nos. 50-280/281 Page 23 of 38 During the initial plant licensing of Surry Units 1 and 2, it was demonstrated that the design of the Surry electrical distribution system met the regulatory requirements in place at that time. The draft GDC published in 1967 included Criterion 39 (Emergency Power for Engineered Safeguards), which is pertinent to the proposed change. The GDC included in Appendix A to 10 CFR 50 did not become effective until May 21, 1971.

The Construction Permits for SPS Units 1 and 2 were issued prior to May 21, 1971; consequently, Surry Units 1 and 2 were not subject to current GDC requirements (SECY-92-223, dated September 18, 1992). However, subsequent reviews of the Surry,

electric distribution system considered the current GDC 17 requirements.

Specifically, GDC 17 requires that all current operating plants have at least two operable circuits between the off-site transmission network and the onsite Class 1 E (safety related) AC electrical power distribution system. In addition, the surveillance requirements require licensees to verify correct breaker alignment and indicated power availability for each required off-site circuit. Consistent with the current Surry licensing basis and GDC 17 requirements, existing protective circuitry will sep.arate the ESF buses from a connected failed source due to a loss of voltage or a sustained, balanced degraded grid voltage. To address the potential for a consequential OPC to exist on an off-site power source, a negative sequence voltage (open phase) protection function is being installed at Surry, and associated TS are being implemented as described in Section 2.4.

The purpose of the negative sequence voltage (open phase) protection function is to mitigate the potential vulnerability of an OPC on a GDC 17 off-site power source. This is achieved with the implementation of the negative sequence voltage (open phase) protection function, which addresses OPCs on the high voltage side of the RSSTs, GSU transformers, and switchyard transformers.

The negative sequence voltage (open phase) protection circuitry is a Class 1 E design, and the two out of three logic open phase protection scheme ensures a single failure in the equipment installed will not prevent the Electric Power (EP) system from independently supplying the electric power required for operation of safety re,lated systems.

The capacity, capability, and redundancy of the EP system are not changed by the implementation of the negative sequence voltage (open phase) protection function; therefore, the station's ability to meet the requirements of GDC 17 is maintained and enhanced.

4.2.3 10 CFR 50.55a(h)(2) Protection Systems 10 CFR 50.55a(h)(2) requires nuclear power plants with construction permits issued after January 1, 1971, but before May 13, 1999, to have protection systems that meet the requirements stated in either Institute of Electrical and Electronics Engineers (IEEE)

Standard 279, "Criteria for Protection Systems for Nuclear Power Generating Stations,"

or IEEE Standard 603-1991, "Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, 1971, protection systems must be

Serial No.17-188 Docket Nos. 50-280/281 Page 24 of 38 consistent with their licensing basis or meet the requirements of IEEE Standard 603-1991 and the correction sheet dated January 30, 1995. The construction permits for Surry Units 1 and 2 were issued prior to January 1, 1971; consequently, their protection systems must be consistent with their licensing basis.

4.2.4 NRC Generic Letter 79-36 In accordance with the NRC Generic Letter 79-36 dated August 8, 1979, entitled "Adequacy of Station Electrical Distribution System Voltages" (Reference 7.6),

Dominion performed analyses to determine the adequacy of the Surry electrical distribution system. The review consisted of:

1. Determining analytically the capacity and capability of the off-site power system and onsite distribution system to automatically start and operate the required loads within their required voltage ratings in the event of: (1) an anticipated transient or (2) an accident (such as a LOCA) without manual shedding of any electric loads.

2. Determining if there are any events or conditions that could result in the simultaneous or consequential loss of both required circuits from the off-site network to the onsite electrical distribution system and thus violate the requirement of GDC 17.

The NRC determined that the Surry off-site power system and the onsite distribution system are capable of providing acceptable voltages for worst case station electric load and grid voltages (Reference 7.7).

The criteria the NRC used in performing their technical evaluation of the Dominion analysis included GDC 5 (Sharing of Structures, Systems, and Components), GDC 13 (Instrumentation and Control), and GDC 17 (Electric Power System) of Appendix A to 10 CFR 50, IEEE Standard 308-1974, ANSI C84.1-1977, and the staff positions and guidelines included in Generic Letter 79-36.

4.2.5 NRC Branch Technical Position (BTP) 8-9 Open Phase Conditions in Electric Power System As noted above, since no regulatory requirements or guidance documents describing the treatment of an OPC previously existed, the NRC issued BTP 8-9 in July 2015 (Reference 7.8) to provide NRC reviewer guidance for evaluating the adequacy of a licensee's design for addressing the potential for an OPC in their off-site electric power system.

Surry used the BTP as guidance during the development of the negative sequence voltage (open phase) protection circuitry. Table 2 compares the Surry design to the BTP criteria.

4.3 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Serial No.17-188 Docket Nos. 50-280/281 Page 25 of 38 Virginia Electric and Power Company (Dominion Energy Virginia) proposes a change to the Surry Power Station (Surry) Units 1 and 2 Technical Specifications (TS) pursuant to 10 CFR 50.90. The proposed change adds operability requirements, required actions, instrument settings, and surveillance requirements for the negative sequence voltage (open phase) protection function associated with the 4160V emergency buses. The negative sequence voltage (open phase) protection function provides detection and isolation of one or two open phases (i.e., an open phase condition) on a TS required off-site primary (preferred) power source and initiates transfer to the onsite emergency power source, i.e., the emergency diesel generators (EDGs).

In accordance with the criteria set forth in 10 CFR 50.92, Dominion Energy Virginia has performed an analysis of the proposed TS change and concluded that it does not represent a significant hazards consideration. The following discussion is provided in support of this conclusion:

1. Does the change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change adds operability requirements, required actions, instrument settings, and surveillance requirements for the negative sequence voltage (open phase) protection function associated with the 4160V emergency buses.

This system provides an additional level of undervoltage protection for Class 1 E electrical equipment. The proposed change will promote reliability of the negative sequence voltage (open phase) protection circuitry in the performance of its design function of detecting and mitigating an open phase condition (OPC) on a required off-site primary power source and initiating transfer to the onsite emergency power source.

The new negative sequence voltage (open phase) protection function will further ensure the normally operating Class 1 E motors/equipment, which are powered from the Class 1 E buses, are appropriately isolated from a primary off-site power source experiencing a consequential OPC and will not be damaged. The addition of the negative sequence voltage (open phase) protection function will continue to allow the existing undervoltage protection circuitry to function as originally designed (i.e.,

degraded and loss of voltage protection will remain in place and be unaffected by this change). The proposed change does not affect the probability of any accident resulting in a loss of voltage or degraded voltage condition on the Class 1 E electrical buses and will enhance station response to mitigating the consequences of accidents previously evaluated as this change further ensures continued operation of Class 1 E equipment throughout accident scenarios.

Serial No.17-188 Docket Nos. 50-280/281 Page 26 of 38 Specific models and analyses were performed and demonstrated that the proposed negative sequence voltage (open phase) protection function, with the specified operability requirements, required actions, instrument settings, and surveillance requirements, will ensure the Class 1 E system will be isolated from the off-site power source should a consequential OPC occur. The Class 1 E motors will be subsequently sequenced back onto the Class 1 E buses powered by the EDGs and will therefore not be damaged in the event of a consequential OPC under both accident and non-acciqent conditions.

Therefore, the Class 1 E loads will be available to perform their design basis functions should a loss-of-coolant accident (LOCA) occur concurrent with a loss-of-off-site power (LOOP) following an OPC.

The loading sequence (i.e., timing) of Class 1 E equipment back onto the ESF bus, powered by the EOG, is within the existing degraded voltage time delay.

The addition of the new negative sequence voltage (open phase) protection function will have no impact on accident initiators or precursors and does not alter the accident analysis assumptions.

Based on the above, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not alter the requirements for the availability of the 4160V emergency buses during accident conditions. The proposed change does not alter assumptions made in the safety analysis and is consistent with those assumptions.

The addition of the negative sequence voltage (open phase) protection function TS enhances the ability of plant operators to identify and respond to an OPC in an off-site, primary power source, thereby ensuring the station electric distribution system will perform its intended safety function as designed.

The proposed TS change will promote negative sequence voltage (open phase) protection function performance reliability in a manner similar to the existing loss of voltage and degraded voltage protective circuitry.

The proposed change does not result in the creation of any new accident precursors; does not result in changes to any existing accident scenarios, and does not introduce any operational changes or mechanisms that would create the possibility of a new or different kind of accident. A failure mode and effects review was completed for postulated failure mechanisms of the new negative sequence voltage protection function and concluded that the addition of this protection function would not affect the existing loss,of voltage and degraded voltage protection schemes; would not affect the number of occurrences of degraded voltage conditions that would cause the actuation of the existing Loss of Voltage, Degraded

Serial No.17-188 Docket Nos. 50-280/281 Page 27 of 38 Voltage or negative sequence voltage protection relays; would not affect the failure rate of the existing protectior:i relays; and would not impact the assumptions in any existing accident scenario.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does this change involve a significant reduction in a margin of safety?

Response: No.

The proposed change enhances the ability of the plant to identify and isolate (an)

.open phase(s) in an off-site, primary power source and transfer the power source for the 4160V emergency buses to the onsite emergency power system. The proposed change does not affect the dose analysis acceptance criteria, does not result in plant operation in a configuration outside the analyses or design basis, and does not adversely affect systems that respond to safely shutdown the plant and to maintain the plant in a safe shutdown condition.

With the addition of the new negative sequence voltage (open phase) protection function, the capability of Class 1 E equipment to perform its safety function will be further assured and the *equipment will remain capable of mitigating the consequences of previously analyzed accidents while maintaining the existing margin to safety currently assumed in the accident analyses.

Therefore, the proposed TS change does not involve a significant reduction in a margin of safety.

Based on the discussion above, Dominion Energy Virginia concludes that the proposed

, TS change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a determination of "no significant hazards consideration" is justified.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i)

The proposed change involves no significant hazards consideration.

As described in Section 4.3 above, the proposed change involves no significant hazards consideration.

Serial No.17-188 Docket Nos. 50-280/281 Page 28 of 38 (ii)

There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off-site.

The proposed change implements new TS requirements for the negative sequence voltage (open phase) protection function and as such does not involve the installation of any new equipment or the modification *of any equipment that may affect the types or amounts of effluents that may be released off-site.

The proposed change will have no impact on normal plant releases and will not increase the predicted radiological consequences of accidents postulated in the UFSAR. There are no significant changes in the types or significant increase in the amounts of any effluents that may be released off-site.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change implements new TS requirements to enhance the ability of the plant to identify and isolate (an) open phase(s) in an off-site, primary power source and transfer the power source for the 4160V emergency buses to the onsite emergency power system. The proposed TS change does not implement plant physical changes or result in plant operation in a configuration outside the plant safety analyses or design basis. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure associated with the proposed change.

Based on the above, Dominion concludes that, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 CONCLUSION

The proposed TS change adds operability requirements, required actions, instrument settings, and SRs for the 4160V emergency bus OPC negative sequence voltage relays in TS Tables 3.7-2, 3.7-4, and 4.1-1, respectively.

The design function of the Emergency Power System and the station's compliance with GDC 17 are being enhanced by the proposed change as it facilitates the detection of and protection-from 1 an OPC on the primary off-site power source. Additionally, the proposed TS change does not physically alter plant equipment and does not affect the safety analyses.

Therefore, Dominion concludes, based on the considerations discussed herein, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issua.nce of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES Serial No.17-188 Docket Nos. 50-280/281 Page 29 of 38 7.1 NRC Bulletin 2012-01, "Design Vulnerability in Electric Power System," dated July 27, 2012. (ML12074A115) 7.2 Letter from Virginia Electric and Power Company to the NRC, "Response to Request for Additional Information (RAI) Regarding Initial Response to NRC Bulletin 2012-01, Design Vulnerability in Electric Power System," dated February 3, 2014 (Serial No.13-678). (ML14035A458) 7.3 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition," dated October 9, 2013. (ML13333A147) 7.4 Letter from NEI to NRC, "Industry Initiative on Open Phase Condition, Revision 1," dated March 16, 2015(ML15075A455/6).

7.5 NEMA MG-1-2009, Motors and Generators.

7.6 NRC Generic Letter 79-36, "Adequacy of Station Electrical Distribution System Voltages," dated August 8, 1979.

7.7 Letter from NRC to Virginia Electric and Power Company dated October 6, 1982 providing the Safety Evaluation for Surry Power Station Units 1 and 2 regarding the Adequacy of Station Electric Distribution System Voltages.

7.8 NRC Standard Review Plan, Rev. 0, "Branch Technical Position (BTP) 8-9",

July 2015.

7.9 Basler Electric Instruction Manual for BE1-47N Voltage Phase Sequence Relay, Publication 9170400990, Revision K.

7.10 Letter from Anthony R. Pietrangelo of NEI to William M. Dean of the NRC dated March 22, 2016, "

Subject:

Industry Position on Open Phase Conditions (OPC) in

• Electronic Power System which Lead to Loss of Safety Functions of both Off-site and Onsite Power Systems (NRC Bulletin 2012-01)."

1UICV --

1 I

I I

I I

~T.,..._

ABll *--,

QT11R G'll8I ~

@ -r"l I

01TIMO 21<<1M auas~

...._7 L1Cll!

172 m

H104M 571112

~

XFMR

n.

llWYD llT SER 2 aJS I (34.5 KV) 112 81117 412

!i72 (14.1 l'I)

WUR -

!11113111 B%1917 5all2 G2llll llUS Z<-IM um

... -BRF

.i2 Serial No 17-188 Docket Nos. 50-280/281, Page 30 of 38 Ll!Gl!ND IAOWM

-DT--

RACK

-E~ER-11..UE

-F,_R:RBUll ClllEEll

- SWION 8EJMCE 0

PINK

- IWITCHYAAD Dll'TRlllUTION OMNGE

- "H" EIEAIEHC'I' -

0 l'UV'lE

- *.r EMERlENCYBUI llBl

-VITALllUS I 0 ~ - VITALllUS I 0

UOllT LUE - VITAL-

• 0 VEl.LOW

- VITALllUS Pi

-- - ------ - - ---------- ----- - -- -- -- - -- - - - ----- -~- ~-- - --- - - - - - ----- - ---- - - - --- -- ---- --- -- --- - --- - ----

1901 10 2G 04M1-1 04M1~

OM1 T

1a.1)

~

14CS-7)

~T c

111'1

~---- UNlERGAOUN0 6 I!

llA1-1 l

'-----+--+-+---_.----+--..--...-------+---+--~

WHTE YB10W TIIAIN '9' Plff'LE 1111 w.c:vrw.*us Rea.Xl'MR 480-111111, 18

~

RELJl'f Aloi

-Aloi

"°111)

~I).. Dll! 1)

..,. UNIT!

'--------.v _____

N'P'_R_,

Rm 11We N01E8:

1. MOLDED CAllEllWIT'O\\ llON-Alll'O. NO OVE1ICURREHT PRCJJECTION It. MOLDED CABE 11REA1CEA. NOIMUTO, NOOVERCURAENT PAOTI:CTION Figure 1 SURRY POWER STATION ELECTRICAL POWER DISTRIBUTION For Information Only R9111sed:01/23/2017 -----*

• • ~~~g~,*~,ir~*q~*sj~~'.¥c*~~~.~H}~~~~~,~t~I;;

.... ;,\\f~:~

1

~l~b-~~~,~~~~!:t~itl~i,i~~;*.***::~,;::i,it ;;~~'~qf~tagc;~'LJ~C,~~~~~ff ~p~1~,g~

An open phase condition must be detected and alarmed in the control room unless it can be shown that the open phase condition does not prevent functioning of important-to-safety structures, systems, and components.

For example, transformers that are oversized for their loading conditions may compensate for the open phase condition.

Where such credit is taken, sufficient "robust" calculational bases or tests must be provided to show that the open phase condition will not adversely affect important-to-safety equipment performance.

If it is demonstrated that an open phase condition does not prevent the functioning of important-to-safety structures, systems, and components, then detection of the open phase condition should occur within a reasonably short period of time (e.g. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). How the open phase condition is detected and corrected must be documented.

The open phase condition should be automatically detected and alarmed in the main control room under all operating electrical system configurations and plant loading conditions.

If the plant auxiliaries are supplied from the main generator and the off-site power circuit to the ESF bus is configured as a standby power source, then any failure (i.e., open phase condition) should be alarmed in the main control room for operators to take corrective action within a reasonable time. In such cases, the consequences of not immediately isolating the degraded power source should be evaluated to demonstrate that any subsequent design bases conditions that Serial No.17-188 Docket Nos. 50-280/281 Page 31of38 Surry is installing negative sequence voltage (open phase) protection circuitry to enhance the ability of plant operators to identify and respond to an OPC in an off-site, primary power source. OPCs that produce unbalanced voltages above the protective circuitry relay setpoint will result in annunciator alarms in the Main Control Room and on the Plant Computer System (PCS).

Consequential OPCs that could prevent the functioning of important-to-safety SSCs will be continuously monitored and alarmed by the protection schemes being implemented.

Inconsequential OPCs not automatically detected are shown through analyses to consist of high impedance-to-ground OPCs that can reasonably be expected to be detected by observation of a broken bus or insulator. Operator inspections of the auxilia and switch ard ower

Serial No.17-188 Docket Nos. 50-280/281 Page 32 of 38

• ,i;*j;

  " ~~~~~~2*:-,p.E~,~~,:C~MPb*t~CEiw1+~*::r~~*'~'e;l.6e~~."~\\~~S:~tlNITl~~1-1vE::*A~[>:t~*~~*~re;.s~:;:G,p1~t:~q.~... :::,1f:.*::1*

Detection circuits for the open phase condition, which prevents the functioning of important-to-safety structures, systems, and components, must be sensitive enough to identify an open phase condition for credited loading conditions (i.e., high and low loading).

Some transformers have vefY low or no loading when in standby mode. Automatic detection may not be possible in this rely on off-site power circuit(s) for safe systems provide the means of detection in shutdown do not create plant transients or these cases.

abnormal operating conditions. Also, the remaining power source(s) can be connected to the ESF buses within the time assumed in the accident analysis.

The detection circuits should be sensitive enough to identify open phase conditions under all operating electrical system configurations and plant loading conditions for which the off-site power supplies are required to be operable in accordance with plant technical specifications (TSs) for safe shutdown.

The implementing design change package documents and implements the protection schemes at the 4kV Emergency Buses for open phase events utilizing Basler BE1-47N relays. Automatic emergency bus trip functions are implemented to protect against an OPC.

A non-safety-related open phase detection and protection scheme is also being implemented at switchyard transformer TX-1 utilizing the Alstom OPD System.

For OPCs detected on the high side of transformer TX-1, the transformer will be isolated using existing protection relaying.

Modeling and analysis calculations determined and validated that the relay schemes, settings, and time delays are of sufficient sensitivity to only identify and protect agpinst actual OPCs.

Automatic protection is available on a continuous basis at the emergency buses, regardless of the off-site power source.

Serial No.17-188 Docket Nos. 50-280/281 Page 33 of 38.

.. *.... ;. TABlE.2;~ DESIGN COMPLIANCE WliHtHE NEI :OPEN PHASEJNIJIATIVE ANo::NRc*;arP 8-9 :.GCllDANCE.... *

,*

• 2 < **;;:';(:*::*:.:::.;.*.*.:..* 1...... **. ;;; **:.':: *** :. ***r:.;:.<:':.n;ii*:.*.,;:j;;* c;.;>:.:;:

.i,;;~iir v :*;:*: :*.. >**::

>~. *'F/C.?>.:;*.:zr,., *'*;:.:;

condition; however, automatic detection must happen as soon as loads are transferred to this standby source.

If automatic detection is not possible, shiftly surveillance requirements must be established to look for evidence of an open phase.

If open phase condition actuation circuits are required, the design should minimize misoperation or spurious action that could cause separation from an operable GOG 17 source.

The protective scheme should not separate the operable GOG 17 source in the range of voltage unbalance normally expected in the transmission system.

The detection circuit should minimize spurious indications for an operable power source in the range of voltage perturbations such as switching surges, transformer inrush currents, load or generation variations, lightning strikes, etc., normally expected in the transmission system.

Protection scheme design should minimize misoperation, ma/operation, and spurious actuation of an operable power source. Additionally, the protective scheme should not separate the operable power source in the range of voltage perturbations such as switching surges, load or generation variations, etc.,

normally expected in the transmission system.

TS Table 3.7-2, Operator Action 27, requires compensatory action to be implemented if the open phase relays are disabled or unavailable.

Three relays per emergency bus are configured in a 2 out of 3 logic scheme to minimize misoperation or spurious action that could cause separation of operable GDC 17 sources. Failure of a single relay makes the system operate in 2 out of 2 logic for protection.

Modeling and analysis were used to determine and validate that relay setpoints are not within the range of normal voltage unbalances expected in the transmission system.

It must be demonstrated that the additional actuation circuit design does not result in lower overall plant operation reliability.

Devices must be coordinated with other protective devices in both the transmission system and the plant's electrical system (e.g., fault protection, overcurrent, etc.).

Detection and actuation circuits may be non-Class-1E. While it is recognized that a Class-1E solution is preferable, a non-Class-1 E solution may be more effective.

A non-Class-1 E solution will enable timely implementation and will provide reasonable levels of reliable functionality given the low likelihood of adverse impacts from open phase events.

Additionally, there is regulatory precedent in using non-Class-1 E circuits in newly identified nuclear plant vulnerabilities (e.g.,

anticipated transient without scram A 1WS circuits. New non-Class-1 E Protection scheme should comply with applicable requirements including single failure criteria for ESF systems as specified in 1 O CFR Part 50, Appendix A, GDC17, and 10 CFR 50.55a(h)(2) or 10 CFR 50.55a(h)(3), which require compliance with IEEE Std 279-1971 "Criteria for Protection Systems for Nuclear Power Generating Stations" or IEEE Std 603-1991, "Standard Criteria for Safety Systems for Nuclear Power Generating Stations." RG 1. 153, "Criteria for Power, Instrumentation, and Control Portions of Safet S stems, " rovides Serial No.17-188 Docket Nos. 50-280/281 Page 34 of 38 Plant operation reliability is maintained with Class 1 E equipment installed in a manner consistent with existing Class 1 E voltage protection schemes. Non-OPC cases, such as unbalanced faults on the auxiliary system and motor starts under various loading conditions, were used with various transmission system unbalances to demonstrate the open phase protection algorithm's security.

Modeling and analysis were used to coordinate the relay setpoints with existing station protective relaying.

The negative sequence voltage (open phase) protective circuitry being implemented at Surry is Class 1 E, complies with applicable requirements for single failure criteria for ESF systems, and does not replace any existing Class 1 E circuits.

>:;,:;15>;;,;',*;::

'.,,*.*, * <. 1j\\r).'Y)!i~iii\\: :::<f 1 ' '",: "'

f!~/l.J'.:,~/.~*l;l~!?.~~?;

'i~i~~~~JV~~ ::'.~iTuJ.

..,,~1~Q;;~~~.4j£Yff',,J~~h~Jt~il',,Pp~f~l circuits will not be allowed to replace additional guidance on this topic.

existing C/ass-1 E circuits.

If protective features are provided in a non-Class 1 E system only, a failure of the non-Class 1 E scheme should not preclude the onsite electrical power system from performing its safety function given a single failure in the onsite power system.

The Updated Final Safety Analysis Report (UFSAR) must be updated to discuss design features and analyses related to the effects of, and protection for, any open phase condition design vulnerability. This update would typically be to chapter 8.

With no accident condition signal present, the open phase condition must not adversely affect the function of important to safety structures, systems, and components.

The design of the protection features for OPCs should address power quality issues caused by open phase conditions such as unbalanced voltages and currents, sequence voltages and currents, phase angle shifts, and harmonic distortion that could affect redundant ESF buses. The ESF loads should not be subjected to power quality conditions specified in industry standards such as Institute of Electrical and Electronic Engineers (IEEE) Standard (Std) 308-2001, "Criteria for Class 1E Power S stems for Nuclear Power Generatin Serial No.17-188 Docket Nos. 50-280/281 Page 35 of 38 A UFSAR change request has been initiated to revise the UFSAR to describe the open phase analysis and detection/protection scheme implemented by this modification. It will be implemented in accordance with the station design control process.

The open phase detection/protection scheme being implemented ensures functionality of Class 1 E equipment for initiating consequential OPCs on the transmission lines from the switchyard to the RSST and GSU transformers and interconnecting onsite auxiliary power circuits. Modeling and analysis for open phase relay setting coordination ensure important to safety SSCs are not adversely affected.

With an accident condition signal present, automatic detection and actuation will transfer loads required to mitigate postulated accidents to an alternate source and ensure that safety functions are preserved, as required by the current licensing bases.

Actuation times needed to maintain equipment safety functions should be short enough to provide reasonable assurance that accident mitigation functions are maintained.

Stations," Section 4. 5, "Power Quality,"

with respect to the design and operation of electrical systems as indicated in Regulatory Guide (RG) 1.32 "Criteria for Power Systems for Nuclear Plants."

Serial No.17-188 Docket Nos. 50-280/281 Page 36 of 38 Open phase events in steady state and concurrent with a Loss of Coolant Accident (LOCA) were evaluated to develop analytical limits for the protection negative sequence relays. Impact on safety related motors, of block start of emergency loads, and of isolating emergency loads from the affected transformer during a LOCA starting sequence and then restarting the emergency loads on the emergency sources were considered.

Time delays have been established by modeling and analysis utilizing coordination with existing protective relaying as well as accident mitigation considerations to ensure accident mitigation functions and capabilities are maintained.

Based on Section 8.5 of the Surry UFSAR, for an OPC coincident with an SI or CLS signal, the emergency buses should be re-energized by the diesel generator within 10 seconds the time dela assumed in the

If off-site power circuit(s) is (are) functionally degraded due to open phase conditions, and safe shutdown capability is not assured, then the ESF buses should be designed to be transferred automatically to the alternate reliable off-site power source or onsite standby power system within the time assumed in the accident analysis and without actuating Serial No.17-188 Docket Nos. 50-280/281 Page 37 of 38 accident analysis), including a 2.2 second residual voltage time delay. Modeling and analysis results demonstrate that for the open phase cases in which the negative sequence protection relay trips, the combined tripping time of the negative sequence voltage relay and the existing undervoltage protection is less than 5 seconds after the-o,Pc occurs. For cases where the tripping time of the negative sequence voltage relay is 5 seconds or longer, the bus voltages on at least two of the three phases are less than the 2975V TS limit for actuation of the Loss of Voltage relay. Thus, for these cases, the Loss of Voltage relay will dropout and trip after a two second time delay. This is within the time considered in the accident analysis for a loss of offsite power coincident with an accident.

For an OPC detected at the ESF buses, the protection logic energizes an existing undervoltage protection auxiliary relay for the associated bus, which starts the EOG and transfers the power source from the offsite power source to the EOG following the same process as the existing Undervoltage I Deg'raded Voltage protection scheme.

Periodic tests, calibrations, setpoint verifications or inspections (as applicable) must be established for any new protective features. The surveillance requirements must be added to the plant Technical Specifications if necessary to meet the provisions of 10CFR50.36.

any protective devices, given a concurrent design basis event.

The unbalanced voltage/current conditions for ESF components expected during various operating and loading conditions should not exceed motor manufacturer's recommendations. The International Electrotechnica/ Commission (/EC)

Standard /EC 60034-26, National Electrical Manufacturers Association (NEMAtStandard (MG 1) Parts 14.36 and

20. 24, and IEEE Std C37. 96-2012 (Guide for AC Motor Protection), Section 5. 7.2.6, "Unbalanced Protection and Phase Failures," may be used for general guidance.

Technical Specification Surveillance Requirements and Limiting Conditions of Operation for equipment used for mitigation of open phase conditions should be identified and implemented consistent with the operability requirements specified in the plant TSs and in accordance with 10 CFR 50.36(c)(2) and 10 CFR 50.36(c)(3).

Serial No.17-188 Docket Nos. 50-280/281 Page 38 of 38 NEMA Standard MG 1 was used as guidance for the calculations performed in support of the open phase detection and protection design change.

TS Table 3.7-2 is revised to add operating conditions and operator actions for the negative sequence voltage (open phase) protection function, and TS Table 3.7-4 is revised to document the negative sequence voltage (open phase) relay setting. TS Table 4.1-1 is revised to include the appropriate surveillance r~q uirements.

Serial No.17-188 Docket Nos. 50-280/281 MARKED-UP TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Station Units 1 and 2

J

~

~

\\0

3.

4.

5.

6.

7.

8.

TABLE 3.7-2 (Continued)

• ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Functional Unit Of Channels Channels AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven 2/MFWpump 1/MFWpump pumps

f. Automatic actuation logic 2

2 LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage) 3/bus 2/bus

b. 4.16 kv emergency bus undervoltage (degraded voltage) 3/bus 2/bus NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* - Note B 4

3

b. Automatic actuation logic 2

2 ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-11 3

2

b. Low-low Tavg, P-12 3

2

c. Reactor trip, P-4 2

2 RECIRCULATION MODE TRANSFER

a. RWST Level - Low-Low*

4 3

b. Automatic Actuation Logic and Actuation Relays 2

2 RECIRCULATION SPRAY

a. RWST Level - Low Coincident with High High 4

3 Containment Pressure*

b. Automatic Actuation Logic and Actuation Relays 2

2 Permissible Channels Bypass Operator To TriQ Conditions Actions 2-1 each 24 MFWpump 1

22 2/bus 26 2/bus 26 3

20 1

14 2

23 2

23 1

24 2

25 1

14 2

20 1

14 NoteA - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A NoteB - When the temporary Service Water supply jumper to the Component Cooling Heat Exchangers is in service in accordance with the footnote to TS 3.14,A.2.b, two low intake canal level probes will be permitted to be in the tripped condition. In this condition, two operable channels are required with one channel to trip. If one of the two operable channels becomes inoperable, the operating unit must be in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

§ o..

• There is a Safety Analysis Limit associated with this ESF function. If during calibration, the setpoint is found to be conservative with

~

respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined

'° calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 2/bus 2/bus 0

""'3

'°en

'W N.

w -..J I

I

-N WO

ACTION 21.

ACTION22.

ACTION23.

ACTION24.

ACTION25.

ACTION26.

Add new Action 27 provided in Insert A TABLES 3.7-2 ANDS 3.7-3 (Continued)

TABLE NOTATIONS TS 3.7-24 08-31-01 With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore tlie inoperable channel to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and reduce pressure and temperature to less than 450 psig and 350° within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; however, one channel may be bypassed for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for surveillance testing per Specification 4.1 provided the other channel is OPERABLE.

With the number of OPERABLE channels less than the Minimum OPERABLE Channels requirement, within one hour determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

With the number of OPERABLE channels less than the Total Number of Channels, restore the inoperable channels to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or reduce pressure and temperature to less than 450 psig and 350°F within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

With the number of OPERABLE channels one less than the Total Numb.er of Channels, place the inoperable channel in the bypassed condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD_ SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. One additional channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for.surveillance testing per Specification 4.1.

With the number of OPERABLE channels less than the Total Number of

" Channels, the associated Emergency Diesel Qenerator may be considered OPERABLE provided the following conditions are satisfied:

a.

The inoperable channel is placed in the tripped conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

b.

The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

If the conditions are not satisfied, declare the associated EDG inoperable.

Amendment Nos. 228 and 228

INSERT A ACTION 27. With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped conditions within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27.a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c. If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped),* the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the Unit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source.

The negative sequence voltage (open phase) protection function shall be returned to service within 90 days.

If the conditions are not satisfied, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

N O"I

§ p..

N O"I TABLE3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No.

Functional Unit Channel Action 6

AUXILIARY FEEDWATER

a. Steam Generator Water Level Aux. Feedwater Initiation Low-Low*

SIG Blowdown Isolation

b. RCP Undervoltage Aux. Feedwater Initiation

c. Safety Injection Aux. Feedwater Initiation

d. Station Blackout Aux. Feedwater Initiation

e. Main Feedwater Pump Trip Aux. Feedwater Initiation 7

LOSS OF POWER

a. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa-(Loss of Voltage) ti on and Diesel start 4.16 KV Emergency Bus Undervoltage Emergency Bus Separa-(Degraded Voltage) ti on and Diesel start 8

NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low Intake Canal Level*

9 RECIRCULATION MODE TRANSFER

a. RWST Level-Low-Low*

TURBINE TRIP AND FEEDWATER ISOLATION

a. Steam Generator Water Level High-High*

RWST Level Low (coincident with High High Containment Pressure)*

Isolation of Service Water flow to non-essential loads Initiation of Recirculation Mode Transfer System Turbine Trip Feedwater Isolation Recirculation Spray Pump Start Setting Limit

16.0% narrow range

70% nominal All S.I. setpoints

46.7% nominal N.A.

2975 volts and

;; 3265 volts with a 2 (+5, -0.1) second time delay

3830 volts anq

;; 3881 volts with a 60 (+/-3.0) second time delay (Non CLS, Non SI) 7 (+/-0.35) second time delay (CLS or SI Conditions) 23 feet-5.85 inches

12.7%

14.3%

76% narrow range

59%

61%

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document

c.

4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)

Emergency Bus Separation and Diesel start

~ 7% voltage imbalance

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS

> § Channel Description

32. Auxiliary Feedwater

a. Steam Generator Water Level Low-Low

b. RCP Undervoltage c.. S.I.

d. Station Blackout

e. Main Feedwater Pump Trip

33. Loss of Power

a. 4.16 KV Emergency Bus Undervoltage (Loss of Voltage)

b. 4.16 KV Emergency Bus Undervoltage (Degraded Voltage)

34. Deleted

35. Manual Reactor Trip i 36. Reactor Trip Bypass Breaker

!j w

§

37. Safety Injection Input to RPS 0..

c.

4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)

Check Calibrate Test SFCP SFCP SFCP (1)

Remarks

1) The auto start of the turbine driven pump is not included in the periodic test, but is tested within 31 days prior to each startup.

SFCP SFCP SFCP (1)(2)

1) The actuation logic and relays are tested within 31 days prior to each startup.

2) Setpoint verification not required.

(All Safety Injection surveillance requirements)

N.A.

SFCP N.A.

N.A.

N.A.

SFCP N.A.

SFCP N.A.

SFCP N.A.

N.A.

N.A.

N.A.

N.A.

N.A.

N.A.

SFCP SFCP (1)

SFCP (1)

SFCP SFCP (1),

SFCP (2)

SFCP SFCP (1)

1) Setpoint verification not required.

1) Setpoint verification not required.

The test shall independently verify the operability of the undervoltage and shunt trip attachments for the manual reactor trip function.

The test shall also verify the operability of the bypass breaker trip circuit.

1) Remote manual undervoltage trip immediately after placing the bypass breaker into service, but prior to commencing reactor trip system testing or required maintenance.

2) Automatic undervoltage trip.

1) Setpoint verification not required.

Serial No.17-188 Docket Nos. 50-280/281 PROPOSED TECHNICAL SPECIFICATIONS PAGES Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Station Units 1 and 2

z 0

~

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Functional Unit

3.

AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater pumps - start motor driven pumps

f. Automatic actuation logic

4. LOSS OF POWER

a. 4.16 kv emergency bus undervoltage (loss of voltage)

b. 4.16 kv emergency bus undervoltage (degraded voltage)

c. 4.16 kv emergency bus negative sequence voltage (open phase)

5.

NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level* - Note B

b. Automatic actuation logic

6. ENGINEERED SAFEGAURDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-11

b. Low-low Tavg,P-12

c. Reactor trip, P-4

7. RECIRCULATION MODE TRANSFER Total Number Of Channels 2/MFWpump 2

3/bus 3/bus 3/bus 4

2 3

3 2

Minimum OPERABLE Channels l/MFWpump 2

2/bus 2/bus 2/bus 3

2 2

2 2

Channels To Trip 2-1 each MFWpump 1

2/bus 2/bus 2/bus 3

1 2

2 1

Permissible Bypass Conditions Operator Actions 24 22 26 26 27 20 14 23 23 24

a. RWST Level - Low-Low*

4 3

2 25

b. Automatic Actuation Logic and Actuation Relays 2

2 1

14 Note A - Engineered Safeguards Actuation Interlocks are described in Table 4.1-A Note B - When the temporary Service Water supply jumper to the Component Cooling Heat Exchangers is in service in accordance with the footnote to TS 3.14.A.2.b, two low intake canal level probes will be permitted to be in the tripped condition. In this condition, two operable channels are required with one channel to trip. If one of the two operable channels becomes inoperable, the operating unit must be in HOT SHUTDOWN within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

• There is a Safety Analysis Limit associated with this ESP function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CPR 50.59.

~*

l s Cl>

l

....... z 0 :n Functional Unit

8. RECIRCULATION SPRAY TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number Of Channels OPERABLE Channels

a. RWST Level - Low Coin~ident with High High Containment Pressure*

4 3

b. Automatic Actuation Logic and Actuation Relays 2

2 Channels To Trip 2

1 Permissible Bypass Conditions Operator Actions 20 14

• There is a Safety Analysis Limit associated with this ESP function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CPR 50.59.

~

(/.)

w

...:i I

N 0 P'

ACTION27.

TABLES 3.7-2 ANDS 3.7-3 (Continued)

TABLE NOTATIONS TS 3.7-24a With the number of OPERABLE channels less than the Total Number of Channels, the negative sequence voltage (open phase) protection function may be considered OPERABLE provided the following conditions are satisfied:

a.

The inoperable channel is placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Note: Action 27.a does not apply if the negative sequence voltage (open phase) protection function cannot be performed.

b.

The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing of other channels per Specification 4.1.

c.

If the negative sequence voltage (open phase) protection function cannot be performed (e.g., the Potential Transformer Blocking Device is tripped),

the negative sequence voltage (open phase) protection function does not have to be declared inoperable provided verification is performed at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> that an open phase condition does not exist on the primary side of transformer TX-2, transformer TX-4, and the Reserve Station Service Transformers, as well as the U,nit 1/Unit 2 Main Step-up Transformers when power is supplied by the dependable alternate source.

The negative sequence voltage (open phase) protection function shall be returned to service within 90 days.

If the conditions are not satisfied, be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

Amendment Nos.

l

.~

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No.

6 7

8 Functional Unit AUXILIARY FEEDWATER

a. Steam Generator Water Level Low-Low*

b. RCP Undervoltage

c. Safety Injection

d. Station Blackout

e. Main Feedwater Pump Trip LOSS OF POWER

a. 4.16 KV Emergency Bus Undervoltage (Loss of Voltage)

b. 4.16 KV Emergency Bus Undervoltage (Degraded Voltage)

c. 4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)

NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low Intake Canal Level*

9 RECIRCULATION MODE TRANSFER

a. RWST Level-Low-Low*

10 TURBINE TRIP AND FEEDWATER ISOLATION

a. Steam Generator Water Level High-High*

Channel Action Aux. Feedwater Initiation SIG Blowdown Isolation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Aux. Feedwater Initiation Emergency Bus Separa-tion and Diesel start Emergency Bus Separa-tion and Diesel start Emergency Bus Separa-tion and Diesel start Isolation of Service Water flow to non-essential loads Initiation of Recirculation Mode Transfer System Turbine Trip Feedwater Isolation Setting Limit

16.0% narrow range

70% nominal All S.I. setpoints

46.7% nominal N.A.

2975 volts and

;; 3265 volts with a 2 (+5, -0.1) second time delay

3830 volts and

;; 3881 volts with a 60 (+/-3.0) second time delay (Non CLS, Non SI) 7 (+/-0.35) second time delay (CLS or SI Conditions)

7% voltage imbalance 23 feet-5.85 inches

12.7%

14.3%

76% narrow range

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the *setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

> s (II

l 0... s (II

l

...... z 0 :"

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING No.

Functional Unit 11

• RWST Level Low (coincident with High High Containment Pressure)*

Channel Action Recirculation Spray Pump Start

~59%

61%

Setting Limit

• There is a Safety Analysis Limit associated with this ESF function. If during calibration the setpoint is found to be conservative with respect to the Setting Limit but outside its predefined calibration tolerance, then the channel shall be brought back to within its predefined calibration tolerance before returning the channel to service. The calibration tolerances are specified in a document controlled under 10 CFR 50.59.

~

en w

~

I N

0\\

P'

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Description

32. Auxiliary Feedwater

a. Steam Generator Water Level Low-Low

b. RCP Undervoltage

c. S.I.

d. Station Blackout

e. Main Feedwater Pump Trip

33. Loss of Power

a. 4.16 KV Emergency Bus Undervoltage (Loss of Voltage)

b. 4.16 KV Emergency Bus Undervoltage (Degraded Voltage)

c. 4.16 KV Emergency Bus Negative Sequence Voltage (Open Phase)

34. Deleted

35. Manual Reactor Trip

i>

36. Reactor Trip Bypass Breaker t

..... z 0

r:n Check Calibrate Test SFCP SFCP SFCP (1)

Remarks

1) The auto start of the turbine driven pump is not included in the periodic test, but is tested within 31 days prior to each startup.

SFCP SFCP SFCP (1)(2)

1) The actuation logic and relays are tested within 31 days prior to each startup.

2) Setpoint verification not required.

(All Safety Injection surveillance requirements)

N.A.

SFCP N.A.

N.A.

N.A.

SFCP N.A.

SFCP N.A.

SFCP N.A SFCP N.A.

N.A.

N.A.

N.A.

SFCP (1)

SFCP (1)

SFCP (1)

SFCP SFCP (1),

SFCP (2)

1) Setpoint verification not required.

1) Setpoint verification not required.

1) Setpoint verification not required.

The test shall independently verify the operability of the undervoltage and shunt trip attachments for the manual reactor trip function.

The test shall also verify the operability of the bypass breaker trip circuit.

1) Remote manual undervoltage trip immediately after placing the bypass breaker into service, but prior to commencing reactor trip system testing or required maintenance.

2) Automatic undervoltage trip.

>-3 tZl

J:>.. -

I 00 Pl

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK2 CALIBRATIONS AND TEST OF INSTRUMENT CHANNELS Channel Descri~tion Check Calibrate Test Remarks

37. Safety Injection Input to RPS N.A.

N.A.

SFCP

38. Reactor Coolant Pump Breaker N.A.

N.A.

SFCP Position Trip

39. Steam/Feedwater Flow and Low SIG SFCP SFCP SFCP (1)

1)

The provisions of Specification 4.0.4 are not Water Level applicable

40. Intake Canal Low (See Note 1)

SFCP SFCP SFCP (1),

1)

Logic Test SFCP (2)

2)

Channel Electronics Test

41. Turbine Trip and Feedwater Isolation

a. Steam generator water level high SFCP SFCP SFCP

b. Automatic actuation logic and N.A.

SFCP SFCP (1)

1)

Automatic actuation logic only, actuation relays actuation relay tested each refueling

42. Reactor Trip System Interlocks

a. Intermediate range neutron flux, N.A.

SFCP (1)

SFCP (2)

1)

Neutron detectors may be excluded from the P-6 calibration

b. Low reactor trips block, P-7 N.A.

SFCP (1)

SFCP (2)

2)

The provisions of Specification 4.0.4 are not

c. Power range neutron flux, P-8 N.A.

SFCP (1)

SFCP (2) applicable.

d. Power range neutron flux, P-10 N.A.

SFCP (1)

SFCP (2)

e. Turbine impulse pressure N.A.

SFCP SFCP

>--s Cl>

s 0.. s

~

Cl>

en

s

~

z 0

I

n 00 cr'