ML023170101

Report of Changes to Technical Specifications Bases

ML023170101
Person / Time
Site:	Palisades
Issue date:	10/31/2002
From:	Cooper D Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML023170101 (160)

Text

Committed to Nuclear Excellence Palisades Operated by Nuclear Nuclear Management Plant Company, LLC October 31, 2002 10 CFR 50.4 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 PALISADES NUCLEAR PLANT DOCKET 50-255 LICENSE DPR-20 REPORT OF CHANGES TO TECHNICAL SPECIFICATIONS BASES This report is submitted in accordance with Palisades Technical Specification 5.5.12.d, which requires that changes to the Technical Specifications Bases, implemented without prior NRC approval, be provided to the NRC on a frequency consistent with 10 CFR 50.71(e). Enclosure 1 provides a listing of all bases changes since issuance of the previous report, dated November 15, 2001, and identifies the affected sections and nature of the changes. Enclosure 2 provides page change instructions and a copy of the current Technical Specifications Bases List of Effective Pages, Title Page and the revised Technical Specification Bases sections listed in Enclosure 1.

SUMMARY

OF COMMITMENTS This/tter contains no new commitments and no revisions to existing commitments.

Dougas E. Cooper, Site Vice-President, Palisades CC Regional Administrator, USNRC, Region III Project Manager, USNRC, NRR NRC Resident Inspector - Palisades Enclosures 27780 Blue Star Memorial Highway a Covert, MI 49043 Telephone 616 764 2000

ENCLOSUREI NUCLEAR MANAGEMENT COMPANY, LLC PALISADES NUCLEAR PLANT DOCKET 50-255 October 31, 2002 TECHNICAL SPECIFICATIONS BASES CHRONOLOGY 1 Page Follows

TECHNICAL SPECIFICATION BASES CHANGES CHRONOLOGY AFFECTED BASES DATE" -SECTION(S) CHANGE(S) 2/09/02 B3.7.7 Clarify left train component cooling water pump requirements.

4/22/02 B3.3.3 Update bases to reflect plant modification that B3.5.2 addressed net positive suction head following B3.5.4 a recirculation actuation signal issue.

B3.6.6 5/23/02 B3.7.15 Make bases consistent with Nuclear B3.7.16 Regulatory Commission (NRC) approved Amendment 207, which addressed spent fuel pool boron-enrichment limits in fuel pool.

5/23/02 B3.3.1 Make bases consistent with NRC approved Amendment 208, which addressed maximum allowable value for variable high power trip.

Also corrected axial offset minus axial shape index values for surveillance requirement (SR) 3.3.1.4 and editorial error on page B3.3.1-35.

7/22/02 B3.4.12 Updates bases to correct minor errors and B3.4.13 reflect current engineering analyses of record B3.4.15 and the Final Safety Analysis Report.

B3.4.16 B3.5.3 B3.6.6 B3.7.7 B3.7.17 B3.8.3 B3.9.4 1

ENCLOSURE2 NUCLEAR MANAGEMENT COMPANY, LLC PALISADES NUCLEAR PLANT DOCKET 50-255 October 31, 2002 REVISED TECHNICAL SPECIFICATIONS BASES Page Change Instructions List of Effective Pages Title Page B 3.3.1, B 3.3.3, B 3.4.12, B 3.4.13, B 3.4.15, B 3.4.16, B 3.5.2, B 3.5.3, B 3.5.4, B 3.6.6, B 3.7.7, B 3.7.15, B 3.7.16, B 3.7.17, B 3.8.3, B 3.9.4 83 (2-sided) Pages Follow

TECHNICAL SPECIFICATIONS PALISADES PLANT Docket 50-255 - License DPR-20 Page Change Instructions Technical Specifications Bases Changes October 31, 2002 Revise your copy of the Palisades Technical Specifications Bases with the attached revised pages. The revised pages are identified by amendment number or revision date at the bottom of the pages and contain vertical lines in the margin indicating the areas of change.

TECHNICAL SPECIFICATIONS BASES REMOVE INSERT List of Effective Pages List of Effective Pages Title Page Title Page Section B 3.3.1 Section B 3.3.1 Section B 3.3.3 Section B 3.3.3 Section B 3.4.12 Section B 3.4.12 Section B 3.4.13 Section B 3.4.13 Section B 3.4.15 Section B 3.4.15 Section B 3.4.16 Section B 3.4.16 Section B 3.5.2 Section B 3.5.2 Section B 3.5.3 Section B 3.5.3 Section B 3.5.4 Section B 3.5.4 Section B 3.6.6 Section B 3.6.6 Section B 3.7.7 Section B 3 7.7 Section B 3.7.15 Section B 3.7.15 Section B 3 7.16 Section B 3.7.16 Section B 3.7.17 Section B 3.7.17 Section B 3.8.3 Section B 3.8.3 Section B 3.9.4 Section B 3.9.4

PALISADES TECHNICAL SPECIFICATIONS BASES 1 LIST OF EFFECTIVE PAGES COVERSHEET Title Page 208 - Revised 05/23/02 TABLE OF CONTENTS Page i 205 Page ii 189 TECHNICAL SPECIFICATIONS BASES Bases 2.0 Pages B 2.1.1 B 2.1.1-4 Revised 09/28/01 Pages B 2.1.2 B 2.1.2-4 189 Bases 3.0 Pages B 3.0 B 3.0-14 189 - Revised 08/09/00 Bases 3.1 Pages B 3.1.1 B 3.1.1-5 189 Pages B 3.1.2 B 3.1.2-6 189 - Revised 08/09/00 Pages B 3.1.3 B 3.1.3-4 189 Pages B 3.1.4 B 3.1.4-13 Revised 09/28/01 Pages B 3.1.5 B 3.1.5-7 189 - Revised 08/09/00 Pages B 3.1.6 B 3.1.6-9 Revised 09/28/01 Pages B 3.1.7 B 3.1.7-6 189 - Revised 08/09/00 Bases 3.2 Pages B 3.2.1 B 3.2.1-11 Revised 09/28/01 Pages B 3.2.2 B 3.2.2-3 Revised 09/28/01 Pages B 3.2.3 B 3.2.3-3 Revised 09/28101 Pages B 3.2.4 B 3.2.4-3 189 - Revised 08/09100 Bases 3.3 Pages B 3.3.1 B 3.3.1-35 Revised 05/23/02 Pages B 3.3.2 B 3.3.2-10 189 - Revised 02112/01 Pages B 3.3.3 B 3.3.3-24 Revised 04/22/2002 Pages B 3.3.4 B 3.3.4-12 189 Pages B 3.3.5 B 3.3.5-6 189 Pages B 3.3.6 B 3.3.6-6 189 - Revised 02/12/01 Pages B 3.3.7 B 3.3.7-12 Revised 05/04/01 Pages B 3.3.8 B 3.3.8-6 189 Pages B 3.3.9 B 3.3.9-5 189 - Revised 08/09/00 Pages B 3.3.10 B 3.3.10-4 189 Bases 3.4 Pages B 3.4.1 B 3.4.1-5 189 Pages B 3.4.2 B 3.4.2-2 189 Pages B 3.4.3 B 3.4.3-7 189 Pages B 3.4.4 B 3.4.4-4 189 Pages B 3.4.5 B 3.4.5-5 189 - Revised 08/09/00 Pages B 3.4.6 B 3.4.6-6 189 - Revised 02/12/01 Pages B 3.4.7 B 3.4.7-7 189 - Revised 02/12/01 Pages B 3.4.8 B 3.4.8-5 189 - Revised 02/12/01 Pages B 3.4.9 B 3.4.9-6 189 Pages B 3.4.10 B 3.4.10-4 189 Pages B 3.4.11 B 3.4.11-7 189 - Revised 08/09/00 Pages B 3.4.12 B 3.4.12-13 Revised 07/22102 Pages Pages Pages B 3.4.13 B 3.4.13-6 B 3.4.14 B 3.4.14-8 B 3.4.15 B 3.4.15-6 Revised 07/22/02 189 - Revised 08/09/00 Revised 07/22/02 I

Pages B 3.4.16 B 3.4.16-5 Revised 07/22/02 Revised 07/22/2002

PALISADES TECHNICAL SPECIFICATIONS BASES 2 LIST OF EFFECTIVE PAGES Bases 3.5 Pages B 3.5.1-1 - B 3.5.1-5 189 Page B 3.5.1-6 191 Page B 3.5.1-7 189 Page B 3.5.1-8 191 Pages B 3.5.2 B 3.5.2-12 Revised 04/22/2002 Pages B 3.5.3-1 -B 3.5.3-4 Revised 07/22/02 Pages B 3.5.4 B 3.5.4-7 Revised 04/22/2002 Pages B 3.5.5 B 3.5.5-5 189 Bases 3.6 Pages B 3.6.1-1 - B 3.6.1-4 Revised 03/30/01 Pages B 3.6.2-1 - B 3.6.2-8 Revised 03/30/01 Pages B 3.6.3-1 - B 3.6.3-11 Revised 03/30/01 Pages B 3.6.4-1 - B 3.6.4-3 Revised 04/27/01 Pages B 3.6.5-1 - B 3.6.5-3 Revised 04/27/01 Pages B 3.6.6-1 - B 3.6.6-12 Revised 07/22/02 Pages B 3.6.7-1 - B 3.6.7-6 189 - Revised 11/09/00 Bases 3.7 Pages B 3.7.1 B 3.7.1-4 189 - Revised 02/12/01 Pages B 3.7.2 B 3.7.2-6 189 - Revised 08/09/00 Pages B 3.7.3 B 3.7.3-5 189 - Revised 08/09/00 Pages B 3.7.4 B 3.7.4-4 189 - Revised 08/09/00 Pages B 3.7.5 B 3.7.5-9 Revised 08/01/01 Pages B 3.7.6 B 3.7.6-4 189 - Revised 08/09/00 Pages B 3.7.7 B 3.7.7-9 Revised 07/22/02 Pages B 3.7.8 B 3.7.8-8 Revised 08/01/01 Pages B 3.7.9 B 3.7.9-3 Revised 07/16/01 Pages B 3.7.10 B 3.7.10-7 Revised 08/01/01 Pages B 3.7.11-1 - B 3.7.11-5 189 Pages B 3.7.12-1 - B 3.7.12-7 189 Pages B 3.7.13-1 - B 3.7.13-3 189 - Revised 08/09/00 Pages B 3.7.14-1 - B 3.7.14-3 189 Pages B 3.7.15-1 -B3.7.15-2 207 Pages B 3.7.16-1 - B 3.7.16-3 207 Pages B 3.7.17-1 - B 3.7.17-3 Revised 07/22/02 Bases 3.8 Pages B 3.8.1-1 -B3.8.1-24 189 - Revised 08/09/00 Pages B 3.8.2 B 3.8.2-4 Revised 11/06/01 Pages B 3.8.3 B 3.8.3-7 Revised 07/22/02 Pages B 3.8.4 B 3.8.4-9 189 - Revised 08/09/00 Pages B 3.8.5 B 3.8.5-3 Revised 11/06/01 Pages B 3.8.6 B 3.8.6-6 189 - Revised 08/09/00 Pages B 3.8.7 B 3.8.7-3 189 Pages B 3.8.8 B 3.8.8-3 Revised 11/06/01 Pages B 3.8.9 B 3.8.9-7 Revised 11/06/01 Pages B 3.8.10 B 3.8.10-3 Revised 11/06/01 Bases 3.9 Pages B 3.9.1-1 - B 3.9.1-4 189 - Revised 08/09/00 Pages B 3.9.2-1 - B 3.9.2-3 189 - Revised 02/12/01 Pages B 3.9.3-1 - B 3.9.3-6 189 - Revised 08/09/00 Pages B 3.9.4-1 - B 3.9.4-4 Revised 07/22/02 Pages B 3.9.5-1 - B 3.9.5-4 I 189 - Revised 02/12/01 Pages B 3.9.6-1 - B 3.9.6-3 189 - Revised 02/27/01 Revised 07/22/2002

PALISADES PLANT FACILITY OPERATING LICENSE DPR-20 APPENDIX A TECHNICAL SPECIFICATIONS BASES As Amended Through Amendment No. 208 Revised 05/23/2002

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the acceptable fuel design limits and breaching the reactor coolant pressure boundary during Anticipated Operational Occurrences (AOOs). (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.") By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are:

• The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

"* Fuel centerline melting shall not occur; and

"* The Primary Coolant System (PCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during AOOs.

Palisades Nuclear Plant B 3.3. 1-1 Revised 05/23/2002

-C-----

RPS Instrumentation B 3.3.1 BASES BACKGROUND Accidents are events that are analyzed even though they are not (continued) expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS is segmented into four interconnected modules. These modules are:

• Measurement channels;

"* RPS trip units;

"* Matrix Logic; and

"* Trip Initiation Logic.

This LCO addresses measurement channels and RPS trip units. It also addresses the automatic bypass removal feature for those trips with Zero Power Mode bypasses. The RPS Logic and Trip Initiation Logic are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Logic and Trip Initiation." The role of the measurement channels, RPS trip units, and RPS Bypasses is discussed below.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

With the exception of Hi Startup Rate, which employs two instrument channels, and Loss of Load, which employs a single pressure sensor, four identical measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated channels A through D.

Some measurement channels provide input to more than one RPS trip unit within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features (ESF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1-2 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

In the case of Hi Startup Rate and Loss of Load, where fewer than four sensor channels are employed, the reactor trips provided are not relied upon by the plant safety analyses. The sensor channels do however, provide trip input signals to all four RPS channels.

When a channel monitoring a parameter exceeds a predetermined setpoint, indicating an abnormal condition, the bistable monitoring the parameter in that channel will trip. Tripping two or more channels of bistable trip units monitoring the same parameter de-energizes Matrix Logic, (addressed by LCO 3.3.2) which in turn de-energizes the Trip Initiation Logic. This causes all four DC clutch power supplies to de-energize, interrupting power to the control rod drive mechanism clutches, allowing the full length control rods to insert into the core.

For those trips relied upon in the safety analyses, three of the four measurement and trip unit channels can meet the redundancy and testability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LCO requires, however, that four channels be OPERABLE. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip channel bypassed) for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation, this arrangement meets the requirements of IEEE Standard 279-1971 (Ref. 3).

Most of the RPS trips are generated by comparing a single measurement to a fixed bistable setpoint. Two trip Functions, Variable High Power Trip and Thermal Margin Low Pressure Trip, make use of more than one measurement to provide a trip.

The required RPS Trip Functions utilize the following input instrumentation:

. Variable High Power Trip (VHPT)

The VHPT uses Q Power as its input. Q Power is the higher of NI power from the power range NI drawer and primary calorimetric power (AT power) based on PCS hot leg and cold leg temperatures. The measurement channels associated with the VHPT are the power range excore channels, and the PCS hot and cold leg temperature channels.

Palisades Nuclear Plant B 3.3.1-3 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

"* Variable High Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signal processing necessary to calculate the TM/LP trip setpoint, VHPT trip setpoint and trip comparison, and Q Power calculation. On power decreases the VHPT setpoint tracks power levels downward so that it is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point it increases to the new setpoint, a fixed increment above Q Power at the time of reset, subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

"* High Startup Rate Trip The High Startup Rate trip uses the wide range Nuclear Instruments (NIs) to provide an input signal. There are only two wide range NI channels. The wide range channel signal processing electronics are physically mounted in RPS cabinet channels C (NI-1/3) and D (NI-2/4). Separate bistable trip units mounted within the NI-1/3 wide range channel drawer supply High Startup Rate trip signals to RPS channels A and C. Separate bistable trip units mounted within the NI-2/4 wide range channel drawer provide High Startup Rate trip signals to RPS channels B and D.

"* Low Primary Coolant Flow Trip The Low Primary Coolant Flow Trip utilizes 16 flow measurement channels which monitor the differential pressure across the primary side of the steam generators. Each RPS channel, A, B, C, and D, receives a signal which is the sum of four differential pressure signals. This totalized signal is compared with a setpoint in the RPS Low Flow bistable trip unit for that RPS channel.

Palisades Nuclear Plant B 3.3.1-4 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

• Low Steam Generator Level Trips There are two separate Low Steam Generator Level trips, one for each steam generator. Each Low Steam Generator Level trip monitors four !evel measurement channels for the associated steam generator, one for each RPS channel.

Low Steam Generator Pressure Trips There are also two separate Low Steam Generator Pressure trips, one for each steam generator. Each Low Steam Generator Pressure trip monitors four pressure measurement channels for the associated steam generator, one for each RPS channel.

"* High Pressurizer Pressure Trip The High Pressurizer Pressure Trip monitors four pressurizer pressure channels, one for each RPS channel.

"* Thermal Margin Low Pressure (TM/LP) Trip The TM/LP Trip utilizes bistable trip units. Each of these bistable trip units receives a calculated trip setpoint from the Thermal Margin Monitor (TMM) and compares it to the measured pressurizer pressure signal. The TM/LP setpoint is based on Q power (the higher of NI power from the power range NI drawer, or AT power, based on PCS hot leg and cold leg tempeiatures) pressurizer pressure, PCS cold leg temperature, and Axial Shape Index. The TMM provide the complex signal processing necessary to calculate the TM/LP trip setpoint, TM/LP trip comparison signal, and Q Power.

Palisades Nuclear Plant B83.3.1-5 Revised 05/2312002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

"* Loss of Load Trip The Loss of Load trip uses a single pressure switch, 63IAST-2, in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units. The Loss of Load Trip is actuated by turbine auxiliary relays 305L and 305R. Relay 305L provides input to RPS channels A and C; 305R to channels B and D.

Relays 305L and 305R are energized on a turbine trip. Their inputs are the same as the inputs to the turbine solenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, auto stop oil pressure switch 63/AST-2 will actuate relays 305L and 305R and generate a reactor trip. If a turbine trip is generated by an input to the solenoid trip valve, relays 305L and 305R, which are wired in parallel, will also be actuated and will generate a reactor trip.

"* Containment High Pressure Trip The Containment High Pressure Trip is actuated by four pressure switches, one for each RPS channel.

"* Zero Power Mode Bypass Automatic Removal The Zero Power Bypass allows manually bypassing (i.e., disabling) four reactor trip functions, Low PCS Flow, Low SG A Pressure, Low SG B Pressure, and TM/LP (low PCS pressure),

when reactor power (as indicated by the wide range nuclear instrument channels) is below 104%. This bypassing is necessary to allow RPS testing and control rod drive mechanism testing when the reactor is shutdown and plant conditions would cause a reactor trip to be present.

The Zero Power Mode Bypass removal interlock uses the wide range nuclear instruments (NIs) as measurement channels.

There are only two wide range NI channels. Separate bistables are provided to actuate the bypass removal for each RPS channel. Bistables in the NI-1/3 channel provide the bypass removal function for RPS channels A and C; bistables in the NI-2/4 channel for RPS channels B and D.

Palisades Nuclear Plant B 3.3.1-6 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Several measurement instrument channels provide more than one (continued) required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

RPS Trip Units Two types of RPS trip units are used in the RPS cabinets; bistable trip units and auxiliary trip units:

A bistable trip unit receives a measured process signal from its instrument channel and compares it to a setpoint; the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the measured signal is less conservative than the setpoint.

They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open or closed); the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the digital input is received. They also provide local trip indication and remote annunciation.

Each RPS channel has four auxiliary trip units and seven bistable trip units.

The contacts from these trip unit relays are arranged into six coincidence matrices, comprising the Matrix Logic. If bistable trip units monitoring the same parameter in at least two channels trip, the Matrix Logic will generate a reactor trip (two-out-of-four logic).

Four of the RPS measurement channels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpoint is not necessary. In these cases, the bistable trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contact multiplication so the single input contact opening can provide multiple contact outputs to the coincidence logic as well as trip indication and annunciation.

Palisades Nuclear Plant B 3.3.1-7 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Trip Units (continued)

(continued)

Trips employing auxiliary trip units include the VHPT, which receives contact inputs from the Thermal Margin Monitors; the High Startup Rate trip which employs contact inputs from bistables mounted in the two wide range drawers; the Loss of Load Trip which receives contact inputs from one of two auxiliary relays which are operated by a single switch sensing turbine auto stop oil pressure; and the Containment High Pressure (CHP) trip, which employs containment pressure switch contacts.

There are four RPS trip units, designated as channels A through D, each channel having eleven trip units, one for each RPS Function. Trip unit output relays de-energize when a trip occurs.

All RPS Trip Functions, with the exception of the Loss of Load and CHP trips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Palisades Nuclear Plant B 3.3.1-8 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Protective System Bypasses (continued)

Three different types of trip bypass are utilized in the RPS, Operating Bypass, Zero Power Mode Bypass, and Trip Channel Bypass. The Operating Bypass or Zero Power Mode Bypass prevent the actuation of a trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the trip unit output from affecting the Logic Matrix. A channel which is bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must be considered to be inoperable.

Operating Bypasses The Operating Bypasses are initiated and removed automatically during startup and shutdown as power level changes. An Operating Bypass prevents the associated RPS auxiliary trip unit from receiving a trip signal from the associated measurement channel. With the bypass in place, neither the pre-trip alarm nor the trip will actuate if the measured parameter exceeds the set point. An annunciator is provided for each Operating Bypass. The RPS trips with Operating Bypasses are:

a. High Startup Rate Trip bypass. The High Startup Rate trip is automatically bypassed when the associated wide range channel indicates below 1 E-4% RTP, and when the associated power range excore channel indicates above 13% RTP. These bypasses are automatically removed between 1 E-4% RTP and 13% RTP.

b. Loss of Load bypass. The Loss of Load trip is automatically bypassed when the associated power range excore channel indicates below 17% RTP. The bypass is automatically removed when the channel indicates above the set point. The same power range excore channel bistable is used to bypass the High Startup Rate trip and the Loss of Load trip for that RPS channel.

Palisades Nuclear Plant B 3.3.1-9 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Operating Bypasses (continued)

(continued)

Each wide range channel contains two bistables set at 1 E-4% RTP, one bistable unit for each associated RPS channel. Each of the two wide range channels affect the Operating Bypasses for two RPS channels; wide range channel NI-1/3 for RPS channels A and C, wide range channel NI-2/4 for RPS channels B and D. Each of the four power range excore channel affects the Operating Bypasses for the associated RPS channel. The power range excore channel bistables associated with the Operating Bypasses are set at a nominal 15%, and are required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow, pressure or temperature too low for the RPS trips to be reset. ZPM bypasses may be manually initiated and removed when wide range power is below I E-4% RTP, and are automatically removed if the associated wide range NI indicated power exceeds IE-4% RTP. A ZPM bypass prevents the RPS trip unit from actuating if the measured parameter exceeds the set point. Operation of the pretrip alarm is unaffected by the zero power mode bypass. An annunciator indicates the presence of any ZPM bypass. The RPS trips with ZPM bypasses are:

a. Low Primary Coolant System Flow.

b. Low Steam Generator Pressure.

C. Thermal Margin/Low Pressure.

The wide range NI channels provide contact closure permissive signals when indicated power is below 1 E-4% RTP. The ZPM bypasses may then be manually initiated or removed by actuation of key-lock switches.

One key-lock switch located on each RPS cabinet controls the ZPM Bypass for the associated RPS trip channels. The bypass is automatically removed if the associated wide range NI indicated power exceeds 1 E-4% RTP. The same wide range NI channel bistables that provide the ZPM Bypass permissive and removal signals also provide the high startup rate trip Operating Bypass actuation and removal.

Palisades Nuclear Plant B 3.3.1-10 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES BACKGROUND Trip Channel Bypass (continued)

A Trip Channel Bypass is used when it is desired to physically remove an individual trip unit from the system, or when calibration or servicing of a trip channel could cause an inadvertent trip. A trip Channel Bypass may be manually initiated or removed at any time by actuation of a key lock switch. A Trip Channel Bypass prevents the trip unit output from affecting the RPS logic matrix. A light above the bypass switch indicates that the trip channel has been bypassed. Each RPS trip unit has an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.

The key cannot be removed when in the bypass position. Only one key for each trip parameter is provided, therefore the operator can bypass only one channel of a given parameter at a time. During the bypass condition, system logic changes from two-out-of-four to two-out-of-three channels required for trip.

APPLICABLE Each of the analyzed accidents and transients can be detected by one SAFETY ANALYSES or more RPS Functions. The accident analysis contained in Reference 4 takes credit for most RPS trip Functions. The High Startup Rate and Loss of Load Functions, which are not specifically credited in the accident analysis are part of the NRC approved licensing basis for the plant. The High Startup Rate and Loss of Load trips are purely equipment protective, and their use minimizes the potential for equipment damage.

The specific safety analyses applicable to each protective Function are identified below.

1. Variable High Power Trip (VHPT)

The VHPT provides reactor core protection against positive reactivity excursions.

The safety analysis assumes that this trip is OPERABLE to terminate excessive positive reactivity insertions during power operation and while shut down.

Palisades Nuclear Plant B 3.3.1 -11 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. High Startup Rate Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the High Startup Rate Trip. The High Startup Rate trip is used to trip the reactor when excore wide range power indicates an excessive rate of change. The High Startup Rate trip minimizes transients for events such as a continuous control rod withdrawal or a boron dilution event from low power levels. The trip may be operationally bypassed when THERMAL POWER is

< 1 E-4% RTP, when poor counting statistics may lead to erroneous indication. It may also be operationally bypassed at

> 13% RTP, where moderator temperature coefficient and fuel temperature coefficient make high rate of change of power unlikely.

There are only two wide range drawers, with each supplying contact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolant System Flow Trip The Low PCS Flow trip provides DNB protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a primary coolant pump.

Flow in each of the four PCS loops is determined from pressure drop from inlet to outlet of the SGs. The total PCS flow is determined, for the RPS flow channels, by summing the loop pressure drops across the SGs and correlating this pressure sum with the sum of SG differential pressures which exist at 100% flow (four pump operation at full power Tave). Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

4, 5. Low Steam Generator Level Trip The Low Steam Generator Level trips are provided to trip the reactor in the event of excessive steam demand (to prevent overcooling the PCS) and loss of feedwater events (to prevent overpressurization of the PCS).

The Allowable Value assures that there will be sufficient water inventory in the SG at the time of trip to allow a safe and orderly plant shutdown and to prevent SG dryout assuming minimum AFW capacity.

Palisades Nuclear Plant B 3.3.1-12 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABLE 4, 5. Low Steam Generator Level Trip (continued)

SAFETY ANALYSIS (continued) Each SG level is sensed by measuring the differential pressure in the upper portion of the downcomer annulus in the SG. These trips share four level sensing channels on each SG with the AFW actuation signal.

6, 7. Low Steam Generator Pressure Trip The Low Steam Generator Pressure trip provides protection against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the PCS. This trip provides a mitigation function in the event of an MSLB.

The Low SG Pressure channels are shared with the Low SG Pressure signals which isolate the steam and feedwater lines.

8. High Pressurizer Pressure Trip The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and Main Steam Safety Valves (MSSVs), provides protection against overpressure conditions in the PCS when at operating temperature. The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (e.g., Loss of Load, Main Steam Isolation Valve (MSIV) closure, etc.) or which suddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety grade instrument channels with the TM/LP trip, Anticipated Transient Without Scram (ATWS) and PORV circuits, and the Pressurizer Low Pressure Safety Injection Signal.

Palisades Nuclear Plant B 3.3.1-13 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABLE 9. Thermal Marqin/Low Pressure (TM/LP) Trio SAFETY ANALYSIS (continued) The TM/LP trip is provided to prevent reactor operation when the DNBR is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The trip is initiated whenever the PCS pressure signal drops below a minimum value (Pmn) or a computed value (Pvar) as described below, whichever is higher.

The TM/LP trip uses Q Power, ASI, pressurizer pressure, and cold leg temperature (Tc) as inputs.

Q Power is the higher of core THERMAL POWER (AT Power) or nuclear power. The AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range excore channels as inputs. Both the AT and excore power signals have provisions for calibration by calorimetric calculations.

The ASI is calculated from the upper and lower power range excore detector signals, as explained in Section 1.1, "Definitions."

The signal is corrected for the difference between the flux at the core periphery and the flux at the detectors.

The Tc value is the higher of the two cold leg signals.

The Low Pressurizer Pressure trip limit (Pvar)iS calculated using the equations given in Table 3.3.1-2.

The calculated limit (Pva,) is then compared to a fixed Low Pressurizer Pressure trip limit (Pmn). The auctioneered highest of these signals becomes the trip limit (Ptp). Ptp is compared to the measured PCS pressure and a trip signal is generated when the measured pressure for that channel is less than or equal to Ptnp. A pre-trip alarm is also generated when P is less than or equal to the pre-trip setting, Ptp + AP.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS pressure for the existing temperature and power conditions. It is compared to actual PCS pressure in the TM/LP trip unit.

Palisades Nuclear Plant B 3.3.1-14 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABLE 10. Loss of Load Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses a single pressure switch in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

11. Containment High Pressure Trip The Containment High Pressure trip provides a reactor trip in the event of a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The Containment High Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two microswitches. One microswitch on each of four sensors provides an input to the RPS.

12. Zero Power Mode Bypass Removal The only RPS bypass considered in the safety analyses is the Zero Power Mode (ZPM) Bypass. The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow or temperature too low for the RPS Low PCS Flow, Low SG Pressure, or Thermal Margin/Low Pressure trips to be reset. ZPM bypasses are automatically removed if the wide range NI indicated power exceeds 1E-4% RTP.

Palisades Nuclear Plant B 3.3.1-15 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABLE 12. Zero Power Mode Bypass Removal (continued)

SAFETY ANALYSIS (continued) The safety analyses take credit for automatic removal of the ZPM Bypass if reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur with the affected trips bypassed and PCS flow, pressure, or temperature below the values at which the RPS could be reset. The ZPM Bypass would effectively be removed when the first wide range NI channel indication reached 1E-4% RTP. With the ZPM Bypass for two RPS channels removed, the RPS would trip on one of the un-bypassed trips.

This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur when PCS flow, steam generator pressure, and PCS pressure (TM/LP) were above their trip setpoints, a trip would terminate the event when power increased to the minimum setting (nominally 30%) of the Variable High Power Trip. In this case, the monitored parameters are at or near their normal operational values, and a trip initiated at 30% RTP provides adequate protection.

The RPS design also includes automatic removal of the Operating Bypasses for the High Startup Rate and Loss of Load trips. The safety analyses do not assume functioning of either these trips or the automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of the trip unit (including its output relays), any required portion of the associated instrument channel, or both, renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. Failure of an automatic ZPM bypass removal channel may also impact the associated instrument channel(s) and reduce the reliability of the affected Functions.

Palisades Nuclear Plant B 3.3.1-16 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES LCO Actions allow Trip Channel Bypass of individual channels, but the (continued) bypassed channel must be considered to be inoperable. The bypass key used to bypass a single channel cannot be simultaneously used to bypass that same parameter in other channels. This interlock prevents operation with more than one channel of the same Function trip channel bypassed. The plant is normally restricted to 7 days in a trip channel bypass, or otherwise inoperable condition before either restoring the Function to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit'determined in the safety analysis in order to account for uncertainties appropriate to the trip Function.

These uncertainties are addressed as described in plant documents.

Neither Allowable Values nor setpoints are specified for the non-safety related RPS Trip Functions, since no safety analysis assumptions would be violated if they are not set at a particular value.

The following Bases for each trip Function identify the above RPS trip Function criteria items that are applicable to establish the trip Function OPERABILITY.

1. Variable Hiah Power TriD (VHPT)

This LCO requires all four channels of the VHPT Function to be OPERABLE.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary VHPT trips during normal plant operations. The Allowable Value is low enough foi the system to function adequately during reactivity addition events.

Palisades Nuclear Plant B 3.3.1-17 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES LCO 1. Variable High Power Trip (VHPT) (continued)

(continued)

The VHPT is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During plant startup, the VHPT trip setpoint is initially at its minimum value, < 30%. Below 30% RTP, the VHPT setpoint is not required to "track" with Q Power, i.e., be adjusted to within 15% RTP. It remains fixed until manually reset, at which point it increases to 5 15% above existing Q Power.

The maximum allowable setting of the VHPT is 111% RTP.

Adding to this the possible variation in trip setpoint due to calibration and instrument error, the maximum actual steady state power at which a trip would be actuated is 115%, which is the value assumed in the safety analysis.

2. High Startup Rate Trip This LCO requires four channels of High Startup Rate Trip Function to be OPERABLE in MODES 1 and 2.

The High Startup Rate trip serves as a backup to the administratively enforced startup rate limit. The Function is not credited in the accident analyses; therefore, no Allowable Value for the trip or operating bypass Functions is derived from analytical limits and none is specified.

The four channels of the High Startup Rate trip are derived from two wide range NI signal processing drawers. Thus, a failure in one wide range channel could render two RPS channels inoperable. It is acceptable to continue operation in this condition because the High Startup Rate trip is not credited in any safety analyses.

The requirement for this trip Function is modified by a footnote, which allows the High Startup Rate trip to be bypassed when the wide range NI indicates below 1OE-4% or when THERMAL POWER is above 13% RTP. If a High Startup Rate trip is bypassed when power is between these limits, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-18 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES LCO 3. Low Primary Coolant System Flow Trip (continued)

This LCO requires four channels of Low PCS Flow Trip Function to be OPERABLE.

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insures that the reactor cannot operate when the flow rate is less than 93% of the nominal value considering instrument errors. Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below I E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

4, 5. Low Steam Generator Level Trip This LCO requires four channels of Low Steam Generator Level Trip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequate water inventory in the steam generators when the reactor is critical and is based upon narrow range instrumentation. The 25.9%

indicated level corresponds to the location of the feed ring.

6, 7. Low Steam Generator Pressure Trip This LCO requires four channels of Low Steam Generator Pressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand.

Since excessive steam demand causes the PCS to cool down, resulting in positive reactivity addition to the core, a reactor trip is required to offset that effect.

Revised 05/23/2002 Plant B 3.3.1-19 Revised 05/23/2002 Nuclear Plant Palisades Nuclear B 3.3.1-19

RPS Instrumentation B 3.3.1 BASES LCO (continued) 8. High Pressurizer Pressure Trip This LCO requires four channels of High Pressurizer Pressure Trip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressure increases in the PCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated.

9. Thermal Margin/Low Pressure (TM/LP) Trip This LCO requires four channels of TM/LP Trip Function to be OPERABLE.

The TM/LP trip setpoints are derived from the core thermal limits through application of appropriate allowances for measurement uncertainties and processing errors. The allowances specifically account for instrument drift in both power and inlet temperatures, calorimetric power measurement, inlet temperature measurement, and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt, fuel pellet manufacturing tolerances, core flow measurement uncertainty and core bypass flow, inlet temperature measurement time delays, and ASI measurement, are included in the development of the TM/LP trip setpoint used in the accident analysis.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below IE-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1 E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-20 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES LCO 10. Loss of Load Trip (continued)

The LCO requires four Loss of Load Trip Function channels to be OPERABLE in MODE 1 with THERMAL POWER >17% RTP.

The Loss of Load trip may be bypassed or be inoperable with THERMAL POWER < 17% RTP, since it is no longer needed to prevent lifting of the pressurizer safety valves or steam generator safety valves in the event of a Loss of Load. Loss of Load Trip unit must be considered inoperable if it is bypassed when THERMAL POWER is above 17% RTP.

This LCO requires four RPS Loss of Load auxiliary trip units, relays 305L and 305R, and pressure switch 63/AST-2 to be OPERABLE. With those components OPERABLE, a turbine trip will generate a reactor trip. The LCO does not require the various turbine trips, themselves, to be OPERABLE.

The Nuclear Steam Supply System and Steam Dump System are capable of accommodating the Loss of Load without requiring the use of the above equipment.

The Loss of Load Trip Function is not credited in the accident analysis; therefore, an Allowable Value for the trip cannot be derived from analytical limits, and is not specified.

11. Containment High Pressure Trip This LCO requires four channels of Containment High Pressure Trip Function to be OPERABLE.

The Allowable Value is high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) that are not indicative of an abnormal condition.

The setting is low enough to initiate a reactor trip to prevent containment pressure from exceeding design pressure following a DBA and ensures the reactor is shutdown before initiation of safety injection and containment spray.

Palisades Nuclear Plant B 3.3.1-21 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES LCO (continued) 12. ZPM Bypass The LCO requires that four channels of automatic Zero Power Mode (ZPM) Bypass removal instrumentation be OPERABLE.

Each channel of automatic ZPM Bypass removal includes a shared wide range NI channel, an actuating bistable in the wide range drawer, and a relay in the associated RPS cabinet. Wide Range NI channel 1/3 is shared between ZPM Bypass removal channels A and C; Wide Range NI channel 2/4, between ZPM Bypass removal channels B and D. An operable bypass removal channel must be capable of automatically removing the capability to bypass the affected RPS trip channels with the ZPM Bypass key switch at the proper setpoint.

APPLICABILITY This LCO requires all safety related trip functions to be OPERABLE in accordance with Table 3.3.1-1.

Those RPS trip Functions which are assumed in the safety analyses (all except High Startup Rate and Loss of Load), are required to be operable in MODES 1 and 2, and in MODES 3, 4, and 5 with more than one full-length control rod capable of being withdrawn and PCS boron concentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES 3, 4, or 5, if PCS boron concentration is at REFUELING BORON CONCENTRATION, or when no more than one full-length control rod is capable of being withdrawn, because the RPS Function is already fulfilled. REFUELING BORON CONCENTRATION provides sufficient negative reactivity to assure the reactor remains subcritical regardless of control rod position, and the safety analyses assume that the highest worth withdrawn full-length control rod will fail to insert on a trip. Therefore, under these conditions, the safety analyses assumptions will be met without the RPS trip Function.

The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, "Nuclear Instrumentation."

Palisades Nuclear Plant B 3.3.1-22 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES APPLICABILITY (continued) The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, "Nuclear Instrumentation."

The Loss of Load trip is required to be OPERABLE with THERMAL POWER at or above 17% RTP. Below 17% RTP, the ADVs are capable of relieving the pressure due to a Loss of Load event without challenging other overpressure protection.

The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESF in providing acceptable consequences during accidents.

ACTIONS The most common causes of channel inoperability are outright failure of loop components or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to the "safe" condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is found inoperable, all affected Functions provided by that channel must be declared inoperable, and the plant must enter the Condition for the particular protection Functions affected.

Palisades Nuclear Plant B 3.3.1-23 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES ACTIONS (continued) When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

A.1 Condition A applies to the failure of a single channel in any required RPS Function, except High Startup Rate, Loss of Load, or ZPM Bypass Removal. (Condition A is modified by a Note stating that this Condition does not apply to the High Startup Rate, Loss of Load, or ZPM Bypass Removal Functions. The failure of one channel of those Functions is addressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel is inoperable, operation is allowed to continue. Since the trip unit and associated instrument channel combine to perform the trip function, this Condition is also appropriate if both the trip unit and the associated instrument channel are inoperable. Though not required, the inoperable channel may be bypassed. The provision of four trip channels allows one channel to be bypassed (removed from service) during operations, placing the RPS in two-out-of-three coincidence logic. The failed channel must be restored to OPERABLE status or placed in trip within 7 days.

Required Action A.1 places the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent trip.

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.1-24 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES ACTIONS A.1 (continued)

(continued)

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

B. 1 Condition B applies to the failure of a single High Startup Rate trip unit or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to entering MODE 2 from MODE 3. A shutdown provides the appropriate opportunity to repair the trip function and conduct the necessary testing. The Completion Time is based on the fact that the safety analyses take no credit for the functioning of this trip.

C.1 Condition C applies to the failure of a single Loss of Load or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to THERMAL POWER ý: 17% RTP following a shutdown. If the plant is shutdown at the time the channel becomes inoperable, then the failed channel must be restored to OPERABLE status prior to THERMAL POWER > 17% RTP. For this Completion Time, "following a shutdown" means this Required Action does not have to be completed until prior to THERMAL POWER _>17% RTP for the first time after the plant has been in MODE 3 following entry into the Condition. The Completion Time trip assures that the plant will not be restarted with an inoperable Loss of Load trip channel.

Palisades Nuclear Plant B 3.3.1-25 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

Condition D applies when one or more automatic ZPM Bypass removal channels are inoperable. Ifthe ZPM Bypass removal channel cannot be restored to OPERABLE status, the affected ZPM Bypasses must be immediately removed, or the bypassed RPS trip Function channels must be immediately declared to be inoperable. Unless additional circuit failures exist, the ZPM Bypass may be removed by placing the associated "Zero Power Mode Bypass" key operated switch in the normal position.

A trip channel which is actually bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must immediately be declared to be inoperable.

E.1 and E.2 Condition E applies to the failure of two channels in any RPS Function, except ZPM Bypass Removal Function. (The failure of ZPM Bypass Removal Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does not apply to the ZPM Bypass Removal Function.

The Required Actions are modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel tripped.

MODE changes in this configuration are allowed because two trip channels for the affected function remain OPERABLE. A trip occurring in either or both of those channels would cause a reactor trip.

In this configuration, the protection system is in a one-out-of-two logic, and the probability of a common cause failure affecting both of the OPERABLE channels during the 7 days permitted is remote.

Required Action E.1 provides for placing one inoperable channel in trip within the Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Though not required, the other inoperable channel may be (trip channel) bypassed.

Palisades Nuclear Plant B 3.3.1-26 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES ACTIONS E.1 and E.2 (continued)

(continued) This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed or inoperable in an untripped condition, the RPS is in a two-out-of-three logic for that function; but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, one of the inoperable channels is placed in trip. This places the RPS in a one-out-of-two for that function logic. If any of the other unbypassed channels for that function receives a trip signal, the reactor will trip.

Action E.2 is modified by a Note stating that this Action does not apply to (is not required for) the High Startup Rate and Loss of Load Functions.

One channel is required to be restored to OPERABLE status within 7 days for reasons similar to those stated under Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action E.2 must be placed in trip if more than 7 days have elapsed since the initial channel failure.

F. 1 The power range excore channels are used to generate the internal ASI signal used as an input to the TM/LP trip. They also provide input to the Thermal Margin Monitors for determination of the Q Power input for the TM/LP trip and the VHPT. If two power range excore channels cannot be restored to OPERABLE status, power is restricted or reduced during subsequent operations because of increased uncertainty associated with inoperable power range excore channels which provide input to those trips.

The Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is adequate to reduce power in an orderly manner without challenging plant systems.

Revised 05/23/2002 B 3.3.1-27 Nuclear Plant Palisades Nuclear Plant B 3.3.1-27 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES ACTIONS G.1, G.2.1, and G.2.2 (continued)

Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, E, or F are not met, or if the control room ambient air temperature exceeds 90 0 F.

If the control room ambient air temperature exceeds 90 0 F, all Thermal Margin Monitor channels are rendered inoperable because their operating temperature limit is exceeded. In this condition, or if the Required Actions and associated Completion Times are not met, the reactor must be placed in a condition in which the LCO does not apply.

To accomplish this, the plant must be placed in MODE 3, with no more than one full-length control rod capable of being withdrawn or with the PCS boron concentration at REFUELING BORON CONCENTRATION in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The Completion Time is reasonable, based on operating experience, for placing the plant in MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The Completion Time is also reasonable to ensure that no more than one full-length control rod is capable of being withdrawn or that the PCS boron concentration is at REFUELING BORON CONCENTRATION.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column of REQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Under most conditions, a CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Palisades Nuclear Plant B 3.3.1-28 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS (continued) Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. Ifa channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

The Containment High Pressure and Loss of Load channels are pressure switch actuated. As such, they have no associated control room indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.1.2 This SR verifies that the control room ambient air temperature is within the environmental qualification temperature limits for the most restrictive RPS components, which are the Thermal Margin Monitors. These monitors provide input to both the VHPT Function and the TM/LP Trip Function. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is reasonable based on engineering judgement and plant operating experience.

SR 3.3.1.3 A daily calibration (heat balance) is performed when THERMAL POWER is > 15%. The daily calibration consists of adjusting the "nuclear power calibrate" potentiometers to agree with the calorimetric calculation if the absolute difference is > 1.5%. Nuclear power is adjusted via a potentiometer, or THERMAL POWER is adjusted via a Thermal Margin Monitor bias number, as necessary, in accordance with the daily calibration (heat balance) procedure. Performance of the daily calibration ensures that the two inputs to the Q power measurement are indicating accurately with respect to the much more accurate secondary calorimetric calculation.

Palisades Nuclear Plant B 3.3.1-29 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS (continued) The Frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is > 15% RTP.

The secondary calorimetric is inaccurate at lower power levels. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows time requirements for plant stabilization, data taking, and instrument calibration.

SR 3.3.1.4 It is necessary to calibrate the power range excore channel upper and lower subchannel amplifiers such that the measured ASI reflects the true core power distribution as determined by the incore detectors. ASI is utilized as an input to the TM/LP trip function where it is used to ensure that the measured axial power profiles are bounded by the axial power profiles used in the development of the TnIt limitation of LCO 3.4.1. An adjustment of the excore channel is necessary only if reactor power is greater than 25% RTP and individual excore channel ASI differs from AXIAL OFFSET, as measured by the incores, outside the bounds of the following table:

Allowed Group 4 Group 4 Reactor Rods a 128" withdrawn Rods <128" withdrawn Power

< 100% -0.020 5 (AO-ASI) 5 0.020 -0.040 < (AO-ASI) < 0.040

< 95 -0.033 s (AO-ASI) s 0.020 -0.053 : (AO-ASI) 5 0.040

< 90 -0.046 5 (AO-ASI) 50.020 -0.066 5 (AO-ASI) 5 0.040

< 85 -0.060 5 (AO-ASI) <0.020 -0.080:5 (AO-ASI) 5 0.040

< 80 -0.133 S (AO-ASI) s 0.080 -0.153 : (AO-ASI) 5 0.100

< 75 -0.146 5 (AO-ASI) 5 0.080 -0.153 :5 (AO-ASI) < 0.100

< 70 -0.153 5 (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 5 0.100

< 65 -0.153 S (AO-ASI) S 0.080 -0.153 5 (AO-ASI) S 0.100

< 60 -0.153 5 (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 5 0.100

< 55 -0.153 < (AO-ASI) < 0.080 -0.153 5 (AO-ASI) 5 0.100

< 50 -0.153 5 (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) < 0.100

< 45 -0.153 5 (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 5 0.100

< 40 -0.153 5 (AO-ASI) 5 0.080 -0.153 < (AO-ASI) :5 0.100

< 35 -0.153 5 (AO-ASI) < 0.080 -0.153 5 (AO-ASI) 5 0.100

< 30 -0.153 5 (AO-ASI) 5 0.080 -0.153:5 (AO-ASI) 5 0.100

< 25 Below 25% RTP any AO/ASI difference is acceptable Table values determined with a conservative Pv. gamma constant of -9420.

Palisades Nuclear Plant B 3.3.1-30 Revised 05/23/2002

RPS Instrumentation B 3.3 1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS (continued) Below 25% RTP any difference between ASI and AXIAL OFFSET is acceptable. A Note indicates the Surveillance is not required to have been performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is > 25% RTP.

Uncertainties in the excore and incore measurement process make it impractical to calibrate when THERMAL POWER is < 25% RTP. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows time for plant stabilization, data taking, and instrument calibration.

The 31 day Frequency is adequate, based on operating experience of the excore linear amplifiers and the slow burnup of the detectors. The excore readings are a strong function of the power produced in the peripheral fuel bundles and do not represent an integrated reading across the core. Slow changes in neutron flux during the fuel cycle can also be detected at this Frequency.

SR 3.3.1.5 A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, except Loss of Load and High Startup Rate, every 92 days to ensure the entire channel will perform its intended function when needed. For the TM/LP Function, the constants associated with the Thermal Margin Monitors must be verified to be within tolerances.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 5).

Palisades Nuclear Plant B 3.3.1-31 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) A calibration check of the power range excore channels using the internal test circuitry is required every 92 days. This SR uses an internally generated test signal to check that the 0% and 50% levels read within limits for both the upper and lower detector, both on the analog meter and on the TMM screen. This check verifies that neither the zero point nor the amplifier gain adjustment have undergone excessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operating experience, and takes into account indications and alarms available to the operator in the control room.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on the Loss of Load and High Startup Rate channels is performed prior to a reactor startup to ensure the entire channel will perform its intended function.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-1/3 sends a trip signal to RPS channels A and C; NI-2/4 to channels B and D. Since each High Startup Rate channel would cause a trip on two RPS channels, the High Startup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring turbine auto stop oil pressure which is not tested when the reactor is critical. Operating experience has shown that these components usually pass the Surveillance when performed at a Frequency of once per 7 days prior to each reactor startup.

Palisades Nuclear Plant B 3.3.1-32 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 REQUIREMENTS (continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (except neutron detectors). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be consistent with the setpoint analysis.

The bistable setpoints must be found to trip within the Allowable Values specified in the LCO and left set consistent with the assumptions of the setpoint analysis. The Variable High Power Trip setpoint shall be verified to reset properly at several indicated power levels during (simulated) power increases and power decreases.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the setpoint analysis.

As part of the CHANNEL CALIBRATION of the wide range Nuclear Instrumentation, automatic removal of the ZPM Bypass for the Low PCS Flow, TM/LP must be verified to assure that these trips are available when required.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

This SR is modified by a Note which states that it is not necessary to calibrate neutron detectors because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in power range excore neutron detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.3) and the monthly calibration using the incore detectors (SR 3.3.1.4). Sudden changes in detector performance would be noted during the required CHANNEL CHECKS (SR 3.3.1.1).

Palisades Nuclear Plant B 3.3.1-33 Revised 05/23/2002

RPS Instrumentation B 3.3.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100

3. IEEE Standard 279-1971, April 5, 1972

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant B 3.3.1-34 Revised 05/23/2002

RPS Instrumentation B 3.3.1 Table B 3.3.1-1 (page 1 of 1)

Instruments Affecting Multiple Specifications REQUIRED AFFECTED INSTRUMENT CHANNELS SPECIFICATIONS Source Range NI-1/3 & 2/4, Count Rate Signal 3.3.9 3.9.2 Source Range NI-1/3, Count Rate Indication @ C-150 Panel 3.3.8 #1 Wide Range NI-1/3 & 2/4, Flux Level 104 Bypass 3.3.1 #3,6,7,9,&12 Wide Range N1-1/3 & 2/4, Startup Rate 3.3.1 #2 Wide Range NI-1/3 & 2/4, Flux Level Indication 3.3.7 #3 3.3.9 Power Range NI-5, 6, 7, & 8, Tq 3.2.1 3.2.3 Power Range NI-5, 6, 7, & 8, Q Power 3.3.1 #1 & 9 Power Range NI-5, 6, 7, & 8, ASI 3.3.1 #9 3.2.1 3.2.4 Power Range NI-5, 6, 7, & 8, Loss of Load/High Startup Rate Bypass 3.3.1 #2 & 10 PCS TC TT-0112 &'0122 CC & CD, Temperature Signal (SMM) 3.3.7 #5 PCS TC TT-0112 & 0122 CA, CB, CC, & CD, Temperature Signal (Q Power & TMM) 3.3.1 #1 & 9 3.4.1 .b PCS TC TT-01 12CA & 0122CB, Temperature Signal (LTOP) 3.4.12.b.1 PCS TC TT-0112CC & 0122CD (PTR-0112 & 0122) Temperature Indication 3.3.7 #2 PCS TC TT-01 12CA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6 PCS TC TT-0122CB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 PCS TH TT-0112 & 0122 HC & HD, Temperature Signal (SMM) 3 3.7 #5 PCS TH TT-0112HC & 0122HD (PTR-0112 & 0122) Temperature Indication 3.3.7 #1 PCS TH TT-01 12 & 0122 HA, HB, HC, & HD, Temperature Signal (Q Power) 3 3.1 #1 & 9 PCS TH TT-01 12HA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6 PCS TH TT-0122HB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 Thermal Margin Monitor PY-0102A, B, C, & D 3.3.1 #1 & 9 Pressurizer Pressure PT-0105A & B, Pressure Signal (WR Indication & LTOP) 3.3.7 #5 3.4.12.b.1 I

Pressurizer Pressure PT-0102A, B, C, & D, Pressure Signal (RPS & SIS) 3.3.1 #8 & 9 3.3.3 #1.a&7a Pressurizer Pressure PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.1 3.4.14 Pressurizer Pressure PI-0110, Pressure Indication @ C-150 Panel 3.3.8#2 SG Level LT-0751 & 0752 A, B, C, & D, Level Signal (RPS & AFAS) 3.3.1 #4 & 5 3.3 3 #4 a & 4.b SG Level LI-0757C & 0758C, Wide Range Level Indication @ C-150 Panel 3.3.8 #10 & 11 SG Level LI-0757 & 0758 A & B, Wide Range Level Indication 3.3.7#11 & 12 SG Pressure PT-0751 & 0752 A, B, C, & D, Pressure Signal (RPS & SG Isolation) 3.3.1 #6&7 3.3.3 #2a, 2b,7b,7c SG Pressure PIC-0751 & 0752 A, B, C, & D, Pressure Indication 3.3.7 #13 & 14 SG Pressure PI-0751E & 0752E, Pressure Indication @ C-150 Panel 3.3.8 #8 & 9 Containment Pressure PS-1 801, 1802, 1803, & 1804, Switch Output (RPS) 3.3.1 #11 Containment Pressure PS-1801, 1802A, 1803, & 1804A, Switch Output (ESF) 3.3.3 #5.a Containment Pressure PS-1801A, 1802, 1803A, & 1804, Switch Output (ESF) 3.3.3 #5.b Note: The information provided in this table is intended for use as an aid to distinguish those instrument channels which provide more than one required function and to describe which specifications they affect. The information in this table should not be taken as inclusive for all instruments nor affected specifications.

Palisades Nuclear Plant B 3.3.1-35 Revised 05/23/2002

ESF Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Engineered Safety Features (ESF) Instrumentation BASES BACKGROUND The ESF Instrumentation initiates necessary safety systems, based upon the values of selected plant parameters, to protect against violating core design limits and the Primary Coolant System (PCS) pressure boundary and to mitigate accidents.

The ESF circuitry generates the signals listed below when the monitored variables reach levels that are indicative of conditions requiring protective action. The inputs to each ESF actuation signal are also listed.

1. Safety Injection Signal (SIS).

a. Containment High Pressure (CHP)

b. Pressurizer Low Pressure

2. Steam Generator Low Pressure (SGLP);

a. Steam Generator A Low Pressure

b. Steam Generator B Low Pressure

3. Recirculation Actuation Signal (RAS);

a. Safety Injection Refueling Water Tank (SIRWT) Low Level

4. Auxiliary Feedwater Actuation Signal (AFAS);

a. Steam Generator A Low Level

b. Steam Generator B Low Level

5. Containment High Pressure Signal (CHP);

a. Containment High Pressure - Left Train

b. Containment High Pressure - Right Train Palisades Nuclear Plant B.3.3.3-1 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND 6. Containment High Radiation Signal (CHR);

(continued)

a. Containment High Radiation

7. Automatic Bypass Removal

a. Pressurizer Pressure Low Bypass

b. Steam Generator A Low Pressure Bypass

c. Steam Generator B Low Pressure Bypass In the above list of actuation signals, the CHIP and RAS are derived from pressure and level switches, respectively.

Equipment actuated by each of the above signals is identified in the FSAR, Chapter 7. (Ref. 1).

The ESF circuitry, with the exception of RAS, employs two-out-of-four logic. Four independent measurement channels are provided for each function used to generate ESF actuation signals. When any two channels of the same function reach their setpoint, actuating relays are energized which, in turn, initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment.

RAS logic consists of output contacts of the relays actuated by the SIRWT level switches arranged in a "one-out-of-two taken twice" logic.

The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS. Loss of a single battery, therefore, cannot either cause or prevent RAS initiation.

The ESF logic circuitry contains the capability to manually block the SIS actuation logic and the SGLP action logic during normal plant shutdowns to avoid undesired actuation of the associated equipment.

In each case, when three of the four associated measurement channels are below the block setpoint, pressing a manual pushbutton will block the actuation signal for that train. Iftwo of the four of the measurement channels increase above the block setpoint, the block will automatically be removed.

Palisades Nuclear Plant B 3.3.3-2 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND 7. Automatic Bypass Removal (continued)

(continued)

The sensor subsystems,, ncluding individual channel actuation bistables, is addressed in this LCO. The actuation logic subsystems, manual actuation, and downstream components used to actuate the individual ESF components are addressed in LCO 3.3.4.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable'electronic-signal based upon the physical characteristics of the parameter being measured.

Four identical measurement channels are provided for each parameter used in the generation of trip signals. These are designated Channels A through D. Measurement channels provide input to ESF bistables within the same ESF channel. In addition, some measurement channels may also be used as inputs to Reactor Protective System (RPS) bistables, and most provide indication in the control room.

When a channel monitoring a parameter indicates an abnormal condition, the bistable monitoring the parameter in that channel will trip.

In the case of RAS and CHP, the sensors are latching auxiliary relays an from level and pressure switches, respectively, which do not develop analog input to separate bistables. Tripping two or more channels monitoring the same parameter will actuate both channels of Actuation

• Logic of the associated ESF equipment.

Three-of the four measurement and bistable channels are necessary to meet the redundancy and testability of GDC 21 in Appendix A to 10 CFR 50 (Ref. 2). The fourth channel provides additional flexibility by allowing one channel to be removed from Service for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure Will prevent'a protective system actuation and no protective channel feeds a control channel, this arrangement meets the requirements of IEEE Standard 279 -1971 (Ref. 3).

B 3.3.3-3 Revised 04/22/2002 Palisades Nuclear Plant

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

The ESF Actuation Functions are generated by comparing a single measurement to a fixed bistable setpoint. The ESF Actuation Functions utilize the following input instrumentation:

• Safety Iniection Sigqnal (SIS)

The Safety Injection Signal can be generated by any of three inputs: Pressurizer Low Pressure, Containment High Pressure, or Manual Actuation. Manual Actuation is addressed by LCO 3.3.4; Containment High Pressure is discussed below. Four instruments (channels A through D), monitor Pressurizer Pressure to develop the SIS actuation. Each of these instrument channels has two individually adjustable ESF bistable trip devices, one for the bypass removal-circuit (discussed below) and one for SIS. Each ESF bistable trip device actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LCO3.3.4. The instrument channels associated with each Pressurizer Low Pressure SIS actuation bistable include the pressure measurement loop, the SIS actuation bistable, and the two auxiliary relays associated with that bistable. The bistables associated with automatic removal of the Pressurizer Low Pressure Bypass are discussed under Function 7.a, below.

• Low Steam Generator Pressure Signal (SGLP)

There are two separate Low Steam Generator Pressure signals, one for each steam generator. For each steam generator, four instruments (channels A through D) monitor pressure to develop the SGLP actuation. Each of these instrument channels has two individually, adjustable ESF bistable'trip-devices, one for the bypass removal circuit (discussed below) and one for SGLP.

Each Steam SGLP bistable trip device actuates an auxiliary relay.

The output contacts from these auxiliary relays form the SGLP logic circuits addressed in LCO 3.3.4. The instrument channels associated with each Steam Generator Low Pressure Signal bistable include the pressure measurement loop, the SGLP actuation bistable, and the auxiliary relay associated with that bistable. The bistables associated with automatic removal of the SGLP Bypass are discussed under Function 7.a, below.

Palisades Nuclear Plant B 3.3.3-4 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

• Recirculation Actuation Signal (RAS)

There are four Safety Injection Refueling Water (SIRW) Tank level instruments used to develop the RAS signal. Each of these instrument channels actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LCO 3.3.4. The SIRW Tank Low Level instrument channels associated with each RAS actuation bistable include the level instrument and the two auxiliary relays associated with that instrument.

Auxiliary Feedwater Actuation Signal (AFAS)

There are two separate AFAS signals (AFAS channels A and B),

each one actuated on low level in either steam generator. For each steam generator, four level instruments (channels A through D) monitor level to develop the AFASactuation signals. The output contacts from the bistables on these level channels form 7,the SGLP logic circuits addressed in LCO 3.3.4. The instrument channels associated with each Steam Generator Low Level Signal bistable include the level measurement loop and the Low Level

",AFAS bistable.

Containment High Pressure Actuation (CHP)

The Containment High Pressure signal is actuated by two sets of four pressure switches, one set for each train. The output contacts from these pressure switches form the CHP logic circuits addressed in LCO 3.3.4.

Palisades Nuclear Plant B 3.3.3-5 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

• Containment High Radiation Actuation (CHR)

The CHR signal can be generated by either of two inputs: High Radiation or Manual Actuation: Manual Actuation is addressed by LCO 3.3.4. Four radiation monitor instruments (channels A through D), monitor containment area radiation level to develop the CHR signal.' Each CHR monitor bistable device actuates one auxiliary relay which has contacts in each CHR logic train addressed in LCO 3.3.4. The instrument channels associated with each CHR-actuation bistable include the radiation monitor itself and the associated auxiliary relay.

• Automatic Bypass Removal Functions Pressurizer Lovm PFressure and Steam Generator Low Pressure logic circuits have the capability to be blocked to avoid undesired actuation when priessure is intentionally lowered during plant shutdowns: In each case these bypasses are automatically removed when the measured pressure exceeds the bypass permissive setpoiht. The measureme'nt channels which provide the bypass removal signal are the same channels which provide the actuation signal. Each of these pressure measurement channels has two bistables, one for actuation and one for the bypass removal Function. The pressurizer pressure channels include an auxiliary relay actuated by the bypass removal bistable.

The logic circuits for Automatic Bypass Removal Functions are addressed by LCO 3.3.4.

Several measurement instrument channels provide more than one required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

Palisades Nuclear Plant B 3.3.3-6 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND Bistable Trip Units (continued) There are four channels of bistables, designated A through D, for each ESF Function, one for each measurement channel. The bistables for all required Functions, except CHP and RAS, receive an analog input from the measurement device, compare the analog input to trip setpoints, and provide contact output to the Actuation Logic. CHP and RAS are

.actuated by pressure'switches and level switches respectively.

The Allowable Values are specified for each safety related ESF trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value

'if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis' in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is hot within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that Safety Limits of Chapter 2.0, "SAFETY LIMITS (SLs)," are not violated during Anticipated Operational Occurrences (AOOs) and that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed. (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set,. isolation of the main condenser, and loss of all offsite power.")

ESF Instrument Channel Bypasses The only ESF instrument channels with built-in bypass capability are the Low SG Level AFAS bistables. Those bypasses are effected by a key operated switch, similar to the RPS Trip Channel Bypasses. A bypassed Low SG Level channel AFAS bistable cannot perform its specified function and must be considered inoperable.

Palisades Nuclear Plant B 3.3.3-7 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES BACKGROUND ESF Instrument Channel Bypasses (continued)

(continued)

While there are no other built-in provisions for instrument channel bypasses in the ESF design (bypassing any other channel output requires-opening a circuit link, lifting a lead, or using a jumper), this LCO includes requirements for OPERABILITY of the instrument channels and bistables which provide input to the Automatic Bypass Removal Logic channels required by LCO 3.3.4, "ESF Logic and Manual Initiation.!

The Actuation Logic channels for Pressurizer Pressure and Steam Generator Low Pressure, however, have the ability to be manually bypassed when the associated pressure is below the range where automatic protection is required. These actuation logic channel bypasses may be manually initiated when three-out-of-four bypass permissive bistables indicate below their setpoint. When two-out-of-four of these bistables are. above their bypass permissive setpoint, the actuation logic channel bypass is automatically removed. The bypass permissive bistables use the same four measurement channels as the blocked ESF function for their inputs.-

APPLICABLE Each of the analyzed accidents can be detected by one or more ESF SAFETY ANALYSES Functions. One of the ESF Functions is the primary actuation signal for that accident. An ESF Function may be the primary actuation signal for more than one type of accident. An ESF Function may also be a secondary, or backup, actuation signal for one or more other accidents.

Functions not specifically credited in the accident analysis, serve as backups and are part of the NRC approved licensing basis for the plant.

Palisades Nuclear Plant B 3.3.3-8 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES APPLICABLE ESF protective Functions are as follows.

SAFETY ANALYSES (continued) I1. Safety Injection Signal (SIS)

The SIS ensures acceptable consequences during Loss of Coolant Accident (LOCA) events, including steam generator tube rupture, and Main Steam Line Breaks (MSLBs) or Feedwater Line Breaks (FWLBs) (inside containment). To provide the required protection, SIS is actuated by a CHP signal, or by two-out-of-four Pressurizer Low Pressure channels decreasing below the setpoint. SIS initiates the following actions:

a. Start HPSI & LPSI pumps;

b. Start component cooling water and service water pumps;

c. Initiate service water valve operations;

d. Initiate component cooling water valve operations;

e. Start containment cooling fans (when coincident with a loss of offsite power);

f. Enable Containment Spray Pump Start on CHP; and

g. Initiate Safety Injection Valve operations.

Each SIS logic train is also actuated by a contact pair on one of the CHP initiation relays for the associated CHP train.

2. Steam Generator Low Pressure Signal (SGLP)

The SGLP ensures acceptable consequences during an MSLB or FWLB by isolating the steam generator if it indicates a low steam generator pressure. The SGLP concurrent with or following a reactor trip, minimizes the rate of heat extraction and suosequent cooldown of the PCS during these events.

Palisades Nuclear Plant B 3.3.3-9 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES APPLICABLE 2. Steam Generator Low Pressure Signal (SGLP) (continued)

SAFETY ANALYSES (continued) One SGLP circuit is provided for each SG. Each SGLP circuit is actuated by two-out-of-four pressure channels on the associated SG reaching their setpoint SGLP initiates the following actions:

a. Close the associated Feedwater Regulating valve and its bypass; and

b. Close both Main Steam Isolation Valves.

3. Recirculation Actuation Siqnal At the end of the injection phase of a LOCA, the SIRWT will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. Switchover from SIRWT to the containment sump must occur before the SIRWT empties to prevent damage to the ECCSpumps and a loss of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sump to support pump suction.

Furthermore, early switchover must not occur to ensure sufficient borated water is injected from the SIRWT to ensure the reactor remains shut down in the recirculation mode. An SIRWT Low Level signal initiates the RAS.

RAS initiates the following actions:

a. Trip LPSI pumps (this trip can be manually bypassed);

b. Switch HPSI and containment spray pump suction from SIRWT to Containment Sump by opening sump CVs and closing SIRWT CVs;

c. Adjust cooling water to component cooling heat exchangers;

d. Open HPSI subcooling valve CV-3071 if the associated HPSI pump is operating,

e. Afte'r containment sump valve CV-3030 is opened, open HPSI subcooling valve CV-3070 if the associated HPSI pump is operating;

f. Close containment spray valve CV-3001 ifcontainment sump valve CV-3030 does not open.

Palisades Nuclear Plant B 3.3.3-10 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES APPLICABLE 3 Recirculation Actuation Signal (continued)

SAFETY ANALYSES (continued) The RAS signal is actuated by sepaiate sensors from thosewhich provide tank level indication. The allowable range of 21" to 27" above the tank floor corresponds to 1.1% to 3.3% indicated level.

Typically the actual setting is near the midpoint of the allowable range.

4 Auxiliary Feedwater Actuation Signal An AFAS initiates feedwater flow to both steam generators if a low level is indicated in either steam generator.

The AFAS maintains a steam generator heat sink during the following events:

"* MSLB;

"* FWLB;

"* LOCA; and

"* Loss of feedwater.

5. Containment Hiah Pressure Sicnal (CHP) hJ hJ I I The CHP signal'closes all containment isolation valves not required for ESF operation and starts containment spray (if SIS enabled), ensuring acceptable consequences during LOCAs, control rod ejection events, MSLBs, or FWLBs (inside containment).

CHP is actuated by two-out-of-four pressure switches for the associated train reaching their setpoints. CHP initiates the following actions:

a. Containment Spray;

b. Safety Injection Signal;

c. Main Feedwater Isolation; Palisades Nuclear Plant B 3.3.3-11 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES APPLICABLE 5. Containment High Pressure Signal (CHP) (continued)

SAFETY ANALYSIS (continued) d. Main Steam Line isolation;

e. Control Room HVAC Emergency Mode; and

f. Containment Isolation Valve Closure.

6. Containment High Radiation Signal (CHR)

CHR is actuated by two-out-of-four radiation monitors exceeding their setpoints. CHR initiates the following actions to ensure acceptable consequences following a LOCA or control rod ejection event:

a. Control Room HVAC Emergency Mode;

b. Containment Isolation Valve Closure; and

c. Block automatic starting of ECCS pump room sump pumps.

During refueling operations, separate switch-selectable radiation monitors initiate CHR, as addressed by LCO 3.3.6.

7. Automatic Bypass Removal Functions The logic circuitry provides automatic removal of the Pressurizer Pressure Low and Steam Generator Pressure Low actuation signal bypasses. There are no assumptions in the safety analyses which assume operation of these automatic bypass removal circuits, and no analyzed events result in conditions where the automatic removal would be required to mitigate the event. The automatic removal circuits are required to assure that logic circuit bypasses will not beoverlooked during a plant startup.

The ESF Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.3.3-12 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES LCO The LCO requires all channel components necessary to provide an ESF actuation to be OPERABLE.

The Bases for the LCO on ESF Functions are addressed below.

1. Safety Injection Signal (SIS)

This LCO requires four channels of SIS Pressurizer Low Pressure to be OPERABLE in MODES 1, 2, and 3.

The setpoint was chosen so as to be low enough to avoid actuation during plant operating transients, but to be high enough to be quickly actuated by a LOCA bor MSLB. The settings include an uncertainty allowance Which is consistent with the settings assumed in the MSLB analysis (which bounds the settings assumed in the LOCA analysis):.

2. Steam Generator Low Pressure Signal (SGLP)

This LCO requires four channels of Steam Generator Low Pressure Instrurnentation for each SG to be OPERABLE in MODES 1, 2, and 3.' However,as indicated in Table 3.3.3-1, Note (a), the SGLP Function is not required to be OPERABLE in MODES 2 or 3 if all Main Steam Isolation Valves (MSIVs) are closed and deactivated and all Main Feedwater Regulating Valves (MFRVs) and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves.

The setpoint was chosen to be low enough to avoid actuation during plant operation, but be close enough to full power operating pressure to be actuated quickly in the event of a MSLB. The setting inclufies'an uncertainty allowance which is consistent with the setting used in the Reference 4 analysis.

Each SGLP logic is made up of output contacts from four pressure bistables from the associated SG. When the logic circuit is satisfied, two relays are energized to actuate steam and feedwater line isolation.-

Palisades Nuclear Plant B 3.3.3-i13 IRevised 04/22/2002

ESF Instrumentation B 3.3.3 BASES LCO 2. Steam Generator Low Pressure Signal (SGLP) (continued)

(continued)

This LCO applies to failures in the four sensor subsystems, including sensors, bistables, and associated equipment. Failures in the actuation subsystems are considered Actuation Logic failures and are addressed in LCO 3.3.4.

3. Recirculation Actuation Signal (RAS)

This LCO requires four channels of SIRWT Low Level to be OPERABLE in MODES 1, 2, and 3.

The setpoint was chosen to provide adequate water in the containment sump for HPSI pump net positive suction head following an accident, but prevent the pumps from running dry during the switchover.

The upper limit on the Allowable Value for this trip is set low enough to ensure RAS does not initiate before sufficient water is transferred to the containment sump. Premature recirculation could impair the reactivity control Function of safety injection by limiting the amount of boron injection. Premature recirculation could also damage or disable the recirculation system if recirculation begins before the sump has enough water.

The lower limit on the SIRWT Low Level trip Allowable Value is high enough to transfer suction to the containment sump prior to emptying the SIRWT.

4. Auxiliary Feedw'ater Actuation Signal (AFAS)

The AFAS logic actuates AFW to each SG on a SG Low Level in either SG.

The Allowable Value was chosen to assure that AFW flow would be initiated while the SG could still act as a heat sink and steam source, and to assure that a reactor trip would not occur on low level without the actuation of AFW.

Palisades Nuclear Plant B 3.3.3-14 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES LCO 4. Auxiliary Feedwater Actuation Signal (AFAS) (continued)

(continued)

This LCO requires four channels for each steam generator of Steam Generator Low Level to be OPERABLE in MODES 1, 2, and 3.

5. Containment High Pressure Signal (CHP)

This LCO requires four channels of CHP to be OPERABLE for each of the associated ESF trains (left and right) in MODES 1, 2, 3,and 4.

The setpoint was chosen so as to behigh enough to avoid actuation by containment temperature or atmospheric pressure changes, but low enough to be quickly actuated by a LOCA or a MSLB in the containment.

6. Containment High Radiation Signal (CHR)

This LCO requires four channels of CHR to be OPERABLE in MODES 1, 2,3, and 4.

The setpoint is based on the maximum primary coolant leakage to the containment atmosphere allowed by LCO 3.4.13 and the maximum activity allowed by LCO 3.4.16. N18 concentration reaches equilibrium in containment atmosphere due to its short half-life, but other activity was assumed to build up. At the end of a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> leakage period the dose rate is approximately 20 RPh as seen by the area monitors. A large leak could cause the area dose rate to quickly exceed the 20 R/Pi setting and initiate CHR.

7. Automatic Bypass Removal The automatic bypass removal logic removes the bypasses which are used during plant shutdown periods, for Pressurizer Low Pressure and Steam Generator Low Pressure actuation signals.

The setpoints were chosen to be above the setpoint for the associated actuktioh signal, but well belowv the normal operating pressures.

Palisades Nuclear Plant B 3.3.3-15 Revised 04122/2002

ESF Instrumentation B 3.3.3 BASES LCO 7. Automatic Bypass Removal (continued)

(continued)

This LCO requires four channels of Pressurizer Low Pressure bypass removal and four channels for each steam generator of Steam Generator Low Pressure bypass removal, to be OPERABLE in MODES 1, 2, and 3.

APPLICABILITY All ESF Functions are required to be OPERABLE in MODES 1, 2, and 3. In addition, Containment High Pressure and Containment High Radiation are required to be operable in MODE 4.

In MODES 1, 2, and 3 there is sufficient energy in the primary and secondary systems to warrant automatic ESF System responses to:

"* Close the main steam isolation valves'to preclude a positive reactivity addition and containment overpressure;

"* Actuate AFW to preclude the loss of the steam generators as a heat sink-(in the event the normal feedwater system is not available);

Actuate ESF systems to prevent or limit the release of fission product radioactivity to the environment by isolating containment and limiting the containment press'ure from exceeding the containment design pressure during a design basis LOCA or MSLB; and Actuate ESF systems to ensure sufficient borated inventory to permit adequate core cooling and reactivity control during a design basis LOCA or MSLB accident.

The CHP and CHR Functions are required to be OPERABLE in MODE 4 to limit leakage of radioactive material from containment and limit operator exposure during and following a DBA.

The SGLP Function is not required to be OPERABLE in MODES 2 and 3, if all MSIVs are closed and deactivated and all MFRVs and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves, since the SGLP Function is not required to perform any safety functions under these conditions.

Palisades Nuclear Plant B 3.3.3o16 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES APPLICABILITY In lower MODES, automatic actuation of ESF Functions is not required, (continued) because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating the ESF components.

LCO 3.3.6 addresses automatic Refueling CHR isolation during CORE ALTERATIONS or during movement of irradiated fuel.

In MODES 5 and 6, ESFAS initiated systems are either reconfigured or disabled for shutdown cooling operation. Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components.

ACTIONS The most common causes'of channel inoperability are outright failure of

"%loopcomponents or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are'typically identified by the aotuation of alarms due to the channel failing to the "safe. condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a

-CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

Typically, the drift is small and results in a delay of actuation rather than a total loss of function. Determination of setpoint drift is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. Ifthe actual trip setpoint is not Within the Allowable Value in Table 3.3.3-1, the channel is inoperable and the appropriate Condition(s) are entered:

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value in Table 3.3.3-1, or the sensor, instrument loop, signal processing electronics, or ESF bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the plant must enter the Condition statement for the particular protection Function affected.

Palisades Nuclear Plant B 3.3.3-17 Revised 04122/2002

ESF Instrumentation B 3.3.3 BASES ACTIONS When the number of inoperable channels in a trip Function exceeds (continued) those specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A Note has been added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function in Table 3.3.3-1. Completion Times for the inoperable channel of a Function will be tracked separately.

A.1 Condition A applies to the failure of a single bistable or associated instrumentation channel of one or more input parameters in each ESF Function except the RAS Function.: Since the bistable and associated instrument channel combine to perform the actuation function, the Condition is also appropriate if both the bistable and associated instrument channel are inoperable.

ESF coincidence logic is normally two-out-of-four. If one ESF channel is inoperable, startup or power operation is allowed to continue as long as action is taken to restore the design level of redundancy.

If one ESF channel is inoperable, startup or power operation is allowed to continue, providing the inoperable channel actuation bistable is placed in trip within 7 days. The provision of four trip channels allows one channel to be inoperable in a non-trip condition up to the 7 day Completion Time allotted to place the channel in trip. Operating with one failed channel in a non-trip condition during operations, places the ESF Actuation Logic in a two-out-of-three coincidence logic.

Ifthe failed channel cannot be restored to OPERABLE status in 7 days, the associated bistable is placed in a tripped condition. This places the function in a one-out-of-three configuration.

Palisades Nuclear Plant B 3.3.3-18 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES ACTIONS A.1 (continued)

(continued)

In this configuration, common cause failure of the dependent channel cannot prevent ESF actuation. The 7 day Completion Time is based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Condition A is modified by a Note which indicates it is not applicable to the SIRWT Low Level Function.

B.1 and B.2 Condition B applies to the failure of two channels in any of the ESF Functions except the RAS Function.

-With two inoperable channels, one channel actuation device must be placed in trip within the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time. Eight hours is allowed forthis action since it must be accomplished by a circuit modification, or by removing power from a circuit component., -With one channel of protective instrumentation inoperable, the ESF Actuation Logic Function is in two-out-of-three logic, but with another channel inoperable the ESF may be operating with a two-out-of-two I6gic:'This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in trip. This places the ESF in a one-out-of-two'logic. If any of the other OPERABLE channels receives a trip signal, ESF actuation will occur.

One of the failed channels must be restored to OPERABLE status within 7 days, and the provisions of Condition A still applied to the remaining inoperable channel. Therefore, the channel that is'still inoperable after completion of Required Action B.2 must be placed in trip if more than 7 days has elapsed since the channel's initial failure.

Palisades Nuclear Plant B 3.3.3-119 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES ACTIONS B.1 and B.2 (continued)

(continued)

Condition B is modified by a Note which indicates that it is not applicable to the SIRWT Low Level Function. The Required Action is also modified by a Note stating that LCO,3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel tripped. MODE changes in this configuration are allowed, to permit maintenance and testing on one of the inoperable channels. In this configuration, the protection system is in a one-out-of-two logic, and the probability of a common cause failure affecting both of the OPERABLE channels during the 7 days permitted is remote.

C.1 and C.2 Condition C applies to one RAS SIRWT Low Level channel inoperable.

The SIRWT low level circuitry is arranged in a "1-out-of-2 taken twice" logic rather than the more frequently used 2-out-of-4 logic. Therefore, Required Action C.1 differs from other ESF functions. With a bypassed SIRWT low level channel, an additional failure might disable automatic RAS, but would not initiate a premature RAS. With a tripped channel, an additional failure could cause a premature RAS, but would not disable the automatic RAS.

Since considerable time is available after initiation of SIS until RAS must be initiated, and since a premature RAS could damage the ESF pumps, it is preferable to bypass an inoperable channel and risk loss of automatic RAS than to trip a channel and risk a premature RAS.

The Completion Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> allowed is reasonable because the Required Action involves a circuit modification.

Required Action C.2 requires that the inoperable channel be restored to OPERABLE status within 7 days. The Completion Time is reasonable based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.3-20 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES ACTIONS D.1 and D.2 (continued)

Ifthe Required Actions and associated Completion Times of Condition A, B,'or C are not met for Functions 1, 2, 3, 4, or 7, the plant must be brought tota MODE in which the LCO does not apply. To

-achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 and E.2 If the Required Actions and associated Completion Times of Condition A, B, or C are not met for Functions 5 or 6, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.- The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular ESF Function are found in the SRs column REQUIREMENTS of Table 3.3.3-1 for that Function. Most functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

'SR 3.3.3.1 A CHANNEL CHECK is performed once eveiry 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> on each ESF input channel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. A CHANNEL CHECK is not performed on the CHP and SIRWT Low Level channels because they have no associated control room indicator.

Palisades Nuclear Plant B83.3.3-21 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.1 (continued)

REQUIREMENTS (continued) Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrurrient channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria,, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when Surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction.

Offscale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.

The Frequency of about once every shift is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of CHANNEL OPERABILITY during normal operational use of displays associated with the LCO required channels.

Palisades Nuclear Plant B 3.3.3-22 Revised 04/22/2002

ESF Instrumentation B 3.3.3 BASES SURVEILLANC E SR 3.3.3.2 REQUIREMEN (continued) A CHANNEL FUNCTIONAL.TEST is performed every 92 days to ensure the entire channel will perform its intended function when needed. A successful test of therequired contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.-

This test is required to be performed each 92 days on ESF input channels provided with on-line testing capability. It is not required for the SIRWT Low Level channels since they have no built in test capability. The CHANNEL FUNCTIONAL TEST for SIRWT Low Level channels is performed each 18 months as part of the required CHANNEL CALIBRATION.

The CHANNEL FUNCTIONAL TEST tests the individual channels using an analog test input to each bistable.

Any setpoint adjustment shall be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Reference 5).

SR 3.3.3.3 CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the setpoint analysis.

B 3.3.3-23 Revised 04/22/2002 Palisades Nuclear Plant

I ---

ESF Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.3 (continued)

REQUIREMENTS (continued) The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the extension analysis. The requirements for this review are outlined in Reference 5.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis.

REFERENCES 1. FSAR, Chapter 7

2. 10 CFR 50, Appendix A

3. IEEE Standard 279-1971

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant B 3.3.3-24 Revised 04/22/2002

LTOP System B 3.4.12 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls PCS pressure at low temperatures so the integrity of the Primary Coolant Pressure Boundary (PCPB) is not compromised by violating the Pressure and Temperature (PMT) limits of "10CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting PCPB component requiring such'protection. LCO 3.4.3, "PCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep fromreviolating the Reference I requirements during the LTOP MODES.

"Thetoughness of the reactor vessel material decreases at low temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). PCS press'ure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the PCS is "watersolid, which occurs only while shutdown. Under that condition, a pressure fluctuation can occur more quickly than an' operator can react to

--relieve the condition. Exceeding the PCS P/T limits by a significant amount could cause brittle fracture of the reactor vessel. LCO 3.4.3 requires administrative control of PCS pressureand temperature during heatup and cooldown to prevent exceeding the P/T limits.

-This LCO provides PCS overpressure protection by limiting coolant injection capability and requiring adequate pressure relief capacity.

Limiting coolant injection capability requires all High Pressure Safety Injection (HPSI) pumps be incapable of injection into the PCS when any

"-'PCScold leg temperature is < 3000 F. The pressure relief capacity requires either two OPERABLE redundant Power Operated Relief Valves (PORVs) or the PCS depressurizedand a PCS vent of sufficient size.

One PORV or the PCS vent isthe overpressure protection device that acts to terminate an increasing pressure event.

... . r, ,' ".,4 O ,, ie ,ri A7719919 002 Palisades Nuclear Plant ED 0.14. 14-

LTOP System B 3.4.12 BASES BACKGROUND With limited coolant injection capability, the ability to provide core (continued) coolant addition is restricted. The LCO does not require the chemical and volume control system to be deactivated or the Safety Injection Signals (SIS) blocked. Due to the lower pressures in the LTOP MODES and the

• expected core decay heat levels, the chemical 'and volume control system can provide adequate flow via the makeup control valve. If conditions require the use of an HPSI pump for makeup in the event of loss of inventory, then a pump can be made available through manual actions.

The LTOP System for pressure relief consists of two PORVs with temperature dependent lift settings or a PCS vent of sufficient size.

Two PORVs are required for redundancy. One PORV has adequate relieving capability to prevent overpressurization for the allowed coolant injection capability.

PORV Requirements As designed for the LTOP System, an "open" signal is generated for each PORV if the PCS pressure approaches a limit determined by the LTOP actuation logic. The actuation logic monitors PCS pressure and cold leg temperature to determine when the LTOP overpressure setting is approached. If the indicated pressure meets or exceeds the calculated value, a PORV is opened.

The LCO presents the PORV setpoints for LTOP by specifying Figure 3.4.12-1, "LTOP Setpoint Limit." Having the setpoints of both valves within the limits of the LCO ensures the P/T limits will not be exceeded in any analyzed event.

When a PORV is opened in an increasing pressure transient, the release of coolant causes the pressure increase to slow and reverse. As the PORV releases coolant, the system pressure decreases until a reset pressure is reached and the valve closed. The pressure continues to decrease below the reset pressure as the valve closes.

Palisades Nuclear Plant B 3.4.12-2 Revised 07/2212002 Palisades Nuclear Plant B 3.4.12-2 Revised 07/22/2002

LTOP System B 3.4.12 BASES BACkGROUND PCS Vent Requirements (continued)

Once the PCS is depressurized, a vent exposed to the containment atmosphere will maintain the PCS at containment ambient pressure in an PCS overpressure transient if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass injection or heatup transient and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

Reference 3 has determined that any vent path capable of relieving 167 gpm at a PCS pressure of 315 psia is acceptable. The 167 gpm flow rate is based on an assumed charging imbalance due to interruption of letdown flow with three charging pumps operating, a 40OF per hour PCS heatup rate, a 60OF per hour pressurizer heatup rate, and an initially depressurized and vented PCS. Neither HPSI pump nor Primary Coolant Pump (PCP) starts need to be assumed with the PCS initially depressurized, because LCO 3.4.12 requires both HPSI'pumps to be incapable of injection into the PCS and LCO 3.4.7, "PCS Loops-MODE 5, Loops Filled," places restrictions on starting a PCP.

The pressure relieving ability of a vent path depends not only upon the area of the vent opening, but also upon the configuration of the piping connecting the vent opening to the PCS. A long, or restrictive piping connection may prevent a larger vent opening from providing adequate flow, while a smaller opening immediately adjacent to the PCS could be adequate. The areas of multiple vent paths cannot simply be added to determine the necessary vent area.

The following vent path examples are acceptable:

II.- Removal of a steam generator primary manway;

2. Removal of the pressurizer manway; .

3. Removal of a PORV or pressurizer safety valve;

4. Both PORVs and associated block valves open; and

5. Opening of both PCS vent valves MV-PC514 and MV-PC515.

b_. ~..1L-3

. =.* F., I*'] CJ ~rt Palisades Nuclear Plant nei' sedVl ,, 22 e.0/-/,U/

LTOP System B 3.4.12 BASES BACKGROUND Reference 4 determined that venting the PCS through MV-PC514 and (continued) MV-PC515 provided adequate flow area. The other listed examples provide greater flow areas with less piping restriction and are therefore acceptable. Other vent paths shown to provide adequate capacity could also be-used. The vent path(s) must be above the level of reactor coolant, to prevent draining the PCS.

One open PORV provides sufficient flow area to prevent excessive PCS pressure. However, if the PORVs are elected as the vent path, both valves must be used to meet the single failure criterion, since the PORVs are held open against spring pressure by energizing the operating solenoid.

When the shutdown cooling system is in service with MO-3015 and MO-3016 open, additional overpressure protection is provided by the relief valves on the shutdown cooling system. References 5 and 6 show that this relief capacity will prevent the. PCS pressure Trom exceeding its pressure limits during any of the above mentioned events.

APPLICABLE Safety analyses (Ref. 7) demonstrate that the reactor vessel is SAFETY ANALYSES adequately protected against exceeding the Reference 1 P/T limits during shutdown. In MODES 1 and 2, and in MODE 3 with all PCS cold leg temperature at or exceeding 4300 F, the pressurizer safety valves prevent PCS pressure from exceeding the Reference 1 limits. Below 4300 F, overpressure prevention falls to the OPERABLE PORVs or to a depressurized PCS and a sufficiently sized PCS vent. Each of these means has a limited overpressure relief capability.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System should be re-evaluated to ensure its functional requirements can still be satisfied using the PORV method or the depressurized and vented PCS condition.

Reference 3 contains the acceptance limits that satisfy the LTOP requirements. Any change to the PCS must be evaluated against these analyses to determine the impact of the change on the LTOP acceptance limits.

Revised 07/2212002 Palisades Nuclear Plant Nuclear Plant B 3.4.12-4 B 3.4.12-4 Revised 07/22/2002

LTOP System B 3.4.12 BASES APPLICABLE Transients that are capable of overpressunzing the PCS are SAFETY ANALYSES categorized as either mass injection or heatup transients (continued)

Mass Iniection Type Transients

a. Inadvertent safety injection; or

b. Charging/ietdown flow mismatch.

Heatup Type Transients'

a. Inadvertent actuation of pressurizer heaters;

b. Loss of Shutdown Cooling (SDC); or-,

c. PCP startup with temperature asymmetry within the PCS or between the PCS and steam generators.

Rendering both HPSI pumps incapable-of injection is required during the LTOP MODES to ensure that mass injection transients beyond the capability of the LTOP overpressure protection system, do not occur. The Reference 3 analyses demonstrate that either one PORV or the PCS vent can maintain PCS pressure below limits when three charging pump are actuated. Thus, the LCO prohibits the operation of both HPSI pumps and does not place any restrictions on charging pump operation.

Fracture mechanics analyses were used to establish the applicabable "temperature'range for the LTOP LCO as below 4300F. At and above this temperature, the pressurizer safety valves provide the reactor vessel pressure protection. The vessel materials were assumed to have a neutron irradiation accumulation equal to 2.192 E19 nvt.

t-evisea UtIZz.IZbUUZ u(ILILuuL Palisades Nuclear Plant Palisades Plant -B3.4.12-5 -R~evised

LTOP System B 3.4.12 BASES APPLICABLE PORV Performance SAFETY ANALYSES (continued) The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the setpoint curve specified in Figure 3.14.12-1 of the accompanying LCO. The setpoint is derived by modeling the performance of the LTOP System, assuming the limiting allowed LTOP transient. The valve qualification process considered pressure overshoot and undershoot beyond the PORV opening and closing setpoints, resulting from signal processing and valve stroke times.

The PORV setpoints at or below the derived limit ensure the Reference 1 limits will be met.

The PORV setpoints will be re-evaluated for compliance when the P/T limits are revised. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to embrittlement caused by neutron irradiation. Revised P/T limits are determined using neutron fluence projections and the results of examinations of-the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3 discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV represents the worst case, single active failure.

PCS Vent Performance With the PCS depressurized, analyses show the required vent size is capable of mitigating the limiting allowed LTOP overpressure transient. In that event, this size vent maintains PCS pressure less than the maximum PCS pressure on the P/T limit curve.

The PCS vent is passive and is not subject to active failure.

LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2).

Revised 07/22/2002 Palisades Nuclear Plant Palisades Nuclear Plant B 3.4.12-6 B 3.4.12-6 Revised 07/22/2002

LTOP System B 3.4.12 BASES LCO This LCO is required to ensure that the LTOP System is OPERABLE.

"TheLTOP System is OPERABLE when both HPSI pumps are incapable of injecting into the PCS and pressure relief capabilities are OPERABLE.

Violation of this LCO could lead to the loss of low temperature

-overpressure mitigation and violation of the Reference 1 limits as a result

-of an operational transient.:

To limit the coolant injection capability, LCO 3.4.12.a requires both HPSI

-pumps be incapable of injecting into the PCS. LCO 3.4.12.a is modified by two Notes. Note 1 only requires both HPSI pumps to be incapable of injecting into the PCS when any PCS cold leg temperature is < 300 0F.

When all PCS cold leg temperatures are 2 300 0 F, a start of both HPSI pumps in conjunction with a charging/letdown imbalance will not cause the PCS pressure to exceed the 10 CFR 50 Appendix G limits. Thus, a restriction on HPSI pump operation when all PCS cold leg temperatures are Ž 300OF is not required. Note 2 is provided to assure that this LCO does not cause hesitation in the use of a HPSI pump for PCS makeup if it is needed due to a loss of shutdown cooling or a loss bf PCS inventory.

The elements of the LCO that provide overpressure'mitigation through pressure relief are:

a. Two OPERABLE PORVs; or

b. The PCS depressurized and Vented.

A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set consistent with Figure 3.4.12-1 in the accompanying LCO and testing has proven its ability to open at that setpoint, and motive power is available to the valve and its control circuit.

A PCS vent is OPERABLE when open with an area capable of relieving

>167 gpm at a PCS pressure of 315 psia.- § Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP-transient.

Palisades Nuclear Plant B 3.4.12-7 Revised 07/22/2002

LTOP System B 3.4.12 BASES APPLICABILITY This LCO is applicable in MODE 3 when the temperature of any PCS cold leg is < 4300 F, in MODES 4 and 5, and in MODE 6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference I P/T limits at and above 430 0 F.

When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1 and 2, and MODE 3 with all PCS cold leg temperatures

Ž 4300F.

Low temperature overpressure prevention is most critical during shutdown when the PCS is water solid, and a mass addition or a heatup transient can cause a very rapid increase in PCS pressure with little or no time available for operator action to mitigate the event.

ACTIONS A Note has been added in the ACTIONS to exclude the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE while relying on the ACTIONS, even though the ACTIONS may eventually require a plant shutdown. The intent of this exception is to allow the plant to enter the LTOP MODE with an inoperable PORV from MODES 1 and 2, and MODE 3 with all PCS cold leg temperature 2 4300 F, to facilitate valve repairs. This exception is acceptable since the Required 'Actions provide the appropriate compensatory measures commensurate with PORV inoperabilites.

A..I With one or two HPSI pumps capable of injecting into the PCS, overpressurization is possible.

The immediate Completion Time to initiate actions to restore restricted coolant injection capability to the PCS reflects the importance of maintaining overpressure protection of the PCS.

Palisades Nuclear Plant Palisades Nuclear Plant Revised 07/2212002 B 3.4.12-8 B 3.4.12-8 Revised 07/22/2002

LTOP System

-B

ý"4 J,* 3.4.12 BASES ACTIONS B.1 (continued)

With one required PORV inoperable and pressurizer water level < 57%,

the required PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two valves are required to meet the LCO requirement and to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The Completion Time is based on only one PORV being required to mitigate an overpressure transient, the likelihood of an active failure of the remaining valve path during this time period being very low, and that a steam bubble exists in the pressurizer. Since the pressure response to a transient is greater ifthe pressurizer steam space is small or if the PCS is solid, the Completion Time for restoration of a PORV flow path to service is shorter. The maximum pressurizer level at Which credit can be taken for having a bubble (57%, which provides about 700 cubic feet of steam space) is based on judgement rather than by analysis, This level provides the same steam volume to dampen pressure transients as would be available at full power. This steam volume provides time for operator action (ifthe PORVs failed to operate) in the interval between an inadvertent SIS and PCS pressure reaching the 10 CFR 50,:Appendix G pressure limit. The time available for action would depend upon the existing pressure and temperature when the inadvertent SIS occurred.

C.1 The consequences of operational events that will overpressurize the PCS are more severe at lower temperature (Ref. 8). With the pressurizer water level > 57%, less steam volume is available to dampen pressure increases resulting from an inadvertent mass injection or heatup transients. Thus, with one required PORV inoperable and the pressurizer water level > 57%; the Completion'Time to restoie the required PORV to OPERABLE status is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. -

'The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time to restore the required PORV to OPERABLE status when the pressurizer water level is > 57%, which usually occurs in MODE 5 or in MODE 6 when the vessel head is on, is a reasonable amount of time to investigate and -repairPORV failures without a lengthy period with only one PORV OPERABLE to protect against overpressure events.

- - -- M  ;- A nii7 5nnoiA V' iqutJI/Ii .. dr.,v.

Palisades Nuclear Plant -II B 3 .. 1 -

LTOP System B 3.4.12 BASES ACTIONS D.1 (continued) If two required PORVs are inoperable, or if the Required Actions and the associated Completion Times are not met, or if the LTOP System is inoperable for any reason other than Condition A, B, or C, the PCS must be depressurized and a vent established within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The vent must be sized to provide a relieving capability of > 167 gpm at a pressure of 315 psia which ensures the flow capacity is greater than that required for the worst case mass injection transient reasonable during the applicable MODES. This action protects the PCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to depressurize and vent the PCS is based on the time required to place the plant in this condition and the relatively low probability of an overpressure event during this time period due to operator attention and administrative requirements.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass injection capability, both HPSI pumps are verified to be incapable of injecting into the PCS. The HPSI pumps are rendered incapable of injecting into the PCS by means that assure that a single event cannot cause overpressurization of the PCS due to operation of the pump. Typical methods for accomplishing this are by pulling the HPSI pump breaker control power fuses, racking out the HPSI pump motor circuit breaker, or closing the manual discharge valve.

SR 3.4.12.1 is modified by a Note which only requires the SR to be met when complying with LCO 3.4.12.a. When all PCS cold leg temperature are > 3000 F, a start of both HPSI pumps in conjunction with a charging/letdown imbalance will not cause the PCS pressure to exceed the 10 CFR 50 Appendix G limits. Thus, this SR is only required when any PCS cold leg temperature is reduced to less than 300°F.

The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> interval considers operating practice to regularly assess potential degradation and to verify operation within the safety analysis.

Revised 07/2212002 talIsades Nuclear iant Palisadles Nuclear Plant B 3.4.12-10 B 3.4.12-10 Revised 07/22/2002

hi LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.2 REQUIREMENTS (continued) SR 3.4.12.2 requires a verification that the required PCS vent, capable of relieving> 167 gpm at a PCS pressure of 315 psia, is OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for a valve that is not locked open; or

b. Once every 31 days for a valve that is locked open.

The passivevent arrangement must only be opern to be OPERABLE.

This Surveillance need only be performed if vent valves are being used to satisfy the requirements of this LCO. This Surveillance does not need to be performed for Vent paths relying on the removal of a steam generator primary manway cover, pressurizer manway cover, safety valve or PORV since their position is adequately addressed using administrative controls and the inadvertent reinstallation of these components is unlikely. The Frequencies consider operating experience with mispositioning of unlocked and locked vent valves, respectively.

SR 3.4.12.3 The PORV block valve must be verified open every 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to provide the flow path for each required PORV to perform its function when actuated. The valve can be remotely verified open in the main control room.

The block valve is a remotely controlled, motor operated valve. The powet to the valve motor operator is not required to be removed, and the manual actuator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure event.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency considers operating experience with accidental movement of valves having remote control and position indication capabilities available where easily monitored. These considerations include the administrative controls over main control room access and equipment control.

Revised 07/2212002 Palisades Nuclear Plant Nuclear Plant BB 3.4.12-11 3.4.12-11 Revised 07/22/2002

LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.4 REQUIREMENTS (continued) Performance of a CHANNEL FUNCTIONAL TEST is required every 31 days. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay This is acceptable because all of the Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable' extensions. PORV actuation could depressurize the PCS and is not required. The 31 day Frequency considers experience with equipment reliability.

A Note has been added indicating this SR is required to be performed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after decreasing any PCS cold leg temperature to < 4300 F. This Note allows a discrete period of time to perform the required test without delaying entry into the MODE of Applicability for LTOP. This option may be exercised in cases where an unplanned shutdown' below 430°F is necessary as a result of a Required Action specifying a plant shutdown, or other plant evolutions requiring an expedited cooldown of the plant.

The test must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after entering the LTOP MODES.

SR 3.4.12.5 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months to adjust the entire channel so that it responds and the valve opens within the required LTOP range and with accuracy to known input.

The 18 month Frequency considers operating experience with equipment reliability and is consistent with the typical refueling outage schedule.

,-'aiisaaes uciear i-'Iant Revised 07/2212002 P-alisades Nuclear Plant B 3.4.12-12 Revised 07/22/2002

LTOP System B 3.4.12 BASES REFERENCES 1. 10 CFR 50, Appendix G

2. Generic Letter 88-11

3. CPC Engineering Analysis, EA-A-PAL-92-095-01

4. CPC Engineering Analysis, EA-TCD-90-01

5. CPC Engineering Analysis, EA-E-PAL-89-040-1

6. CPC Corrective Action Document, A-PAL-91-011

7. FSAR, Section 7.4

8. Generic Letter 90-06 Palisades Nuclear Plant B 3.4.12-13 Revised 07/22/2002

PCS Operational LEAKAGE B 3.4.13 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.13 PCS Operational LEAKAGE BASES BACKGROUND Components that contain or transport primary coolant to or from the reactor core make up the PCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the PCS.

During plant life, the joint and valve interfaces can produce varying amounts of primary coolant LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the PCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.

'10 CFR 50, Appendix A, GDC 30, requires means for detecting and, to the extent practical, identifying the source of primary coolant LEAKAGE.

Regulatory Guide 1.45 (Ref. 1) describes acceptable hnethods for selecting leakage detection systems.

"Thesafety significance bf PCS LEAKAGE varies widely depending on its source, rate, and'duration.' Therefore, detecting and monitoring primary coolant LEAKAGE irnto the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is

-necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety of the facility and the public-.

A limited amount of leakage inside containment is expected from auxiliary "systemsthat cannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to hot interfere with PCS LEAKAGE detection.

• This LCO deals with protection of the Primary Coolant Pressure Boundary (PCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a Loss'Of Coolant Accident (LOCA).

Palisades Nuclear Plant B 3.4.13-1 Revised 07122/2002

PCS Operational LEAKAGE B 3.4.13 BASES BACKGROUND As defined in 10 CFR 50.2, the PCPB includes all those pressure (continued) containing components, such as the reactor pressure vessel, piping, pumps, and valves, which are:

(1) Part of the primary coolant system, or (2) Connected to the primary coolant system, up to and including any and all of the following:

(i) The outermost containment isolation valve in system piping which penetrates the containment, (ii) The second of two valves normally closed during normal reactor operation in system piping which does not penetrate the containment, (iii) The pressurizer safety valves and PORVs.

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY ANALYSES address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event The safety analysis for all events resulting in a discharge of steam from the steam generators to the atmosphere assumes 0.3 gpm primary to I

secondary LEAKAGE as the initial condition.

Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a Main Steam Line Break (MSLB), Steam Generator Tube Rupture (SGTR) and the Control Rod Ejection (CRE) accident analyses.

The leakage contaminates the secondary fluid.

I The FSAR (Ref. 2 and 5) analysis for SGTR assumes the contaminated I

secondary fluid is released via the Main Steam Safety Valves and Atmospheric Dump Valves. The 0.3 gpm primary to secondary LEAKAGE is inconsequential, I

relative to the dose contribution from the affected SG.

The MSLB (Ref 3 and 5) is more limiting than SGTR for site radiation releases.

The safety analysis for the MSLB accident assumes 0.3 gpm primary to secondary LEAKAGE in one steam generator as an initial condition.

The CRE (Ref 4 and 5) accident with primary fluid release through the Atmospheric Dump Valves is the most limiting event for site radiation releases.

The safety analysis for the CRE accident assumes 0.3 gpm primary to secondary LEAKAGE in one steam generator as an initial condition.

The dose consequences resulting from the SGTR, MSLB and CRE accidents are well within the guidelines defined in 10 CFR 100 and meets the requirements of Appendix A of 10 CFR 50 (GDC 19).

PCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.4.13-2 Revised 07/22/2002

PCS Operational LEAKAGE B 3.4.13 BASES LCO PCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE from within the PCPB is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in increased LEAKAGE. Violation of this LCO could result in continued degradation of the PCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

As defined in Section 1.0, pressure boundary LEAKAGE is "LEAKAGE (except SG LEAKAGE) through a nonisolable fault in an PCS component body, pipe wall, or vessel wall."

b. Unidentified LEAKAGE One gallon per minute (gp m) of unidentified LEAKAGE from within the PCPB is allowed as a reasonable-minimum detectable amount that the containment air monitouing and containrment sump level monitoring equipment can detect within a reasonlable time period.

Violation of this LCO could result in continued degradation of the PCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE from within the PCPB is allowed because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the PCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically located sources which is known not to adversely affect the OPERABILITY of required leakage detection systems, but does not include pressure boundary LEAKAGE or controlled Primary Coolant Pump (PCP) seal leakoff to the Volume

-'Control Tank (a normal function not considered LEAKAGE). Violation of this LCO could result in continued degradation of a component or

system . - " , .. ....

LCO 3.4.14, "PCS Pressure Isolation Valve'(PIV) Leakage,"

- measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result In PCS LEAKAGE when the other is leaktight. If both valves leak and result in a loss of mass from the PCS,-the loss must be included in the allowable identified LEAKAGE.' - ' ' - -

Palisades Nuclear Plant B 3.4.13-3 Revised 07/22/2002-.

PCS Operational LEAKAGE B 3.4.13 BASES LCO d. Primary to Secondary LEAKAGE through Any One SG (continued)

The 432 gallons per day limit on primary to secondary LEAKAGE through any one SG ensures the total primary to secondary LEAKAGE through both SGs produces acceptable offsite doses in the MSLB accident analysis. In addition, the LEAKAGE limit also ensures that SG integrity is maintained in the event of a CRE, MSLB I

or under LOCA conditions. Violation of this LCO could exceed the offsite dose limits for this accident analysis. Primary to secondary LEAKAGE must be included in the total allowable limit for identified LEAKAGE.

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for PCPB LEAKAGE is greatest when the PCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the primary coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the PCPB.

B.1 and B.2 If any pressure boundary LEAKAGE from within the PCPB exists or if unidentified, identified, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the PCPB are much lower, and further deterioration is much less likely.

Palisades Nuclear Plant B 3.4.13-4 Revised 07/22/2002

PCS Operational LEAKAGE BASES .B 3.4.13 BASES -

SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying PCS LEAKAGE to be within the LCO limits ensures the integrity of the PCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an PCS water inventory balance. Primary to secondary LEAKAGE is also measured by performance of a PCS water inventory balance in conjunction with effluent monitoring within the secondary steam and feedwater systems. -

The PCS water inventory balance must be performed with the reactor at

-steady state operating conditions and near operating pressure.

Therefore, this SR is modified by a Note which states that the SR is not required to be performed in MODES 3 and 4, until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met only when steady'state is established.

For PCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable PCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and PCP seal leakoff.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level.

These leakage detection systems are specified in LCO 3.415, "PCS Leakage Detection Instrumentation."

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR is required to be performed during steady state operation.

SR 3.4.13.2 This SR provides the means necessary to determine SG OPERABILITY in an operational MODE. The requirement to demonstrate SG tube integrity in accordance with the Steam Generator Tube Surveillance Program emphasizes the importance of SG tube integrity, even though this Surveillance cannot be performed at normal operating conditions.

Palisades Nuclear Plant 8 3.4.13-5 Revised 07/22/2002

.1 ,

PCS Operational LEAKAGE B 3.4.13 BASES REFERENCES 1. Regulatory Guide 1.45, May 1973

2. FSAR, Section 14.15

3. FSAR, Section 14.14

4. FSAR, Section 14.16

5. FSAR, Section 14.24 Palisades Nuclear Plant B 3.4.13-6 Revised 07/22/2002

PCS Leakage Detection Instrumentation B 3.4.15 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.15 PCS Leakage Detection Instrumentation BASES BACKGROUND -The Palisades Nuclear Plant design criteria (Ref. 1) require means for detecting and, to the extent practical, identifying the location of the source of PCS LEAKAGE.

Leakage detection instrumentation must have the capability to detect significant Primary Coolant Pressure Boundary (PCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure. Thus,- an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

Industry practice has shown that water flow changes of 0.5 gpm to 1.0 gpm can'readily be detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment sump, which is used to-coflect unidentified "LEAKAGE, is instrumented with level transmitters providing sump level indication in the control room. The sensitivity of these instruments is acceptable for detecting increases in unidentified LEAKAGE.

The primary coolant contains radioactivity that, when released to the containment, can'be detected by radiation monitoring instrumentation.

Primary coolant radioactivity !evels will be low during initial reactor startup and fora few weeks thereafter until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. An instrument sensitivity capable of detecting a 100 cm3lmin leak in 45 minutes based on 1%

faildd fuel is practical for the leakage detection instrument (Ref. 2).

Radioactivity detection is included for monitoring gaseous activities because of its sensitivity to PCS LEAKAGE.

An increase in humidity of the containment atmosphere would indicate release of water vapor to the containment. Humidity detectors are capable of detecting a 10% change in humidity which would result from approximately 150 gallons of primary water leakage (Ref. 2).

- ~~ ~ ~ ~ ~i, ~

...ifltn)el'fl1 InP) P)

Palisades Nuclear Plant B :3.4.15-1 reviVlUd 0 d,.,u*

PCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND Since the humidity level is influenced by several factors, a quantitative (continued) evaluation of an indicated leakage rate by this means may be questionable and should be compared to observed increases in liquid flow into or from the containment sump and condensate flow from the containment air coolers. Humidity level monitoring is considered most useful as an indirect indication to alert the operator to a potential problem.

The containment air cooler design includes a sump with a drain, a liquid level switch, and an overflow path. Normally, very little water will be condensed from the containment atmosphere and the small amount of condensate Will easily flow out through the sump drain. Ifflow to the sump is greater than 20 gpm, the level in the sump will rise to the liquid level switch (approximately 6 inches from the bottom of the sump) and triggers an alarm in the control room. Excessive flow to the sump is indicative of a service water leak, steam leak, or a primary coolant system leak. A steam leak or primary coolant leak would be accompanied by an increase in the 6ontainment atmosphere humidity which would be detected by the containment humidity sensors and displayed in the control room. Since excessive containment air cooler drainage may be attributed to causes other than PCS LEAKAGE, an evaluation of PCS LEAKAGE should be confirmed using diverse instrumentation required by this specification.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment. Containment temperature and pressure fluctuate during plant operation, but a rise above the normally indicated range of values may indicate PCS LEAKAGE into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals can be valuable in recognizing rapid and sizable leakage to the containment.

Temperature and pressure monitors are not required by this LCO.

Revised 07/2212002 Palisades Nuclear Plant Palisades Nuclear Plant B 3.4.15-2 B 3.4.15-2 Revised 07/22/2002

PCS Leakage Detection Instrumentation B 3.4.15

0. 1 BASES APPLICABLE . The-need to'evaluite the'severity of an alarmor an indication is SAFETY ANALYSES important to the operators, and the ability to compare and verify with indications from other systems is necessary. The system sensitivities are described in the FSAR (Ref. 2). Multiple instrument locations are utilized, if needed, to ensure the transport delay time of the LEAKAGE from its source to an instrument location is acceptable.

The safety significance of PCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring PCS LEAKAGE into the containment area are necessary. Quickly separating thle identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should leakage occur detrimental to the safety of the facility and the public.

PCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2).

LCO One method of protecting against large PCS LEAKAGE is based on the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the plant in a safe condition when PCS LEAKAGE indicates possible PCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are "available."Thus, a combination which includes one instrument channel from each of any three of the following; containment sump level indication, gaseous activity monitor, containment air cooler condensate level switch, or containment humidity monitor provides an acceptable minimum. For the containment air cooler condensate level switch only an operating containment air cooler may be relied upon to fulfill the LCO requirements for an OPERABLE leakage detection instrument.

APPLICABILITY Because of elevated PCS temperature and pressure in MODES 1, 2, 3, and 4, PCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is < 200°F and pressure is maintained

,low or at atmospheric pressure., I -

Palisades .uclear..lnt i evsaq U(ILU4UUA Palisades Nuclear Plant -B,3-.4.15-3. IRevisedl 07/2l2/2-002

PCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABILITY Since the temperatures and pressures are far lower than those for (continued) MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation is much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS The ACTIONS are modified by a Note that indicates the provisions of LCO 3.0.4 are not applicable. As a result, a MODE change is allowed when one or two required leak detection instrument channels are inoperable. This allowance is provided because other instrumentation is available to monitor for PCS LEAKAGE.

A.1 and A.2 If one or two required leak detection instrument channels are inoperable, a periodic surveillance for PCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide information that is adequate to detect leakage.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as "once per...' however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per..." basis. The 25% extension applies to each performance of the Required Action after the initial performance., Therefore, while Required Action 3.4.15 A.1 must be initially performed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

Restoration of the required instrument channels to an OPERABLE status is required to regain the function in a Completion Time of 30 days after the instrument's failure. This time is acceptable considering the frequency and adequacy of the PCS water inventory balance required by Required Action A. 1.

B.1 and B.2 If the Required Action cannot be met within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Revised 07/2212002 Palisades Nuclear Palisades Plant Nuclear Plant B 3.4.15-4 B 3.4.15-4 Revised 07/22/2002

PCS Leakage Detection Instrumentation

, ..... B 3.4.15 I4 I BASES ACTIONS C.1 (continued)

If all req-uired monitors are inoperable, no automatic means of monitoring leakage are available and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.15.1. SR .3.4.15.2, and SR 3.4.15.3 REQUIREMENTS These SRs require the performance of a CHANNEL CHECK for each required tontainment sump level indicator,-containment atmosphere gaseous activity monitor, and containment atmosphere humidity monitor. The check gives reasonable confidence the channel is operating properly. The Frequency of.12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 3.4.15.4 SR 3.4.15.4 requires the performance of a CHANNEL FUNCTIONAL TEST of the required containment air cooler condensate level switch.

Since this instrumentation does not include control room indication of flow rate, a CHANNEL CHECK is not possible. The test ensures that the level switch can perform its function in the desired manner. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency of 18 months is a typical refueling cycle (performance of the test is only practical during a plant outage) and considers instrument reliability.

Operating experience has shown this Frequency is acceptable for detecting degradation.

reviseu uiisiiuus n inn in nan Plant Palisades Nuclear Plant B 3.4.15-5 Revised U IIZ./"UU

PCS Leakage Detection Instrumentation B 3.4.15 BASES SURVEILLANCE SR 3.4.15.5, SR 3.4.15.6, and SR 3.4.15.7 REQUIREMENTS (continued) These SRs require the performance of a CHANNEL CALIBRATION for each required containment sump level, containment atmosphere gaseous activity, and containment atmosphere humidity channel. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The Frequency of 18 months is a typical refueling cycle and considers channel reliability. Operating experience has shown this Frequency is acceptable.

REFERENCES 1. FSAR, Section 5.1.5

2. FSAR, Sections 4.7 and 6.3 Palisades Nuclear Plant B 3.4.15-6 Revised 07/22/2002

PCS Specific Activity B 3.4.16 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.16 PCS Specific Activity BASES BACKGROUND 10 CFR 100.11 specifies the maximum dose to the whole body and the thyroid an individual at the site boundary can receive for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> during an accident. The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 guideline limits during analyzed transients and accidents.

The PCS specific activity LCO limits the allowable concentration level of radionuclides in the primary coolant. The LCO.limits are established to minimize the offsite radioactivity dose consequences in the event of a

-Steam Generator Tube Rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LtO are standardized based on parametric evaluations of offsite radioactivity dose "consequencesfor typical site locations. "

The parametric evaluations showed the potential offsite dose levels for an SGTR accident were an appropriately sma!l fraction of the 10 CFR 100 dose guideline limits. -Each evaluation assumes a broad range of site

- applicable atmopheric dispersion factors.

APPLICABLE The LCO limits on the specific activity of the primary coolant ensure SAFETY ANALYSES that the resulting 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following an SGTR accident. The SGTR safety analysis (Ref. 1) assumes the specific activity of the primary coolant at the LCO limits and an existing primary coolant Steam Generator (SG) tube leakage rate of 0.3 gpm. The analysis also assumes a reactor trip and a turbine trip at the same time as the SGTR event.

The analysis for the SGTR accident establishes the acceptance limits for PCS specific activity. Reference to this analysis is used to assess changes to the facility that could affect PCS specific activity as they relate to the acceptance limits.

-. ~~~ - .n .4 7inVinAl)

Palisades Nuclear Plant b J.4.10-1 r-rfVl)~v coo I*f.li.;JJ.

PCS Specific Activity B 3.4.16 BASES APPLICABLE The rise in pressure in the ruptured SG causes radioactive SAFETY ANALYSES contaminated steam to discharge to the atmosphere through the (continued) atmospheric dump valves or the main steam safety-valves. The atmospheric discharge stops when the affected SG is isolated below approximately 525 0F. The unaffected SG'removes core decay heat by venting steam until Shutdown Cooling conditions are reached.

The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the 10 CFR 100 dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limit of 40 pCi/gm for more than 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

This is acceptable because of the low probability of an SGTR accident occurring during the established 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> time limiL The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.

PCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO The specific iodine activity is limited to 1.0 g.Ci/gm DOSE EQUIVALENT 1-131, and the gross specific activity in the drimary coolant is limited to the number of piCVgm equal to 100 divided by E (average disintegration energy). The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> thyroid dose to-an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. The limit on gross specific activity ensures the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

The SGTR accident analysis (Ref. 1) shows that the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose levels are within acceptable limits. Violation of the LCO may result in primary coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.

Nuclear Plant Palisades Nuclear B 3.4.16-2 Revised 07/2212002 Palisades Plant B 3.4.16-2 Revised 07/22/2002

PCS Specific Activity B 3.4.16 BASES APPLICABILITY In MODES 1 and 2, and in MODE 3 with PCS average temperature > 500 0F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity is necessary to contain the potential consequences of an SGTR to within-the acceptable site boundary dose values.

For operation in MODE 3 with PCS average temperature < 500°F, and in

-MODES 4 and 5, the release of radioactivity in the event of an SGTR is unlikely since the saturation pressure corresponding to the primary coolant temperature is below the lift settings of the atmospheric dump valves and main steam safety valves.

ACTIONS A.1 and A.2" With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples-at intervals of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> must be taken to demonstrate the limit 40 pCi/gm is not exceeded. The Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is required to obtain and analyze a sample.

• - - As stated in SR 3.0.2,,the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as *once per..

.7-however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per.. ."basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.4.16 A.1 must be initiallyperformed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> without any SR

• 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2

= ~extension. . .

-: Sampling must continue for trending. The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

The Completion Time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> Is required Ifthe limit violation resulted from normal iodine spiking.

A Note to the Required Actions of Condition A excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.

Palisades Nuclear Plant S........ leVl,,ed U hI/- 2d0.UU

PCS Specific Activity B 3.4.16 BASES ACTIONS B.1 (continued)

If a Required Action and associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is 40 pCi/gm or above, or with the gross specific activity in excess of the allowed limit, the plant must be placed in a MODE in which the requirement does not apply.

The change within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to MODE 3 with PCS average temperature

< 500OF lowers the saturation pressure of the primary coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is required to reach MODE 3 below 500°F from full power conditions and without challenging plant systems.

SURVEILLANCE SR 3.4.16.1 REQUIREMENTS The Surveillance requires performing a gamma isotopic analysis as a measure of the gross specific activity of the primary coolant at least once per 7 days. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes, excluding iodines, this measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with PCS average temperature at least 500 0F. The 7 day Frequency considers the unlikelihood of a gross fuel failure during the time.

Paisades muia *ian ... evised.......2...

Palisades Nuclear Plant B 3.4.16-4 Revised 07/22/2002

PCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.2 REQUIREMENTS (continued) This Surveillance is performed to ensure iodine remains within limits during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level considering gross activity is monitored every 7 days. The Frequency, between 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after a power change of > 15% RTP within a 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results. This SR is modified by a Note which states that the SR is only required to be performed in MODE 1.

SR 3.4.16.3 A radiochemical analysis for E determination is required every 184 days (6 months) with the plant operating in MODE 1 equilibrium conditions.

The I- determination directly relates to"the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for I- is a measurement of the average energies per disintegration for isotopes with half lives longer than 15 minutes, excluding iodines. The Frequency of 184 days recognizes I- does not change rapidly.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. This ensures the radioactive materials are at equilibrium so the analysis for I- is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. FSAR, Section 14.15 Palisades Nuclear Plant B 3.4.16-5 Revised 07/22/2002

ECCS - Operating B 3.5.2 B 3.5 EMERGENCY CORE'COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS -' Operating BASES BACKGROUND The function of the ECCS is 'toprovide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of Coolant Accident (LOCA);'

b. Control Rod Ejection accident;

c. Loss of secondary coolant accident, including a Main Steam Line Break (MSLB) or Loss of Normal Feedwater; and

d. Steam Generator Tube Rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are two phases of ECCS operation: injection and recirculation.

In the injection phase, all injection is initially added to the Primary Coolant System (PCS) via the cold legs. After the Safety Injection Refueling Water Tank (SIRWT) has been depleted, the recirculation phase is entered as the ECCS suction is automatically transferred to the containment sump.

Two suitably redundant, 100% capacity trains are provided. Each train consists of a High Pressure Safety Injection (HPSI) and Low Pressure Safety Injection (LPSI) subsystem. -In MODES 1 and 2, and in MODE 3 with PCS temperature > 325 0F, both trains must be OPERABLE. This ensures that 100% of the core cboding requirements can be provided in the event of a single active failure. " ,.

8 3.5.2-1 Revised 04/22/2002 Palisades Nuclear Plant

ECCS - Operating B 3.5.2 BASES BACKGROUND Each train of a Safety Injection Signal (SIS) actuates LPSI flow by (continued) starting one LPSI pump and opening two LPSI loop injection valves. Each train of an SIS actuates HPSI flow by starting one HPSI pump, opening the four associated HPSI loop injection valves, and closing the pressure control valves associated with each Safety Injection Tank. In addition, each train of a SIS will provide a confirmatory open signal to the normally open Component Cooling Water valves which supply seal and bearing cooling to the LPSI, HPSI, and Containment Spray pumps.

The safety analyses assume that one only train of safety injection is available to mitigate an accident. While operating under the provisions of an ACTION, an additional single failure need not be assumed in assuring that a loss of function has not occurred. Therefore, the LPSI flow assumed in the safety analyses can be met if there is an OPERABLE LPSI flow path from the SIRWT to any two PCS loops. The HPSI flow assumed in the safety analyses can be met if there is an OPERABLE HPSI floW path from the SIRWT to each cold leg. In each case, an OPERABLE flow path must include an OPERABLE pump and an OPERABLE injection valve.

A suction header supplies water from the SIRWT or the containment sump to the ECCS pumps. 'Separate piping supplies each train. The discharge headers from each HPSI pump divide into four supply lines after entering the containment, one feeding each PCS cold leg. The discharge headers from each LPSI pump combine to supply a common header which divides into four supply lines after entering containment, one feeding each PCS cold leg.

,The hot-leg injection piping connectsthe HPSI.Train 1 header and the HPSI Train 2 header to the PCS hot-leg. For long term core cooling after a large LOCA, Hot-leg injection is used to assure that for a large cold-leg PCS break, net core flushing flow can be maintained and excessive boric acid concentration in the core which could result in eventual precipitation and core flow blockage will be prevented. Within a few hours after a LOCA, if shutdown cooling is not in operation, the operator initiates simultaneous hot-leg and cold-leg injection. Hot-leg injection motor-operated valve throttle position and installed flow orifices cause HPSI flows to be split approximately equally between hot- and cold-leg injection paths.

Palisades Nuclear Plant B 3.5.2-2 Revised 04/22/2002

ECCS - Operating

. B 3.5.2 BASES BACKGROUND Motor operated valves are set to maximize the LPSI flow to the P0s.

(continued) This flow balance directs sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the PCS cold legs.

For LOCAs coincident with a loss of off-site power that are too small to initially depressurize the PCS below the shutoff head of the HPSI pumps, the core cooling function is provided by the Steam Generators (SGs) until the PCS pressure decreases below the HPSI pump shutoff head.

During low temperature conditions in the PCS, limitations are placed on the maximum number of HPSI pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System," for the basis of these requirements.

During a large break LOCA,,PCS pressure could decrease to < 200 psia in

< 20 seconds. The ECCS systems are actuated upon receipt of an SIS. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, all loads will be shed at the time the diesel generators receive an automatic start signal. With load shedding completed, the diesel generator breakers will close automatically when generator voltage approaches a normal operating value. Closing of the

• breakers will reset the load shedding signals and start the sequencer. The sequencers will initiate operation of the engineered safeguard equipment required for the accident. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time before pumped flow is available to the core following a LOCA.

The active ECCS components,' along with the passive Safety Injection Tanks (SITs) and the.Safety Injection Refueling Water Tank (SIRWT),

covered in LCO 3.5.1, "Safety Injection Tanks (SITs)," and LCO 3.5.4, "Safety Injection Refueling Water Tank (SIRWT)," provide the cooling water necessary to meet the Palisades Nuclear Plant design criteria (Ref 1)..

Palisades Nuclear Plant B 3.5.2-3 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES APPLICABLE The LCO helps to ensure that the following acceptance criteria, SAFETY ANALYSES established by 10 CFR 50.46 for ECCSs, will be met following a LOCA:

a. Maximum fuel element cladding temperature is < 2200°F;

b. Maximum cladding oxidation is

• 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is

< 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also limits the potential for a post trip return to power following an MSLB event.

Both a HPSI and a LPSI subsystem are assumed to be OPERABLE in the large break LOCA analysis at full power (Ref. 2). This analysis establishes a minimum required runout flow for the HPSI and LPSI pumps, as well as the maximum required response time for their actuation. The HPSI pump is also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the HPSI pump. The SGTR and MSLB accident analyses also credit the HPSI pumps, but are not limiting in their design.

The large break LOCA event with a loss of offsite power and a single failure (disabling one ECCS train) establishes the OPERABILITY requirements for the ECCS. During the blowdown stage of a LOCA, the PCS depressurizes as primary coolant is ,ejected through the break into the containment. The nuclear reaction is term~inated either by moderator voiding (during large breaks) or control rod insertion (during small breaks).

Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

On smaller breaks, PCS pressure will stabilize at a value dependent upon break size, heat load, and injection flow. The smaller the break, the higher this equilibrium pressure. In all LOCA analyses, injection flow is not credited until PCS pressure drops below the shutoff head of the HPSI pumps.

Palisades Nuclear Plant B 3.5.2-4 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES -

APPLICABLE The LCO ensures that an ECCS train will deliver sufficient water to match SAFETY ANALYSES,' decay heat boiloff rates soon enough to minimize core damage for a large (continued) LOCA. It also ensures that the HPSI pump will deliver sufficient water during a small break LOCA and provide sufficient boron to limit the return to power following an MSLB event. For smaller LOCAs, PCS inventory decreases until the PCS can be depressurized below the HPSI pumps' shutoff head. During this period of a small break LOCA, the SGs continue to serve as the heat sink providing core cooling.

ECCS - Operating satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO In MODES I and 2, and in MODE 3 with PCS temperature > 325 0 F, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assumingthere is a single failure affecting either train. 'Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents .

-An ECCS train consists of an HPSI subsystem and a LPSI subsystem. In addition, each train includes the piping, instruments, and controls to ensure the availability of an OPERABLE flow path capable of taking suction from

-the SIRWT on an SIS and automatically transferring suction to the containment sump upon a Recirculation Actuation Signal (RAS).

During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water from the SIRWT to the PCS, via the HPSI and LPSI, pumps and their respective supply headers, to each of the four cold leg injection nozzles is available. During the recirculation phase, a flow path is provided from the containment sump to the PCS via the HPSI pumps. For worst case conditions, the containment building water level alone is not sufficient to assure adequate Net Positive Suction Head (NPSH) for the HPSI pumps. Therefore, to obtain adequate NPSH, a

- portion of the Containment Spray (CS) pump discharge flow is diverted from downstream of the shutdown cooling heat exchangers to the suction of the HPSI pumps at recirculation during a large break LOCA In this S;configuration, the CS pumps and shutdown cooling heat exchangers provide a support function for HPSI flow path OPERABILITY. The OPERABILITY requirements for the CS pumps and shutdown cooling heat exchangers are addressed in LCO 3.6.6,'"Containment Cooling Systems."

- Support system OPERABILITY is addressed by LCO 3.0.6.

The flow path for each train must maintain its designed independence to ensure that no single active failure can disable both ECCS trains.

Palisades Nuclear Plant B 3.5.2-5 "*Revised 04/22/2002

I ECCS - Operating B 3.5.2 BASES APPLICABILITY In MODES 1 and 2, and in MODE 3 with PCS temperature > 3250F, the ECCS OPERABILITY requirements for the limiting Design Basis Accident (DBA) large break LOCA are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The HPSI pump performance is based on the small break LOCA, which establishes the pump performance curve and has less dependence on power. The requirements of MODE 2 and MODE 3 with PCS temperature > 3250 F, are bounded by the MODE 1 analysis.

The ECCS functional requirements of MODE 3, with PCS temperature

< 3250 F, and MODE 4 are described in LCO 3.5.3, "ECCS - Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "PCS Loops MODE 5, Loops Filled," and LCO 3.4.8, "PCS' Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are aldressed by LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level,"

and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS A..1 Condition A is applicable whenever one LPSI subsystem is inoperable.

With one LPSI subsystem inoperable, action must be taken to restore OPERABLE status within 7 days. In this condition, the remaining OPERABLE ECCS train is adequate toperform the heat removal function.

However, the overall reliability is reduced because a single failure to the remaining LPSI subsystem could result in loss of ECCS function. The 7 day Completion Time is reasonable to perform corrective maintenance on the inoperable LPSI subsystem. While mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time, this '7 day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference

5. Reference 5 concluded that extending the Completion Time to 7 days for an inoperable LPSI subsystem provides plant operational flexibility while simultaneously reducing overall plant risk. This is because the risks incurred by ha;ving the LPSI subsystem unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during plant shutdown operations.

Palisades Nuclear Plant B83.5.2-6 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES ACTIONS B.1 (continued)  : (Condition B is applicable whenever one or more ECCS trains is inoperable for reasons other than one inoperable LPSI subsystem. Action B.1 requires restoration of both ECGS trains, (HPSI and LPSI) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on an NRC study (Ref. 3), assuming that at least 100% of the required ECCS flow (that assumed in the safety analyses) is available. If less than 100% of the required ECCS flow is available, Condition D must also be entered.

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time under conditions when a required system can perform its required safety function, but may not be able to do so assuming an additional failure.

When operating in-accordance with the Required Actions of an LCO

-Condition, it is not necessary to be able to cope with an additional single failure.

The ECCS can provide one hundred percent of the required ECCS flow following the occurance of any single active failure.' Therefore, the ECCS function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable.

Under that condition, however, the ability to provide the function after the occurance of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

C.1 and 0.2:,

Condition C is applicable when the Required Actions of Condition A or B cannot be completed within the required Completion Time. Either Condition A or B is applicable whenever one or more ECCS trains is inoperable. Therefore, when Condition C is applicable, either Condition A or B is also applicable. Being in Conditions A or B, and Condition C concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition C while the plant is still within the applicable conditions of the LCO.

Ifthe inoperable ECCS trains cannot be restored to OPERABLE status within the required Completion Times of Condition A and B, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and PCS temperature reduce to < 325°F within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.5.2-7 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES ACTIONS D.1 (continued)

Condition D is applicable with one or more trains inoperable when there is less than 100% of the required ECCS flow available. Either Condition A or B is applicable whenever one or more ECCS trains is inoperable.

Therefore, when this Condition is applicable, either Condition A or B is also applicable. Being in Conditions A or B, and Condition D concurrently maintains both Completion Time clocks for instances where equipment repair'allows exit from Condition D (and LCO 3.0.3) while the plant is still within the applicable conditions of the LCO.

One hundred percent of the required ECCS flow can be provided by one OPERABLE HPSI subsystem and one OPERABLE LPSI subsystem. The required LPSI flow (that assumed in the safety analyses) is available if there is an OPERABLE LPSI flow path from the SIRWT to any two PCS loops. Shutdown cooling flow control valve, CV-3006 must be full open.

The required HPSI flow (that assumed in the safety analyses) is available if there is an OPERABLE HPSI flow path from the SIRWT to each PCS loop (having less than all four PCS loop flowpaths may,be acceptable if verified against current safety analyses). A Containment Spray Pump and a sub cooled suction valve must be available to support each OPERABLE HPSI pump. In each case, an OPERABLE flow path must include an OPERABLE pump and OPERABLE loop injection valves.

Reference 4 describes situations in which-one component, such as the shutdown cooling flow control valve, CV-3006, can disable both ECCS trains. With one or more components inoperable, such that 100% of the required ECCS flow (that assumed in the safety analyses) is not available, the facility is in a condition outside the accident safety analyses.

Withi less than 100% of the required ECCS flow available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LCO 3.0.3 must be entered immediately.

Palisades Nuclear Plant B 3.5.2-8 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES . . . ...

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to thePCS is maintained., CV-3027 and CV-3056 are stop valves in the minimum recirculation flow path for the ECGS pumps. If either of these valves were closed when the PCS pressure was above the shutoff head of the ECCS pumps, the pumps could be damaged by running with insufficient flow and thus render both ECCS trains inoperable.

Placing HS-3027A and HS-3027B for CV-3027, and HS-3056A and HS-3056B for CV-3056, in the open position ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure. These valves are of the type described in Reference 4, which can disable the function of both ECCS trains and invalidate the accident analysis. CV-3027 and CV-3056 are capable of being closed from the control room since the SIRWT must be isolated from the containment during the recirculation phase of a LOCA. A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered reasonable in view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS,operation. This SR does not apply to valves that are locked, sealed, ot otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time., This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of beingmispositioned are in the correct position.

S- .The 31 day Frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect

-a single train. Thi, Frequency has been shown to be acceptable through operating experience.

Palisades Nuclear Plant B 3.5.2-9 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 REQUIREMENTS (Continued) SR 3.5.2.3 verifies CV-3006 is in the open position and that its air supply is isolated. CV-3006 is the shutdown cooling flow control valve located in the common LPSI flow path., The valve must be verified in the full open position to support the low pressure injection flow assumptions used in the accident analyses.

The inadvertent misposition of this valve could result in a loss of low pressure.

injection flow and thus invalidate these flow assumptions. CV-3006 is designed to be held open by spring force and closed by air pressure. To ensure the valve cannot be inadvertently misaligned or change position as the result of a hot short in the control circuit, the air supply to CV-3006 is isolated. Isolation of the air supply to CV-3006 is acceptable since the valve does not require automatic repositioning during an accident The 31 day Frequency has been shown to be acceptable through operating practice and the unlikely occurrence of the air supply to CV-3006 being unisolated coincident with a inadvertent valve misalignment event or a hot short in the control circuit SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller damage or other hydraulic component problems is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis. SRs are specified in the Inservice Testing Program, which encompassesSection XI of the ASME Code.Section XI of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR "3.5.2.5, SR 3.5.2.6. and SR 3.5.2.7 These SRs demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated actuation signal, I.e., on an SIS or RAS, that each ECCS pump starts on receipt of an actual or simulated actuation signal, I.e.,

on an SIS, and that the LPSI pumps stop on receipt of an actual or simulated actuation signal, i.e., on an RAS. RAS opens the HPSI subcooling valve CV-3071, ifthe associated HPSI pump is operating. After the containment sump valve CV-3030 opens from RAS, HPSI subcooling valve CV-3070 will open, ifthe associated HPSI pump is operating. RAS will close containment spray valve CV-3001, ifcontainment sump valve CV-3030 does not open. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

Palisades Nuclear Plant B 3.5.2-10 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7 (continued)

REQUIREMENTS The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the

"-potentialfor unplanned transients if the Surveillances were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability of the equipment and operating

- experience: The actuation logic is tested as part of the Engineered Safety Feature (ESF) testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.8 The HPSI Hot Leg Injection motor operated valves and the LPSI loop injection valves have position switches which are set at other than the full open position. This surveillance verifies that these position switches are set properly.

The HPSI Hot leg injection valves are manually opened during the post-LOCA long term cooling phase to admit HPSI injection flow to the PCS hot leg. The open position limit switch on each HPSI hot leg isolation valves is set to establish a predetermined flow split between the HPSI injection entering the PCS hot leg and cold legs.

The LPSI loop injection MOVs open automatically on a SIS signal. The open position limit switch on each LPSI loop injection valve is set to establish the maximum possible flow through that valve. The design of these valves is such that excessive turbulence is developed in the valve body when the valve disk is at the full open position. Stopping the valve travel at slightly less than full open reduces the turbulence and results in increased flow. Verifying that the position stops are properly set ensures that a single low pressure safety injection subsystem is capable of delivering the flow rate required in the safety analysis.

The 18 month Frequency is based on the same factors as those stated above for SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7.

SR 3.5.2.9 Periodic inspection of the containment sump ensures that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under outage conditions.

This Frequency is sufficient to detect abnormal degradation and is confirmed by operating experience.

Palisades Nuclear Plant I *gI*VV Q lUVIV ........

B 3.5.2-1 1 Revised 04/22/2002

ECCS - Operating B 3.5.2 BASES REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.17

3. NRC Memorandum to V. Stello, Jr., from R. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975

4. IE Information Notice No. 87-01, January 6, 1987

5. CE-NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," May 1995 Palisades Nuclear Plant B83.5.2-12 Revised 04/22/2002

ECCS - Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS - Shutdown BASES BACKGROUND The Background section for Bases B 3.5.2,"ECCS - Operating," is applicable to these Bases, with the following modifications.

0 In MODE 3 with Primary Coolant System (PCS) temperature < 325 F and in MODE 4, an ECCS train is defined as one Low Pressure Safety Injection (LPSI) train.-The LPSI flow path consists of piping, valves, and pumps that enable water from the Safety Injection Refueling Water Tank (SIRWT), and subsequently the containment sump, to be injected into the PCS following a Loss of Coolant Accident (LOCA).

APPLICABLE- In Mode 3 with PCS temperature < 325 0F and in Mode 4 the normal SAFETY ANALYSES compliment of ECCS components is reduced from that which is

.. available during operations above Mode 3 with PCS temperature

Ž 325 0F. The acceptability for the reduced ECCS operational requirements is based on engineering judgement rather than specific analysis and considers such factors as the reduced probability that a LOCA will occur, and the reduced energy stored in the fuel. The

'reduction in ECCS operational requirements include:

1) Isolation of the Safety Injection Tanks (SITs) since PCS pressure is expected to be reduced below the SIT injection pressure,

2) Reliance on manual safety injection initiation since the automatic Safety Injection Signal (SIS) is not required by the technical specifications below 300 0F,

3) Rendering the High Pressure Safety Injection (HPSI) pumps incapable of injecting into the PCS. The HPSI pumps are rendered incapable of injecting into the PCS in accordance with the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System". This action assures that a single mass addition event initiated'at a pressure within the limits of

.LCO 3.4.12 cannot cause the PCS pressure to exceed the 10 CFR 50 Appendix G limit: .

Revised 07122/2002 Palisades Nuclear Plant B 3.5.3-1

ECCS - Shutdown B 3.5.3 BASES APPLICABLE At a PCS temperature of 325°F the maximum allowed PCS pressure SAFETY ANALYSES corresponds to the LTOP setpoint limit which is approximately 800 psia, (continued) Below 800 psia postulated piping flaws of critical size are considered unlikely since normal operation at 2060 psia serves as a proof test against ruptures. In addition, since the reactor has been shutdown for a period of time, the decay heat and sensible heat levels are greatly reduced from the full power case.

Although a pipe break in the PCS pressure boundary is considered unlikely, break sizes larger and smaller than approximately 0.1 ft2 are considered separately when analyzing ECCS response.

For breaks larger than approximately 0.1 ft2, the event is characterized by a very rapid depressurization of the PCS to near the containment pressure. Due to the reduced temperature and pressure of the PCS, the time to complete blowdown is extended from that assumed in the full power case. During this time, the fuel is cooled by the flow through the core towards the break. Automatic safety injection actuation is not assumed to occur since the pressurizer pressure SIS may be bypassed below 1700 psig. Therefore, operator action is relied upon to initiate ECCS flow. Indication that would alert the operator that a LOCA had occurred include; a loss of pressurizer, level, rapid decrease in PCS pressure, increase in containment pressure, and containment high radiation alarm. Since the saturation pressure for 325 0 F is approximately 100 psia,; the LPSI pumps are capable of providing the required heat removal function. When the OPERABLE LPSI pump is being used to fulfill the shutdown cooling function, the PCS pressure is

< 300 psia. As such, the rate of PCS blowdown is reduced providing some time to manually realign the OPERABLE LPSI pump to the ECCS mode of operation.

For breaks smaller than approximately 0.1 tf, the event is characterized by a slow depressurization of the PCS and a relatively long time for the PCS level to drop below the tops of the hot legs. In MODE 3 with PCS temperature < 325 0F and in the upper range of MODE 4 before shutdown cooling is established, the spectrum of smaller break sizes are more limiting than larger breaks in terms of ECCS performance since the PCS could stay above the shutoff head of the LPSI pumps.

For these break sizes, sufficient time, well in excess of the recbommended 10 minutes' attributed for manual operator action, is available to either initiate once through cooling using the PORVs, or by re-establishing HPSI pump injection capability. In either case, the core remains covered and the criteria of 10 CFR 50.46 preserved.

ECCS - Shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.5.3-2 Revised 07/22/2002

ECCS - Shutdown B 3.5.3 BASES 0

LCO --.In MODE 3 with PCS temperature < 325 F and in MODE 4, anECCS

.train is comprised of a single LPSI train.-Each LPSI train includes the

. -,piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the SIRWT and transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to supply water from the SIRWT to the PCS via one LPSI pump and at least one supply header to a cold leg injection nozzle: In the long term, this flow path may be switched to take its supply from the containment sump.

With PCS temperature < 3250F, one LPSI pump is acceptable without single failure consideration, based on the stable reactivity condition of the reactor and the limited core cooling requirements. The High

-Pressure Safety Injection (HPSI) pumps may therefore be released from

< 300 0 F, both the ECCS train requirements. With PCS temperature HPSI pumps must be rendered incapable of injection into the PCS in accordance with LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP) System."

The LCO is further modified by a Note that allows a LPSI train to be considered OPERABLE during alignment and operationfor shutdown cooling, if capable of being manually realigned (remote"orlocal) to the ECCS mode of operation and not otherwise inoperable. This allows operation of a LPSI pump in the shutdown cooling mode.

0 APPLICABILITY In MODES I and 2, and in MODE 3 with PCS temperature > 325 F, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

0 In MODE 3 with PCS temperature < 325 F and in MODE 4, one OPERABLE ECCS train is acceptable without single failure consideration, based on the stable reactivity condition of the reactor and the limited core cooling requirements.

Palisades Nuclear Plant B 3.5.3-3 Revised 07/22/2002

ECCS - Shutdown B 3.5.3 BASES APPLICABILITY In MODES 5 and 6, plant conditions are such that the probability of an (continued) event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "PCS Loops MODE 5, Loops Filled," and LCO 3.4.8, "PCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS A.1 With no LPSI train OPERABLE, the plant is not prepared to respond to a loss of cbolant accident. Action must be initiated Immediately to restore at least one LPSI train to OPERABLE status. The Immediate Completion Time reflects the importance of maintaining an OPERABLE LPSI train and ensures that prompt action is taken to restore the required cooling capacity.

I SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

Palisades Nuclear Plant B 3.5.3-4 Revised 07/22/2002

SIRWT B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Safety Injection Refueling Water Tank (SIRWT)

BASES ' * "

BACKGROUND The SIRWT supports the ECCS and the Containment Spray System by

-providing a source of borated water for Engineered Safety Feature (ESF) pumpoperation.

The SIRWT supplies two ECCS trains by separate, redundant supply headers. Each header also supplies one train of the Containment Spray System. An air operated isolation valve is provided in each "headerwhich isolates the SIRWT from the ECCS after the ESF pump suction has been transferred to the containment sump following

-depletion of the SIRWT during a Loss of Coolant Accident (LOCA).

SA separate header is used to supply the Chemical and Volume Control System (CVCS) from the SIRWT. Use of a single SIRWT to supply both trains of the ECCS and Containment Spray System is acceptable since the SIRWT is a passive component,-and passive failures are not Sassumed to occur concurrently with any Design Basis Event during the

.injection phase of an accident. Not all the water stored in the SIRWT is available for injection following a LOCA; the location of the ESF pump

" suction piping in the SIRWT will result in some portion of the stored volume being unavailable.

The High Pressure Safety Injection (HPSI) and Low Pressure Safety Injection (LPSI) pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions. These lines discharge back to the SIRWT, which vents to the atmosphere. When the suction for the ESF pumps is transferred to the containment sump, the recirculation path must be isolated to prevent is a release of the containment sump contents to the SIRWT. If not isolated, this flow path could result in a release of S- contaminants to the atmosphere and the eventual loss of suction head for the ESF pumps.-.

Palisades Nuclear Plant B 3.5.4-1 . - Revised 04/2212002

SIRWT B 3.5.4 BASES BACKGROUND This LCO ensures that:

(continued)

a. The SIRWT contains sufficient borated water to support ESF pump operation during the injection phase;

b. Sufficient water volume exists in the containment sump to support continued operation of the ESF pumps at the time of transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a LOCA.

Insufficient water inventory in the SIRWT could result in insufficient cooling capacity of the ECCS when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of shutdown margin or excessive boric acid precipitation in the core following a LOCA, as well as excessive stress corrosion of mechanical components and systems inside containment.

APPLICABLE During accident conditions, the SIRWT provides a source of borated SAFETY ANALYSES water to the HPSI, LPSI, and Containment Spray pumps. As such, it provides containment cooling and depressurization, core cooling, replacement inventory, and is a source'of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Bases B 3.5.2, "ECCS Operating," and B 3.6.6, "Containment Cooling Systems." These analyses are used to assess changes to the SIRWT in order to evaluate their effects in relation to the acceptance limits.

In MODES 1, 2, and 3 the minimum volume limit of 250,000 gallons is based on two factors:

a. Sufficient deliverable volume must be available to provide at least 20 minutes of full flow from one train of ESF pumps prior to reaching a low level switch over to the containment sump for recirculation; and

b. The containment sump water volume must be sufficient to support continued ESF pump operation after the switch over to recirculation occurs. This sump volume water inventory is supplied by the SIRWT borated water inventory.

Palisades Nuclear Plant B 3.5.4-2 Revised 04/22/2002

SIRWT B 3.5.4 BASES APPLICABLE -Twenty minutes is`the point at which approximately 75% of the design SAFETY ANALYSES flow of one HPSI pump is capable of meeting or exceeding'tlie decay (continded) heat boiloff rate.

The SIRWT capacity, alone, is hot sufficient to provide adequate Net Positive Suction Head (NPSH) for the HPSI pumps after switch over to the containment sump for the worst case conditions. To assure

adequate NPSH for the HPSI pumps, their suction headers are automatically aligned to the discharge of the Containment Spray Pumps

.(Ref. 2). Restrictions are-placed on Containment Spray Pump operation

-With this alignment to ensure theCbrntainment Spray Pumps have

-adequate NPSH (Ref. 3).

In MODE 4, the minimum-volume limit of 200,000 gallons is based on engineering judgement and considers factors such as:

"a.-- The volume of water transferred f6om the SIRWT to the PCS to account for the change in PCS water volume during a cooldown from 532 0 F to-200OF (approximately 17,000 gallons assuming an initial PCS volume of 80,000 gallons); and

b. The minimum SIRWT water Volume capable of providing a sufficient level in the containment sutmp to support LPSI pump operation following a LOCA.

Due to the reduced PCS temperature and pressure requirements in MODE 4, and in recognition that water from the SIRWT used for PCS "makeupis available for recirculation following a LOCA, the minimum

-water volume limit for-the SIRWT in MODE 4 is lower than in MODES 1, 2, or 3. , -.

The 1720 ppm limit for minimum boron concentration was established to ensure that, following a LOCA with a minimum level in the SIRWT, the reactor will remain subcritical in the cold condition following mixing of the SIRWT, Safety Injection Tanks, and PCS water volumes. Small

'"-:.-"break LOCAs assume that'all full-length control rods are inserted, except for the control rod of highest worth, which is withdrawn from the core. Large break LOCA analyses assume that all full-length control rods remain withdrawn until the blowdown phase is over. For large break LOCAs, the initial reactor shutdown is accomplished by void formation. The most limiting case occurs at beginning of core life.

Palisades 'Nuclear Plant B 3.5.4-3  :,Revised 04/22/2002

SIRWT B 3.5.4 BASES APPLICABLE The maximum boron limit of 2500 ppm in the SIRWT is based on boron SAFETY ANALYSES precipitation in the core following a LOCA. With the reactor vessel at (continued) saturated conditions, the core dissipates heat by pool nucleate boiling.

Because of this boiling phenomenon in the core, the boric acid concentration will increase in this region. If allowed to proceed in this manner, a point will be reached where boron precipitation will occur in the core. Post LOCA emergency procedures direct the operator to establish simultaneous hot and cold leg injection to prevent this condition by establishing a forced flow path through the core regardless of break location. These procedures are based on the minimum time in which precipitation could occur, assuming that maximum boron concentrations exist in the borated water sources used for injection following a LOCA. Boron concentrations in the SIRWT in excess of the limit could result in precipitation earlier than assumed in the analysis.

SIRWT boron concentration and volume also determine the post-LOCA pump pH. Trisodium Phosphate (TSP), stored in the lower region of containment, mixes with the SIRWT water following a LOCA to control pH. Maintaining pH in the proper range is necessary to retain iodine in solution, prevent excessive hydrogen generation, and to prevent potential long term stress corrosion cracking in ESF piping. TSP requirements are addressed in LCO 3.5.5, 'Trisodium Phosphate (TSP).".

The upper limit of 100°F and the lower limit of 40°F on SIRWT temperature are the limits assumed in the accident analysis. SIRWT temperature affects the outcome of several analyses. Although the minimum temperature limit of 40°F was selected to maintain a small margin above freezing (32°F), violation of the minimum temperature could result in unacceptable conclusions for some analyses. The upper temperature limit of 100OF is used in the Containment Pressure and Temperature Analysis. Exceeding this temperature will result in higher containment pressure due to reduced containment spray cooling capacity.

The SIRWT satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.5.4-4 Revised 04/22/2002

SIRWT B 3.5.4 BASES LCO The SIRWT ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA),-to cool and cover the core in the event of a LOCA, that the reactor remains subcritical following a DBA, and that an adequate level exists in the containment sump to support ESF pump operation in the recirculation mode.

To be considered OPERABLE, the SIRWT must meet the limits established in the SRs for water volume, boron concentration, and temperature.

APPLICABILITY In MODES 1, 2, and 3, the SIRWT OPERABILITY requirements are dictated by the ECCS and Containment Spray System OPERABILITY requirements. In MODE 4 the SIRWT OPERABILITY requirements are dictated by ECCS requirements only. As such, the SIRWT must be OPERABLE in MODES 1, 2,3, and 4.

Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "PCS Loops -'MODE 5, Loops Filled," and LCO 3.4.8, "PCS Loops MODE 5, Loops Not Filled." MODE 6 core-cooling requirements are addressed by LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level,'" and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS ~AJ With SIRWT boron concentration or borated water temperature not within limits, it must be returned to within limits within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. In this condition neither the ECCS nor the Containment Spray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE condition.- The allowed Completion Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to restore the SIRWT to within limits was developed considering the time'required to change boron concentration or temperature, and that the contents of the tank are still available for injection.,

Palisades Nuclear Plant B 3.5.4-5 "--Revised 04/22/2002

SIRWT B 3.5.4 BASES ACTIONS B.1 (continued)

With SIRWT borated water volume not within limits, it must be returned to within limits within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In this condition, neither the ECCS nor Containment Spray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which these systems are not required. The allowed Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to restore the SIRWT to OPERABLE status is based on this condition simultaneously affecting multiple redundant trains.

C.1 and C.2 If the SIRWT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.4.1 REQUIREMENTS SIRWT borated water temperature shall be verified every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be within the limits assumed in the accident analysis. This Frequency has been shown to be sufficient to identify temperature changes that approach either acceptable limit.

SR 3.5.4.2 and SR 3.5.4.3 The minimum SIRWT water volume shalt be verified every 7 days. This Frequency ensures that a sufficient initial water supply is available for injection and to support continued ESF pump operation on recirculation.

Since the SIRWT volume is normally stable and is provided with a Low Level Alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.4.2 is modified by a Note which states that it is only required to be met in MODES 1, 2, and 3.

Palisades Nuclear Plant B 3.5.4-6 Revised 04/22/2002

SIRWT B 3.5.4 BASES SURVEILLANCE SR 3.5.4.2 and SR 3.5.4.3 (continued)

REQUIREMENTS SR 3.5.4.3 is modified by a Note which states that it is only required to be met in MODE 4. The required minimum SIRWT water volume is less in MODE 4 since the PCS temperature and pressure are reduced and a significant volume of water is transferred from the SIRWT to the PCS during MODE 4 to account for primary coolant shrinkage.

SR 3.5.4.4 Boron concentration of the SIRWT shall be verified every 31 days to be within the required range. This Frequency ensures that the reactor will remain subcritical following a LOCA. Further, it ensures that the resulting sump pH will be maintained in an acceptable range such that boron precipitation in the core will not occur earlier than predicted and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.

Since the SIRWT volume is normally stable, a 31 day sampling Frequency is appropriate and has been shown through operating experience to be acceptable.

REFERENCES 1. FSAR, Chapter 6 and Chapter 14

2. Design Basis Document (DBD) 2.02, "High-Pressure Safety Injection System," Section 3.3.1

3. EOP 4.0, Loss of Coolant Accident Palisades Nuclear Plant B'3.5.4-7 Revised 04/22/2002

Containment Cooling Systems B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Cooling Systems BASES BACKGROUND The Containment Spray and Containment Air Cooler systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment press ure'reduces the release of fission product radioactivity from containment to the environment, in the event of a Main Steam Line Break (MSLB) or a large break Loss of Coolant Accident (LOCA). The Containment Spray and Containment Air Cooler systems are designed to the'requirements of the Palisades Nuclear Plant design criteria (Ref. 1).

"TheContainment Air Coo1eIýSystem and Containment Spray System are Engineered Safety Feature (ESF) systems. They are designed to ensure "that the heat remova! capability required during the post accident period can be attained. The systems are arranged With two spray pumps and one air cooler fan powered from one diesel generator, and with one spray pump and three air cooler fans powered from the other diesel generator.

The Containment Spray System was orginally designed to be redundant to the Containment Air Coolers (CACs) and fans. These systems were originally designed such that either two containment spray pumps or three CACs could limit containment pressure to less than design. However, the current safety analyses take credit for one containment spray pump when "evaluatingcases with three CACs, and for one air cooler fan in cases with two spray pumps and both Main Steam Isolation Valve (MSIV) bypass valves closed. 'Ifan MSIV bypass valve is open, 2 service water pumps and 2 CACs are also required to be OPERABLE in addition to the 2 spray pumps for containment heat removal.,

To address this dependency between the Containment Spray System and the Containment Air Cooler.Systern the title of this Specification is "Containment Cooling Systems," and includes both systems. The LCO is written in terms of trains of containment cooling. One train of containment cooling is associated 'witli Diesel Generator 1-1 and includes Containment Spray Pumps P-54B -and P-54C,'Containment Spray Valve CV-3001 and the associated spray header, and Air Cooler Fan V-4A. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A, and V-3A.i C ,

Palisades Nuclear Plant B 3.6.6 'Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES BACKGROUND If reliance is placed solely on one spray pump and three CACs, at least (continued) two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs. Additional details of the required equipment and its operation is discussed with the containment cooling system with which it is associated.

Containment Spray System The Containment Spray System consists of three half-capacity (50%)

motor driven pumps, two shutdown cooling heat exchangers, two spray headers, two full sets of full capacity (100%) nozzles, valves, and piping, two full capacity (100%) pump suction lines from the Safety Injection and Refueling Water Tank (SIRWT) and the containment sump with the associated piping, valves, power sources, instruments, and controls. The heat exchangers are shared with the Shutdown Cooling System. SIRWT supplies borated water to the containment spray during the injection phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the SIRWT to the containment sump.

Normally, both Shutdown Cooling Heat Exchangers must be available to provide cooling of the containment spray flow in the event of a Loss of Coolant Accident. If the Containment Spray side (tube side) of one SDC Heat Exchanger is out of service, 100% of the required post accident cooling capability can be provided, if other equipment outages are limited. One hundred percent of the post accident cooling can be provided with the Containment Spray side of one SDC Heat Exchanger out of service if the following equipment is OPERABLE: 3 safety related Containment Air Coolers, 2 Containment Spray Pumps, CCW pumps P-52A and P-52B, 2 SWS pumps, and both CCW Heat Exchangers, and if

1. One CCW Containment Isolation Valve, CV-091 0, CV-091 1, or CV-0940, is OPERABLE, and

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE..

The Containment Spray System provides a'spray of cold borated water into the upper regions of containment toreduce the containment pressure and temperature during a MSLB or large break LOCA event. In addition, the Containment Spray System in conjunction with the use of trisodium phosphate (LCO 3.5.5, "Trisodium Phosphate,") serve to remove iodine which may be released following an accident. The SIRWT solution temperature is an important factor in determining the heat removal capability of the Containment Spray Systemduring the injection phase.

Palisades Nuclear Plant B 3.6.6-2 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES BACKGROUND Containment Spray System' (continued) -

flhle irecirculation mode of operation, heat ii removed from the containment sump water' by the shutdown Cooling heat exchangers.

The Containment Spray System is actuated either automatically by a Containment Hight Pressure (CHP) signal or manually. An automatic a6tuation opens the containment spray header isolation valves, starts the three containment soray puips, and begins the injection phase.

Individual component controls'may be used to manually initiate 4

- Containment Spray.-"The injection phase cd ntinues until an SIRWT Level Low signal is received. The Low Level signal for the SIRWT generates a

-Re'circulation Actuation Signal (RAS) that aligns valves from the containment spray pump suction to the containment sump. RAS opens the HPSI subcooling valve CV-3071, if the associated HPSI pump is operating. After the subcoolin-g containment valve sump CV-3070-will valve open,: CV-3030 if the6 opensHPSI associated frompump RAS, is SHPSI op erating. RAS will close containment spraý valve CV-3001, if containment sump valve CV-3030 does not open. The Containment Spray System in recirculation mode maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water.

Operation of the Containment Spray System in the recirculation mode is "controlledby the operator in' accordan'ce with the 'emergency operating procedures.

The containment spray pumps also provide a ~equired support function for the High Pressure Safety Injection pumps as desCribed in the Bases for specification 3.5.2. The High Pressure Safety Injection-pumps alone "maynot have adequate NPSH after a postulated accident and the 4 realignment of their suctions from the SIRWT to the containment sump.

Flow is automatically provided from the discharge of the containment spray pumps to.the suction of the High Pressure Safety Injection (HPSI) pumps after the change to recirc6ulation mode has occurred, if the HPSI pump is operating:. The additional suction-pressure ensures that adequate NPSH is available for the High Pressure Safety Injection pumps.

Palisades Nuclear Plant B 3.6.6-3 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES BACKGROUND Containment Air Cooler System (continued)

The Containment Air Cooler System includes four air handling and cooling units, referred to as the Containment Air Coolers (CACs), which are located entirely within the containment building. Three of the CACs (VHX-1, VHX-2, and VHX-3) are safety related coolers and are cooled by the critical service water. The fourth CAC (VHX-4) is not taken credit for in maintaining containment temperature within limit (the service water inlet valve for VHX-4 is closed by an SIS signal to conserve service water flow), but is used -during normal operation along with the three CACs to maintain containment temperature below the design limits. The fan associated with VHX-4, V-4A, is assumed in the safety analysis as assisting in the containment atmosphere mixing function.

The DG which powers the fans associated with VHX-1, VHX-2, and VHX-3 (V-1A, V-2A and V-3A) also powers two service water pumps.

This is necessary because if reliance is placed solely on the train with one spray pump and three CACs, at least two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs.

Each CAC has two vaneaxial fans with direct connected motors which draw air through the cooling coils. Both of these fans are normally in operation, but only one fan and motor for each CAC is rated for post accident conditions. The post accident rated "safety related" fan units, V-IA, V-2A, V-3A, and V-4A, serve not only to provide forced flow for the associated cooler, but also provide mixing of the containment atmosphere. A single operating safety related fan unit will provide enough air flow to assure that there is adequate mixing of unsprayed containment areas to assure the assumed iodine removal by the containment spray. The fan units also support the functioning of the hydrogen recombiners, as discussed in the Bases for LCO 3.6.7, "Hydrogen Recombiners." In post accident'ope'ation following a SIS, all four Containment air coolers are designed to change automatically to the emergency mode.

The CACs are automatically changed to the emergency mode by a Safety Injection Signal (SIS). This signal will trip the normal rated fan motor in each unit, open the high-capacity service water discharge valve from VHX-1, VHX-2, and VHX-3, and close the high-capacity service water supply valve to VHX-4. The test to verify the service water valves actuate to their correct position upon receipt of an SIS signal is included in the surveillance test performed as part of Specification 3.7.8, "Service Water System." The safety related fans are normally in operation and only receive an actuation signal through the DBA sequencers following an SIS in conjunction with a loss of offsite power. This actuation is tested by the surveillance which verifies the energizing of loads from the DBA sequencers in Specification 3.8.1, "AC Sources-Operating."

Palisades Nuclear Plant B83.6.6-4 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES APPLICABLE The Containment Spray System and Containment Air Cooler I SAFETY ANALYSES System limit the temperature and pressure that could be experienced following either a Loss of Coolant Accident (LOCA) or a Main Steam Line

, Break (MSLB)., The large break LOCA and MSLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. 2 The Containment Cooling Systems have been analyzed for three accident cases (Ref. 2). All accidents analyses account for the most limiting single active failure.

"1. A Large Break LOCA,

• 2. An MSLB occurring at various power levels with both MSIV bypass valves closed,and- -

3. An MSLB occurring at 0% RTP with both'MSiV bypass valves open.

The postulated large break LOCA is analyzed, in regard to containment ESF systems, assuming the loss of offsite power and the loss of one ESF

-bus, which is the worst case single active failure, resulting in one train of Containment Cooling being rendered inoperable (Ref. 6).

-..--The postulated MSLB is analyzed, in regard to containment ESF systems, assuming the worst case single active failure.,

• The MSLB event is analyzed at various power levels with both MSIV bypass valves closed, and at 0% RTP with both MSIV bypass valves

-open. Having any MSIV bypass valve open allows additional blowdown

.*-,-from the intact steam generator.',

The analysis and evaluation show that under the worst .case scenario, the highest 'peak containment pressure and the peak containment vapor temperature are within the intent of the-design basis. (See the Bases for p....Specifications 3.6.4, "Containment Pressure," and 3.6.5, "Containment Air "Temperature,"for a'detailed discussion.) The analyses and evaluations

'-considered a range of power levels and equipment configurations as "describedin Reference 2. The peak'cbntainment piressure case is the

'0% power MSLB with initial (pre-accident) -onditions of 140°F and 16.2 psia. The peak temperature case is the 102% power MSLB with initial (pre-accident) conditions of 1401F and 15.7 psia. The analyses also assume a response time delayed initiation in order to provide conservative peak calculated containment pressure and temperature responses.

Palisades Nuclear Plant B 3.6.6-5 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES APPLICABLE The external design pressure of the contairnment shell is 3 psig. This SAFETY ANALYSES value is approximately 0.5 psig greater than the maximum external (continued) pressure that could be developed if the containment were sealed during a period of low barometric pressure and high temperature and, subseq-uently, the containment atmosphere was cooled with a concurrent major rise in barometric pressure.

The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the Containment High Pressure setpoint to achieve full flow through the CACs and containment spray nozzles. The spray lines within containment are maintained filled to the 735 ft elevation to provide for rapid spray initiation. The Containment Cooling System total response time of < 60 seconds includes diesel generator startup (for loss of offsite power), loading of equipment, CAC and containment spray pump startup, and spray line filling.

The performance of the Containment Spray System for post accident conditions is given in Reference 3. The performance of the Containment Air Coolers is given in Reference 4.

The Containment Spray System and the Containment Cooling System satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO During an MSLB or large break LOCA event, a minimum of one containment cooling train is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header, and air cooler fan V-4A. This train must be supplemented with 2 service water pumps and 2 containment air coolers if an MSIV bypass valve is open. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray Pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A, and V-3A.' To~ensure that these requirements are met, two trains of containment cooling must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst case single active failure occurs.

Palisades Nuclear Plant B83.6.6-6 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES .

LCO The Containment Spray System portion of the containment cooling trains (continued) includes three spray pumps, two spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the SIRWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

The Containment Air Cooler System portion of the containment cooling train which must bte OPERABLE includes the three safety related air "coolerswhich each consist of four cooling coil banks, the safety related fan Which must be in operation to be OPERABLE, gravity-operated fan discharge dampers, instruments, and controls to ensure an OPERABLE flow path.

CAC fans V-1A, V-2A, V-3A, and V-4A must be in operation to be "consideredOPERABLE. These fans only receive a start signal from the DBA sequencer; they are assumed to be in operation, and are not started

'by either a CHIP or an SIS signal.

APPLICABILITY In MODES 1, 2, and 3, a large break LOCAkevent could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the containment spray trains and containment cooling trains.

In-MODES 4, 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray and Containment Cooling systems are not required to be OPERABLE in MODES 4, 5 and 6.

ACTIONS A._

Condition A is applicable whenever one or more containment cooling trains is inoperable. Action A. 1 requires restoration of both trains to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />., The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time for Condition A is based on the assumption that at least 100% of the required post accident containment cooling capability (that assumed in the safety analyses) is available. If less than 100% of the required post containment accident cooling is available, Condition C must also be entered.

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time under conditions when a'required system can perform its required safety function, but may not be able to do so assuming an additional failure.

When operating in accordance with the Required Actions of an LCO Condition, it is not necessary to be able to cope with an additional single failure.

Palisades Nuclear Plant B 3.6.6-7 " Revise-d 07/22-/2002

Containment Cooling Systems B 3.6.6 BASES ACTIONS A.1 (continued)

The Containment Cooling systems can provide one hundred percent of the required post accident cooling capability following the occurrence of any single active failure. Therefore, the'containment cooling function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under that condition, however, the ability to provide the function after the occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

B.1 and 6.2 Condition B is applicable when the Required Actions of Condition A cannot be completed within the required Completion Time. Condition A is applicable whenever one or more trains is inoperable. Therefore, when Condition B is applicable, Condition A is also applicable. (If less than 100% of the post accident containment cooling capability is available, Condition C must be entered as well.) Being in Conditions A and B concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition B while the plant is still within the applicable conditions of the LCO.

If the inoperable containment cooling trains cannot be restored to OPERABLE status within the required Completion Time of Condition A, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1.

Condition C is applicable with one or more trains inoperable when there is less than 100% of the required post accident containment cooling capability available. Condition A is applicable whenever one or more trains is inoperable. Therefore, when this Condition is applicable, Condition A is also applicable. Being in Conditions A and C concurrently maintains both Completion Time clocks for instances where equipment repair restores 100% of the required post accident containment cooling capability while the LCO is still applicable, allowing exit from Condition C (and LCO 3.0.3).

Palisades Nuclear Plant B 3.6.6-8 Revised 07/22/2002

Containment Cooling Systems "B3.6.6 BASES ACTIONS C.1 (continued)

Several specific cases have beenanalyzed in the safety analysis to provide operating flexibility for equipment outages and testing. These analyses show that action A.1 can be entered under certain circumstances, because 100% of the post accident cooling capability is maintained. These specific cases are discussed below.

One hundred percent of the required post accident cooling capability can be provided with both MSIV bypass valves'closed if either,

1. Two containment spray pumps, two spray headers, and one CAC fan are OPERABLE, or

"- 2., One containment spray pump, two spray headers, and three safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon).

- One hundred percent of the required post accident cooling capability can be provided for operation with a MSIV bypass valve open or closed if;

1. Two containment spray pumps, two spray headers, and two safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon).

2. One containment spray pump, one spray header, and three safety related CACs are OPERABLE (at least three.service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs).

If the Containment Spray side (tube side) of one SDIC Heat Exchanger is out of service, 100% of the required post accident cooling capability can be provided, if other equipment outages are limited_7One hundred percent of the post accident cooling can be provided with the r Containment Spray side of one SDC Heat Exchanger out of service if the

-following equipment is OPERABLE: 3 safety related Containment Air Coolers, 2 Containment Spray Pumps, CCW pumps P-52A and P-52B, 2 SWS pumps, and-both CCW Heat Exchangers, and if

1. 'One CCW Containment Isolation Valve, CV-0910, CV-0911, or CV-0940, is OPERABLE, and

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are

""OPERABLE. .-

Palisades Nuclear Plant B 3.6.6-9 ** Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES ACTIONS C.1 (continued)

.With less than 100% of the required post accident containment cooling capability available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation. This SR also does not apply to valves that are locked, sealed, or otherwise secured in position since these were veified to be in the correct positions prior to being secured.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned, are in the correct position.

SR 3.6.6.2 Operating each safety related Containment Air Cooler fan unit for

Ž 15 minutes ensures that all trains are OPERABLE and are functioning properly. The 31 day Frequency was developed considering the known reliability of the fan units, the two train redundancy available, and the low probability of a significant degradation of the containment cooling train occurring between surveillances.

SR 3.6.6.3 Verifying the containment spray header is full of water to the 735 ft elevation minimizes the time required to fill the header. This ensures that spray flow will be admitted to the containment atmosphere within the time frame assumed in the containment analysis. The 31day Frequency is based on the static nature of the fill header and the low probability of a significant degradation of the water level in the piping occurring between surveillances.

SR 3.6.6.4 Verifying a total service water flow rate of > 4800 gpm to CACs VHX-1, VHX-2, and VHX-3, when aligned for accident conditions, provides assurance the design flow rate assumed in the safety analyses will be achieved (Ref. 8). Also considered in selecting this Frequency were the Palisades Nuclear Plant B 3.6.6-10 Revised 07/22/2002

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 (continued)

REQUIREMENTS known reliability of the 'cooling water system, the two train redundancy,

-and the low probability of a significant degradatioh of flow occurring between surveillances.

SR 3.6.6.5 Verifying that each'containment spray pump's developed head at the flow "testpoint is greater than or equal to the required developed head ensures that spray pump performance has not -degraded during the cycle. Flow t" .and differential pressure are normal tests of centrifugal pump performance'required by Section Xl of the ASME Code (Ref. 5).

Since the containment'spray pumps cannot be tested with flow through the spray headers, they-are tested on recirculation flow. This test .. ......

confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component .

OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.6 and SR 3.6.6.7 SR 3.6.6.6 verifies each automatic containment spray valve actuates to its correct position upon receipt of an'actual'or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

SR 3.6.6.7 verifies each containment spray pump starts automatically on an actual or simulated actuation signal. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage ^and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

Operating experience has sh6wn that these corh'ponents usually pass the Surveillances when performed at the 18 month Frequency. Therefore, the Frequency was concludedto be acceptable from a reliability standpoint.' -

-Where the surveillance'of containment sump isolation valves is also required by SR 3.5.2.5, a single surveillance may be used to satisfy both requirements.

SR 3.6.6.8 This SR verifies each containment cooling fan actuates upon receipt of an actual or simulated actuation signal. The 18 month Frequency is Palisades Nuclear Plant B 3.6b.6-1 1 Revisedl 07/22/2002

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.8 (continued)

REQUIREMENTS based on engineering judgement and has been shown to be acceptable through operating experience. See SR 3.6.6.6 and SR 3.6.6.7, above, for further discussion of the basis for the 18 month Frequency.

SR 3.6.6.9 With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Due to the passive design of the nozzle, a test at 10 year intervals is considered adequate to detect obstruction of the spray nozzles.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.18

3. FSAR, Sections 6.2

4. FSAR, Section 6.3

5. ASME, Boiler and Pressure Vessel Code,Section XI

6. FSAR, Table 14.18.1-3

7. FSAR, Table 14.18.2-1

8. FSAR, Table 9-1

9. EA-MSLB-2001-01 Rev. 1, Containment Response to a MSLB Using CONTEMPT-LT128, January 2002.

10. EA-LOCA-2001-01 Rev. 1, Containment Response to a LOCA Using CONTEMPT-LT/28, January 2002.

Palisades Nuclear Plant B 3.6.6-12 Revised 07/22/2002

CCW System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Component Cooling Water,(CCW) System BASES -

BACKGROUND The CCW System provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis

,. Accident (DBA) or transient. During normal operation, the CCW System also provides this function for various nonessential components, as well as the spent fuel pool. The CCW System serves as a barrier to the release of radioactive byproducts between potentially radioactive systems "andthe Service Water System (SWS), and thus to the environment.

The isolation of the CCW to componentsor systems may render those components inoperable but does not affect the OPERABILITY of the CCW System.

The CCW System consists of three pumps'connected in parallel to common suction and discharge headers. The discharge header splits into two parallel heat exchangers and thencombines again into a common distribution header which supplies various heat loads. A common surge tank provides the necessary net positive suction head for the CCW pumps and a surge volume for the system. A train of CCW is considered to be that equipment electrically connected to a common safety bus necessary to transfer heat acquired from the various heat loads to the SWS. There are two CCW trains, each associated with a Safeguards Electrical Distribution Train which are described in Specification 3.8.9, "Distribution Systems - Operating."

1. The CCW train associated with the Left Safeguards Electrical Distribution Train consists of one CCW pump (P-52A), CCW heat exchanger E-54B, the CCW surge tank (T-3), associated piping, CCW control valves receiving an actuation signal from the left Atrain (eg: CV-091 1, CV-0938, & CV-0946), and controls for that equipment to perform their safety function.

2. -The CCW traini'associated with the Right Safeguards Electrical Distribution Train consists of one CCW pump (P-52B), CCW heat exchanger E-54A, the CCW surge tank (T-3), associated piping, CCW control valves receiving an actuation signal from the right train (eg. CV-0937, CV-0940,' & CV-0945), and controls for that "equipmentto perform their safety function.I Palisades Nuclear Plant 13 3J'.7-1' SRevised 07/22/2002

CCW System B 3.7.7 BASES BACKGROUND 3. The CCW system piping, CCW surge tank (T-3), CCW (continued) control valves which receive actuation signals from both right and left trains (eg. CV-0910, CV-0913, CV-0944, CV-0944A, CV-0950, &

CV-0977B), and controls for that equipment to perform their safety

- function.

CCW system components receive three automatic actuation signals, a Safety Injection Signal (SIS), a Recirculation Actuation Signal (RAS), or a Containment High Pressure (CHP) signal:

1. SIS starts the CCW pumps, isolates non-essential CCW loads outside the containment, opens the CCW inlet valves to the Shutdown Heat Exchangers (SDHXs), and sends an open signal to the engineered safeguards pump cooler CCW inlet valves (which are normally open).

2. RAS sends an open signal to the CCW heat exchanger CCW inlet valves (which are normally open).

3. CHP isolates the CCW loads inside the containment.

The CCW System cools three groups of loads which are described in the FSAR (Ref. 1). The major loads are:

1. Safety related loads outside the containment, Shutdown Cooling Heat Exchangers Engineered Safeguards Pump Coolers

2. Non-safety related loads outside the Containment, and Spent Fuel Cooling Heat Exchangers Waste Gas Compressors Rad Waste Evaporators

3. Non-safety related loads inside the Containment.

Letdown Heat Exchanger Shield Cooling Heat Exchangers Primary Coolant Pump Leakoff and Oil Coolers CRDM Seal Coolers Each of these groups of loads can be cooled by the flow from one CCW pump. During normal operation, when full flow is not being provided to the Shutdown Cooling and Letdown Heat Exchangers, one CCW pump can provide the required flow for all three groups of loads. Two pumps may be operated to provide additional system flow and thermal stability.

Palisades Nuclear Plant B 3.7.7-2 Revised 07/22/2002

CCW System B 3.7.7 BASES----

BACKC3ROUND During post accident conditions, with all CCW and related system (contin ued) components OPERABLE, one hundred per cent of the required CCW post" "accident cooling capability ban be provided by any one CCW pump with "sufficientflow margin to allow manually restoring CCW flow to the Spent Fuel Pool Cooling Heat Exchangers'. If CCW or related systems have components out of service, additional CCW pumps may be required to provide the required post accident cooling capability.

"_For post accident cooling; the Engineered Safety Features signals reposition several valves to maximize containment cooling and conserve CCW flow. Initially, a safety injection signal will start the CCW pumps, and open the large CCW inlet valves to the Shutdown Cooling Heat Exchangers (CCW cools the Shutdown Cooling Heat Exchangers, which cool the containment spray flow). A safety injection signal will also isolate "thenon-safety related CCW loads outside-the containment. A

-Containmernt High Pressure signal will isolate the non-safety related CCW loads inside'the corntainment.: The occurrence of these automatic actions "will provide the req-uired CCW post accident cooling capability while "limitingthe CCW flow requirement to that which ban be provided by one

'CCW pump. -..

The safety analyses assume that both CCW heat exchangers are available. To assure that both heat exchangers will be available even with a single active failure, the CCW inlet valves to the CCW heat exchangers are maintained in the full open position during plant operation.

I Additional information on the design and operation of the system, along with a list of the components served, is presented in the FSAR, Section 9.3 (Ref. 1). The principal safety related function of the CCW System is the removal of decay heat from the reactor via the Shutdown Cooling (SDC) System heat exchangers. This may utilize the SDC heat exchangers during a normal or post accident cooldown and shutdown in conjunction with the Containment Spray System during the recirculation phase following a LOCA.

Palisades Nuclear Plant B 3.7.7-3 Revised 07/22/2002

CCW System B 3.7.7 BASES APPLICABLE The design basis of the CCW System is for one CCW train in SAFETY ANALYSES conjunction with the SWS and a 100% capacity Containment Cooling System (containment spray, containment coolers, or a combination) removing core decay heat between 20 to 40 minutes after a design basis LOCA. This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA, and provides a gradual reduction in the temperature of this fluid as it is supplied to the Primary Coolant System (PCS) by the safety injection pumps. Any single CCW pump can provide one hundred percent of the required CCW post accident cooling capability if both CCW heat exchangers are available.

The CCW System is designed to perform its function with a single failure of any active component, assuming a loss of offsite power. The CCW System also functions'to cool the plant from SDC entry conditions (Tr,

< 3000 F) to MODE 5 (Tave < 2000 F) during normal and post accident operations. The time required to cool from 300OF to 200OF is a function of the number of CCW and SDC trains operating. This assumes that the maximum Lake Michigan water temperature of LCO 3.7.9, "Ultimate Heat Sink (UHS)," occurs simultaneously with the maximum heat loads on the system.

The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.7.7-4 Revised 07/22/2002

CCW System B 3.7.7 BASES LCO - The CCW trains are independent of each other to the degree that each_

has separate controls and power supplies. In the event of a DBA, one CCW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requirement is met, two CCW trains must be OPERABLE. At least one CCW train will operate assuming the worst

_single active failure occurs coincident with the loss of offsite power.

The CCW train associated with the Left Safeguards Electrical Distribution Train is considered OPERABLE when:

a.' -CCW pump P-52A is OPERABLE;

b. t CCW surge tank T-3 and other common components are OPERABLE;

c. CCW heat exchanger E-54B is. OPERABLE; and

d. - The associated piping,'valves, and instrumentation and controls required to perform the safety related function are OPERABLE.

The COW train associated with the Right Safeguards Electrical Distribution Train is considered OPERABLE when:

a. CcW pump P-52B is OPERABLE;,*

b. CCW surge tank T-3 and other common components are OPERABLE;, r -,

C. CCW heat exchanger E-54A is OPERABLE; and

d. The associated piping, valves, and instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of CCW from other components or systems not required for safety mayrender those components or systems inoperable, but does not affect the OPERABILITY of the CCW System.

Palisades Nuclear Plant B 3.7.7-5 Revised 07122/2002

CCW System B 3.7.7 BASES APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating system that must be prepared to perform its post accident safety functions, primarily PCS heat removal by cooling the SDC heat exchanger.

In MODES 5 and 6, the OPERABILITY requirements of the CCW System are determined by the systems it supports.

ACTIONS A.1 Condition A is applicable whenever one or more CCW trains is inoperable.

Action A.1 requires restoration of both trains to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the assumption that at least 100% of the required CCW post accident cooling capability (that assumed in the safety analyses) is available. (If, however, less than 100% of the CCW post accident cooling is available, Condition C must also be entered.)

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time under conditions when a required system can perform its required safety function, but'may'not be able to do so assuming an additional failure. When operating in accordance with the Required Actions of an LCO Condition, it is not necessary to be able to cope with an additional single failure.

The CCW system can provide one hundred percent of the required post accident cooling capability following the occurrence of any single active failure. Therefore, the CCW function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under that condition, however, the ability to provide the function after the occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

B.1 and B.2 Condition B is applicable when the Required Actions of Condition A cannot be completed within the required Completion Time. Condition A is applicable whenever one or more trains is inoperable. Therefore, when Condition B is applicable, Condition A is also applicable. (If less than 100% of the post accident CCW cooling capability is available, Condition C must be entered as well.) Being in Conditions A and B concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition B while the plant is still within the applicable conditions of the LCO.

Palisades Nuclear Plant B 3.7.7-6 Revised 07/22/2002

CCW System B 3.7.7 BASES ACTIONS B.1 & B.2 (continued)

If the required CCW trains cannot be-restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply.' To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

• C.1 Condition C is applicable with one or more trains inoperable when there is

. less than 100% of the required CCW post accident cooling capability available. Condition A is applicable whenever one or more trains is inoperable. Therefore, when this Condition is applicable, Condition A is also

, applicable. .Being in Conditions A and C concurrently maintains both Completion Time clocks for instances where equipment repair restores 100%

of the required CCW post accident cooling capability while the LCO is still applicable, allowing exit from Condition C (and LCO 3.0.3).

If the CCW side -(shell side) of either CCW heat exchanger is out of service, 100% of the required COW post accident cooling capability cannot be assured. If the SWS side (tube side) of either CCW heat exchanger is out of service, 100% of the required CCW post accident cooling capability can be provided, if other equipment outages are limited. One hundred percent of the post accident CCW cooling can be provided with the SWS side of one CCW heat exchanger out of service if the following equipment is

-OPERABLE: 3 safety related Containment Air Coolers, 2 Containment Spray Pumps, CCW pumps P-52A and P-52B, 2 SWS pumps, and both Shutdown Cooling Heat Exchangers, and if

.1:- One CCW Containment header valve.CV-0910, CV-0911, or CV-0940, is OPERABLE, and 2.. Two CCW isolation valves for the non-safety related loadsoutside the containment, CV-0944A and CV-0944'(or CV-0977B), are

.OPERABLE. .

One hundred percent of the required CCW post accident cooling can be provided despite the inoperability of one or more of those CCW valves closed by Safety Injection, which isolate cooling to non-essential loads, provided there-are sufficient CCW pumps available to supply the additional flow.

Palisades Nuclear Plant B83.7.7-7 -, 'Revised 07/22/2002"

CCW System B 3.7.7 BASES ACTIONS C._1 (continued)

One hundred percent of the required CCW post accident cooling capability can be provided by one CCW pump if both CCW heat exchangers are available and if:

1. One CCW Containment header valve, CV-0910, CV-0911, or CV-0940, is OPERABLE, and

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE.

One hundred percent of the required CCW post accident cooling capability can be provided by two CCW pumps if both CCW heat exchangers are available and if:

1. One CCW Containment heade" valve, CV-091 0, CV-091 1, or CV-0940, is OPERABLE, or

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE.

With less than 100% of the required CCW post accident cooling capability available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correctalignment for manual, power operated, and automatic valves in the CCW flow path provides assurance that the proper flow paths exist for CCW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct p*6sition prior to locking, sealing, or securing; This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.

This SR is modified by a Note indicating that the isolation of the CCW to components or systems may render those components inoperable but does not affect the OPERABILITY of the CCW System.

Palisades Nuclear Plant B 3.7.7-8 Revised 07/22/2002

CCW System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.1 (continued)

REQUIREMENTS The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.7.2 This SR verifies proper automatic operation of the CCW valves on an actual or simulated actuation signal. Specific signals (e.g., safety injection, RAS) are tested under Section 3.3, "Instrumentation." This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

This SR is modified by a Note which states this SR is only required to be met in MODES 1, 2, and 3. The instrumentation providing the input signal is not required in MODE 4, therefore, to keep consistency with Section 3.3, "Instrumentation," the SR is not required to be met in this MODE.

Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.7.3 This SR verifies proper automatic operation of the CCW pumps on an actual or simulated actuation signal in the "with standby power available" mode which tests the starting of the pumps by the SIS-X relays. The starting of the pumps by the sequencer is performed in Section 3.8, "Electrical Power Systems." This SR is modified by a Note which states this SR is only required to be met in MODES 1, 2, and 3. The instrumentation providing the input signal is not required in MODE 4, therefore, to keep consistency with Section 3.3, "Instrumentation," the SR is not required to be met in this MODE. Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 9.3 Palisades Nuclear Plant B 3.7.7-9 Revised 07/22/2002

SFP Boron Concentration B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Spent Fuel Pool (SFP) Boron Concentration BASES BACKGROUND As described in LCO 3.7.16, "Fuel Assembly Storage,". fuel assemblies are stored in the fuel storage racks in accordance with criteria based on initial enrichment, discharge burnup, and decay time.

The criteria were based on'the assumption that 850 ppm of soluble boron was present in the spent fuel pool. The pool is required to be maintained at a boron concentration of k 1720 ppm. Criterion 2 of 10 CFR 50.36 (c) (2) requires that criticality control be achieved without credit for soluble boron. However, in 1998 the NRC documented requirements that could be established to maintain criticality below 0.95. This is documented in "Guidance on the Regulatory Requirements for Criticality Analysis of Fuel Storage at Light-Water Reactor Power Plants", Laurence l.'Kopp, U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Reactor Systems Branch, February 1998. The precedent of taking credit for soluble boron in spent fuel pool water to provide criticality control has also been established. Soluble boron credit was used in the Westinghouse Spent Fuel Rack Criticality Analysis Methodology described in WCAP-14416-NP-A and that methodology was approved for use by an NRC Safety Evaluation dated October 25, 1996. The criteria discussed above was developed using a method that closely followed the Westinghouse methodology. Additionally the requirements specified by the NRC guidance are in place at Palisades.

APPLICABLE A fuel assembly could be inadvertently loaded into a fuel storage rack SAFETY ANALYSES location not allowed by LCO 3.7.16 (e.g., an insufficiently depleted or insufficiently decayed fuel assembly). Another type of postulated accident is associated with a fuel assembly that is dropped onto the fully loaded fuel pool storage rack. Either incident could have a positive reactivity effect, decreasing the margin to criticality. However, the negative reactivity effect of the soluble boron compensates for the increased reactivity caused by either one of the two postulated accident scenarios.

The concentration of dissolved boron in the SFP satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO The specified concentration of dissolved boron in the SFP preserves the assumptions used in the analyses of the potential accident scenarios described above. This concentration of dissolved boron is the minimum required concentration for fuel assembly storage and movement within the SFP.

APPLICABILITY This LCO applies whenever fuel assemblies are stored in the spent fuel pool.

Amendment No. .gg, 207 Plant Palisades Nuclear Plant B 3.7.15-1 B 3.7.15-1 , Amendment No. 4189, 207

I SFP Boron Concentration B 3.7.15 BASES ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, 3, or 4, the fuel movement is independent of reactor operation. Therefore, inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.

A.1. and A.2 When the concentration of boron in the spent fuel pool is less than required, immediate action must be taken to preclude an accident from happening or to mitigate the consequences of an accident in progress.

This is most efficiently achieved by immediately suspending the movement of fuel assemblies. This does not preclude the movement of fuel assemblies to a safe position. In addition, action must be immediately initiated to restore boron concentration to within limit.

I SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies that the concentration of boron in the spent fuel pool is within the required limit. As long as this SR is met, the analyzed incidents are fully addressed. The 7 day Frequency is appropriate because no major replenishment of pool water is expected to take place over a short period'of time.

REFERENCES None Palisades Nuclear Plant B 3.7.15-2 Amendment No. 1-89, 207

Spent Fuel Assembly Storage B 3.7.16 B 3.7 PLANT SYSTEMS B 3.7.16 Spent Fuel Assembly Storage BASES BACKGROUND The fuel storage facility is designed to store either new (nonirradiated) nuclear I fuel assemblies, or used (irradiated) fuel assemblies in a vertical configuration I underwater. The storage pool is sized to store 892 fuel assemblies, which includes storage for failed fuel canisters. The fuel storage racks are grouped into two regions, Region I and Region II per Figure 3.7.16-1. The racks are designed as a Seismic Category I structure able to withstand seismic events.

Region I contains racks in the spent fuel pool having a 10.25 inch center-to center spacing and a single rack in the north tilt pit having an 11.25 inch by 10.69 inch center-to-center spacing. Region II contains racks in both the spent fuel pool and the north tilt pit having a 9.17 inch center-to-center spacing.

Because of the smaller spacing and poison concentration, Region II racks have

- more limitations for fuel storage than Region I racks. Further information on these limitations can be found in Section 4.0, "Design Features." These limitations (e.g., enrichment, bumup) are sufficient to maintain a kItr of < 0.95 for fuel of original enrichlment of up to 4.95% for Region I, and 4.6% for Region 11.-

APPLICABLE The fuel storage facility was originally designed for I SAFETY ANALYSES noncriticality by use of adequate spacing, and "flux trap" construction whereby the fuel assemblies are inserted into neutron absorbing stainless steel cans.

The current criticality calculations also take credit for soluble boron to prevent criticality.

The spent fuel assembly storage meets the'requirements specified in

"=Guidanceon the Regulatory Requirements for Criticality Analysis of Fuel Storage at Light-Water Reactor Power Plants', Laurence 1. Kopp, U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Reactor -,

Systems Branch, February 1998. This document established the requirements for use of soluble boron to maintain k* below 0.95.

The spent fuel assembly storage satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO The restrictions on the placement of fuel assemblies within the spent fuel pool, according to Table 3.7.16-1, in the accompanying LCO, ensures that the kI of the spent fuel pool will always remain < 0.95 assuming the pool to be flooded with water, borated to 850 ppm. The restrictions are consistent with the I criticality safety analysis performed for the spent fuel pool according to Table 3.7.16-1, in the accompanying LCO. Fuel assemblies not meeting the criteria of Table 3.7.16-1 shall be stored in accordance with Specification 4.3.1.1.

APPLICABILITY This LCO applies whenever any fuel assembly is stored in Region 11of either the spent fuel pool or the north tilt pit.

Palisades Nuclear Plant B 3.7.16-1 Amendment No.-1-89, 207

Spent Fuel Assembly Storage B 3.7.16 BASES ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. I If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not specify any'action: If moving irradiated fuel assemblies while in MODE 1, 2. 3, or 4, the fuel movement is independent of reactor operati6n. Therefore, in either case, inability to move fuel assemblies is not sufficient reason to require a reactor shutdown.

I When the configuration of fuel assemblies stored in Region IIthe spent fuel pool is not in accordance with Table 3.7.16-1, immediate action must be taken to make the necessary fuel assembly movement(s) to bring the configuration into compliance with Table 3.7.16-1.

SURVEILLANCE SR 3.7.16.1 REQUIREMENTS This SR verifies by administrative means that the combination of initial enrichment, bumup and decay time of the fuel assembly is in accordance with Table 3.7.16-1 in tlhe accompanying LCO prior to placing the fuel assembly in a Region II storage location.

I REFERENCES None Palisades Nuclear Plant B 3.7.16-2 Amendment No. U89, 207

Spent Fuel Assembly Storage B 3.7.16 BASES 465.00' Ref.

BASES Region 11 Region 11 I1 x 11 11x 11 W-I W-2 176.00' N Region Ref. Existing NUS Racks/

1c 2c 3c 4c, 5c 6c Region II Region 1I 7 x 11 7 x 11 W-3 W-4

-1 -

MAIN POOL Figure B 3.7.16-1 (page 1 of 1)

Spent Fuel Pool Arrangement I Palisades Nuclear Plant B83.7.16-3 Amendment No. 49, 207

Secondary Specific Activity B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Primary Coolant System (PCS). Under steady state conditions, the activity is primarily lodines with relatively short half lives,

'and thus is indication of current conditions. During transients, 1-131 spikes have been observed as well as increased releases of some noble gases. Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation

- ' minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.

-This limit is lower than the activity value that might be expected from a 0.3 gpm tube leak of primary coolant at the limit of 1.0 PCi/gm as assumed in the safety analyses with exception of the control rod ejection analysis which assumes 0.3 gpm, Which' is-the same as LCO 3.4.13, "PCS Operational LEAKAGE." The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and primary coolant LEAKAGE. Most of the iodine isotopes have short half lives (i.e., < 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />).

Operating a plant at the allowable limits Would result in a 2-hour Exclusion Area Boundary (EAB) exposure well within the 10 CFR 100 (Ref. 1) limits.

of APPLICABLE The accident analysis of the Main Steam Line'Break (MSLB), outside (Ref. 2) assumes SAFETY ANALYSES containment as discussed in the FSAR, Chapter 14.14 isotope the initial secondary coolant specific activity to have a radioactive concentration of 0.10 jC:Vgm DOSE EQUIVALENT 1-131. This assumption ii used in the analysis for detenrmining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB are well within the plant EAB limits (Ref. 1) for whole body and thyroid dose rates.

B 3.7.17-1 Revised 07/22/2002 Palisades Nuclear Plant

Secondary Specific Activity B 3.7.17 BASES APPLICABLE With the loss of offsite power, the remaining steam generator is SAFETY ANALYSES available for core decay heat dissipation by venting steam to the (continued) atmosphere through Main Steam Safety Valves (MSSVs) and Atmospheric Dump Valves (ADVs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generator. Venting continues until the primary coolant temperature and pressure have decreased sufficiently for the Shutdown Cooling System to complete the cooldown.

In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through MSSVs and ADVs during the event.

Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).

LCO As indicated in the Applicable Safety Analyses, the specific activity limit in the secondary coolant system of

• 0.10 gtCVgm DOSE EQUIVALENT 1-131 limits the radiological consequences of a Design Basis Accident (DBA) to well within the required limit (Ref. 1).

Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the plant in an operational MODE that would minimize the radiological consequences of a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators-are not being used for heat removal.* Both the PCS and steam generators are at low pressure or depressurized, and primary to secondary LEAKAGE is minimal.

Therefore, monitoring of secondary specific activity is not required.

Palisades Nuclear Plant B 3.7.17-2 Revised 07/22/2002

Secondary Specific Activity B 3.7.17 BASES ACTIONS A.1 and A.2 DOSE EQUIVALENT 1-131 exceeding the allowable value in the secondary coolant is an indication of a problem in the PCS and contributes to increased post accident doses. Ifsecondary specific activity cannot be restored to within limits in the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.17.1 REQUIREMENTS This SR ensures that the secondary specific activity is within the limits of the accident analysis. A gamma isotope analysis of the secondary coolant, which determines DOSE EQUIVALENT 1-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in primary coolant activity or LEAKAGE. The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT 1-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.

REFERENCES 1. 10 CFR 100.11

2. FSAR, Section 14.14 B 3.7.17-3 Revised 07/22/2002 Palisades Nuclear Plant

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 3.8 ELECTRICAL POWER SYSTEMS B 3.8.3 Diesel Fuel, Lube Oil, and Starting Air' BASES BACKGROUND The Diesel Generators (DGs) are provided with a storage tank having a required fuel oil inventory sufficient to operate one diesel for a period of

_7 days, while the DG is supplying maximum post-accident loads. This onsite fuel oil capacity is sufficient to operate the DG for longer than the time to replenish the onsite supply from offsite sources.

Fuel oil is transferred from the Fuel Oil Storage Tank to either day tank by either of two Fuel Transfer Systems. The fuel oil transfer system which includes fuel transfer pump P-18A can be powered by offsite power, or by either DG. However, the fuel oil transfer system which includes fuel transfer pump P-18B can only be powered by offsite power, or by DG 1-1.

For proper operation of the standby DGs, it is necessary to ensure the proper quality of the fuel oil., Regulatory Guide (RG) 1.137 (Ref. 1) addresses the recommended fuel oil practices as supplemented by ANSI N195-1976 (Ref. 2).

The 6G lubrication system is designed to provide sufficient lubrication to permit proper operation of its associated DG under all loading conditions. The system is required to circulate the lube oil to the diesel engine working surfaces and to remove excess heat generated by friction during operation. The onsite storage in addition to the engine oil sump is sufficient to ensure 7 days of continuous operation. This supply is sufficient supply to allow the operator to replenish lube oil from offsite sources. Implicit in this LCO is the requirement to assure, though not necessarily by testing, the capability to transfer the lube oil from its storage location to the DG oil sump, While the DG is running.

Each DG is provided with an associated starting air subsystem to assure independent start capability. The starting air system is required to have a minimum capacity with margin for a DG start attempt without recharging the'air start receivers.

Palisades Nuclear Plant B 3.8.3 Revised 07/22/2002

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BAS ES APPLICABLE A description of the Safety Analyses applicable in MODES 1, 2, 3, and SAFETY ANALYSES 4 is provided in the Bases for LCO 3.8.1, "AC Sources - Operating";

during MODES 5 and 6, in the Bases for LCO 3.8.2, "AC Sources Shutdown." Since diesel fuel, lube oil, and starting air subsystems support the operation of the standby AC power sources, they satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full accident load, operation. It is also required to meet specific standards for quality. The specified 7 day requirement and the 6 day quantity listed in Condition A are taken from the Engineering Analysis associated with Event Report E-PAL-93-026B. Additionally, the ability to transfer fuel oil from the storage tank to each day tank is required from each of the two transfer pumps.

Additionally, sufficient lube oil supply must be available to ensure the capability to operate at full accident load for 7 days. This requirement is in addition to the lube oil contained in the engine sump. The specified 7 day requirement and the 6 day quantity listed in Condition B are based on an assumed lube oil consumption of 0.8 to 1.0% of fuel oil consumption.

The starting air subsystem must provide, without the aid of the refill compressor, sufficient air start capacity, including margin, to assure start capability for its associated DG.

These requirements, in conjunction with an ability to obtain replacement supplies within 7-days, support the'availability of the DGs. DG day tank fuel requirements are addressed in LCOs 3.8.1 and 3.8.2.

APPLICABILITY DG OPERABILITY is required by LCOs 3.8.1 and 3.8.2 to ensure the availability of the required AC power to shut down the reactor and maintain it in a safe shutdown condition following a loss of off-site power. Since diesel fuel, lube oil, and starting air support LCOs 3.8.1 and 3.8.2, stored diesel fuel oil, lube oil, and starting air are required to be within limits, and the fuel transfer system is required to be OPERABLE, when either DG is required to be OPERABLE.

Palisades Nuclear Plant B 3.8.3-2 Revised 07/22/2002

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS A.1 "Inthis Condition, the'available DG fuel oil supply is less than the "required7 day supply, but enough for at least 6 days. This condition allows sufficient time to obtain additional fuel and to perform the sampling and analyses required prior to addition of fuel oil to the tank.

A period of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is considered sufficient to complete restoration of the required inventory prior to declaring the DGs inoperable.

B.1 In this Condition, the available DG lube oil supply in storage is less than the required 7 day supply, but enough for at least 6 days. This condition allows sufficient time to obtain additional lube oil. A period of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is considered sufficient to complete restoration of the required inventory prior to declaring the DGs inroperable.

C.1, D.1, and E.1 Since DG 1-2 cannot power'fuel transfer pump P-18B, without P-18A, DG 1-2 becomes dependant on offsite power or DG 1-1 for its fuel supply (beyo nd the 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> itwill operate on the day tank), and does not meet the requirement for independence. Since the condition is not as severe as the DG itself being inoperable, 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> is allowed to restore the fuel transfer system to operable status prior to declaring the DG inoperable.

Without P-18B, either DG can still provide power to the remaining fuel transfer system. Therefore, neither DG is directly affected. Continued operation with a single remaining fuel transfer'system, however, must be limited since an additional single'active failure- (P-1 8A) could disable the onsite power system. Because the loss of P-18B is less severe than the loss of one DG, a 7 day Completion Time is allowed.

If both fuel transfer systems are inoperable, the onsite AC sources are limited to about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> duration. Since this condition is not as severe as both DGs being inoperable, 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is allowed to restore one fuel transfer pump to OPERABLE status.

Revised 07/22/2002 Palisades Nuclear Plant B 3.8.3-3

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS F. 1 (continued)

With the stored fuel oil properties, other than viscosity, and water and sediment, defined in the Fuel Oil Testing Program not within the required limits, but acceptable for short term DG operation, a period of 30 days is allowed for restoring the stored fuel oil properties. The most likely cause of stored fuel oil becoming out of limits is the addition of new fuel oil with properties that do not meet all of the limits. This 30 day period provides sufficient time to determine if new fuel oil, when mixed with stored fuel oil, will produce an acceptable mixture, or if other methods to restore the stored fuel oil properties are required. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.

G.1 With a Required Action and associated Completion Time not met, or with diesel fuel oil, lube oil, or starting air subsystem not within limits for reasons other than addressed by Condition's A, B, or F, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

In the event that diesel fuel oil with viscosity, or water and sediment is out of limits, this would be unacceptable for even short term DG operation. Viscosity is important primarily because of its effect on the handling of the fuel by the pump and injector&system; water and sediment provides an indication of fuel contamination. When the fuel oil stored in the Fuel Oil Storage Tank is determined to be out of viscosity, or water and sediment limits, the DGs must be declared inoperable, immediately.

Palisades Nuclear Plant B 3.8.3-4 Revised 07/22/2002

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel Soil in the storage tank to support either DG's operation for 7 days at full post-accident load. The 7 day period is sufficient time to place the plant in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Frequency is specified to ensure that a sufficient supply of fuel oil is available, since'the Fuel Oil Storage Tank is the fuel oil supply for the diesel fire pumps, heating and evaporator boilers, in addition to the DGs.

SR 3.8.3.2 This Surveillance ensures that sufficient stored lube oil inventory is available to support at least 7 days of full accident load operation for one DG. The 200 gallons requirement is based on an estimated consumption of 0.8 to 1.0% of fuel oil consumption.

A 31 day Frequency is adequate to ensure that a sufficient lube oil supply is onsite, since DG starts and run times are closely monitored by the plant staff.

SR 3.8.3.3 The tests listed below are a means of determining whether new fuel oil and stored fuel oil are of the appropriate grade and have not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion.

Testing for viscosity, specific gravity, and Water and sediment is completed for fuel oil delivered to the plant prior to its being added to the Fuel Oil Storage Tank: Fuel oil which fails the test, but has not been added to the Fuel Oil Storage Tank does not imply failure of this SR and requires no specific action. If results from 'these tests are within acceptable limits, the fuel oil may be added to the storage tank without concern for contaminating the entire volume of fuel oil in the storage tank.

B 3.8.3-5 Revised 07/22/2002 Palisades Nuclear Plant

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS Fuel oil is tested for other of the parameters specified in ASTM D975 (Ref. 3) in accordance with the Fuel Oil Testing Program required by Specification 5.5.11. Fuel oil determined to have one or more measured parameters, other than viscosity or water and sediment, outside acceptable limits will be evaluated for its effect on DG operation.

Fuel oil which is determined to be acceptable for short term DG operation, but outside limits will be restored to within limits in accordance with LCO 3.8.3 Condition F.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The pressure specified in this SR is intended to reflect the acceptable margin from which successful starts can be accomplished.

The 31 day Frequency takes into account the capacity, capability, redundancy, and diversity of the AC sources and other indications available in the control room, including alarms, to alert the operator to below normal air start pressure.

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the Fuel Oil Storage Tank once every 92 days eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it reduces the potential for water entrainment in the fuel oil during DG operation.

Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequencies and acceptance criteria are established in the Fuel Oil Testing Program based, in part, on those recommended by RG 1.137 (Ref. 1). This SR is for preventative maintenance.

Palisades Nuclear Plant B 3.8.3-6 Revised 07/22/2002

Diesel Fuel, Lube Oil, and Starting Air B 3.8.3 BAS ES SURVEILLANCE SR 3.8.3.5 (continued)

REQUIREMENTS The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed in accordance with the requirements of the Fuel Oil Testing Program.

SR 3.8.3.6 This SR demonstrates that each fuel transfer pump and the fuel transfer system controls operate and control transfer of fuel from the Fuel Oil Storage Tank to each day tank and engine mounted tank. This is required to support continuous operation of standby power sources.

This SR provides assurance that the following portions of the fuel transfer system is OPERABLE:

a. Fuel Transfer Pumps;

b. Day and engine mounted tank filling solenoid valves; and

c. Day and engine mounted tank automatic level controls.

The 92 day Frequency corresponds to the testing requirements for pumps in the ASME Code, Section Xl (Ref. 4). Additional assurance of fuel transfer system OPERABILITY is provided during the monthly starting and loading tests for each DG when the fuel oil system will function to maintain level in the day and engine mounted tanks.

REFERENCES 1. Regulatory Guide 1.137

2. ANSI N195-1976, Appendix B

3. ASTM Standards, D975, Table 1

4. ASME, Boiler and Pressure Vessel Code, Section Xl Palisades Nuclear Plant B 3.8.3-7 Revised 07/22/2002

SDC and Coolant Circulation - High Water Level B 3.9.4 B 3.9 REFUELING OPERATIONS B 3.9.4 Shutdown Cooling (SDC) and Coolant Circulation - High Water Level BASES BACKGROUND The purposes of the SDC System in MODE 6 are to remove decay heat and sensible heat from the Primary Coolant System (PCS) as required by the Palisade Nuclear Plant design, to provide mixing of borated coolant, to provide sufficient coolant circulation to minimize the effects of a boron dilution accident, and to prevent boron stratification (Ref. 1). Heat is removed from the PCS by circulating primary coolant through the SDC heat exchanger(s), where the heat is traniferred to the Component Cooling Water System. The coolant is then returned to the PCS via the PCS cold leg(s). Operation'of the SDC System for normal cooldown or decay heat removal is manually accomplished from the control room.

The heat removal'rate is adjusted by controlling the flow of primary coolant through the SDC heat exchanger(s). Mixing of the primary coolant is maintained by this continuous circulation of primary coolant through the SDC System.

APPLICABLE If the primary coolant temperature is not maintained below 200°F, SAFETY ANALYSES boiling of the primary coolant could result. This could lead to inadequate cooling of the reactor fuel due to the resulting loss of coolant in the reactor vessel.. Additionally, boiling of the primarycoolant could lead to a reduction in boron concentration in the coolant due to the boron plating out on components near the areas of the boiling activity, and because of the possible addition of water to the reactor vessel with a lower boron concentration than is required to keep the' reactorf subcritical.

"Theloss of primary coolant and the reduction of boron concentration in the primary coolant would eventually challenge the integrity of the fuel

" cladding, which is a fission product barrier. Orne'train of the SDC System is "required to be inoperation in MODE 6, with the refueling cavity water level greater than or equal to the 647 ft elevation, to prevent this challenge. The LCO allows the rem0Aoal of an SDC train from operation for short durations under the condition that the boron concentration of the primary coolant is not reduced.

This 'conditional allowance does not result in a challenge to the fission product barrier.

SDC and Coolant Circulat~i6n'-'High Water Level satisfies Criterion 4 of 10 CFR50.36(c)(2).

Palisades Nuclear Plant B 3.9.4-1 Revised 07/22/2002

SDC and Coolant Circulation - High Water Level B 3.9.4 BASES LCO Only one SDC train is required for decay heat removal in MODE 6, with the refueling cavity water level greater than or equal to the 647 ft elevation. Only one SDC train is required because the volume of water above the reactor vessel flange provides backup decay heat removal capability. At least one SDC train must be OPERABLE and in operation to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of a criticality; and

c. Indication of reactor coolant temperature.

An OPERABLE SDC train consists of an SDC pump, a heat exchanger, valves, piping, instruments, and controls to ensure an OPERABLE flow path and to determine the PCS temperature. The flow path starts in the Loop 2 PCS hot leg and is returned to.at least one PCS cold leg.

A SDC train may be considered OPERABLE (but not necessarily in operation) during re-alignment to, and when it is re-aligned for, LPSI service or for testing, if it is capable of being (locally or remotely) realigned to the SDC mode of operation and is not otherwise inoperable.

Since SDC is a manually initiated system, it need not be considered inoperable solely because some additional manual valve realignments must be made in addition to the normal initiation actions. Because of the dual functions of the components that comprise the LPSI and shutdown cooling systems, the LPSI alignment may, be preferred.

The LCO is modified by two Notes. Note I allows the required operating SDC train to not be in operation for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in each 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period, provided no operations are permitted that would cause a reduction of the PCS boron concentration. Boron concentration reduction is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, and PCS to SDC isolation valve testing.

During this 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> period, decay heat is removed by natural circulation to the large mass of water in the refueling cavity. Note 2 allows the required SDC train to be made inoperable for

• 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period for testing and maintenance provided one SDC train in operation providing flow through the reactor core, and the core outlet temperature is < 200°F.

The purpose of this Note is to allow the heat flow path from the SDC heat exchanger to be temporarily intem'pted for maintenance or testing on the Component Cooling Water or Service Water Systems.

Palisades Nuclear Plant B 3.9.4-2 Revised 07/22/2002

"SDCand Coolant Circulation - High Water Level B 3.9.4 BASES LCO During this 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period, the core outlet temperature must be (continued) maintained < 2000 F. Requiring one SDC train to be in operation ensures adequate mixing of the borated coolant.

APPLICABILITY One SDC train must be1OPERABLE and in operation in MODE 6, with the refueling cavity'water level greater than'or equal to 647 ft elevation, to provide decay heat removal. The 647 ft elevation was selected because it corresponds to the elevation requirement established for fuel movement in LCO 3.9.6, "Refueling Cavity Water Level." Requirements for the SDC System in other MODES are'covered by LCOs in Section 3.4, "Primary Coolant System (PCS)." SDC train requirements in MODE 6, with the refueling cavity water level less than the 647 ft elevation are located in LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS SDC train requirements are met by'having one SDC train OPERABLE and in operation, except as permitted in the Note to the LCO.

"A.__

If one required SDC train is inoperable or not in operation, actions shall be immediately initiated and continued until the SDC train is restored to OPERABLE status and to operation. An immediate Completion Time is necessary for an operator to initiate corrective actions.

A.2 If SDC train requirements are not met, there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations can occur through the addition of water with a lower boron concentration than that contained in the PCS. Therefore, actions that reduce boron concentration shall be suspended immediately.

Palisades Nuclear Plant B 3.9.4-3 `- Revised 07/22/2002

SDC and Coolant Circulation, - Higlh Water Level B 3.9.4 BASES ACTIONS A.3 (continued)

If SDC train requirements are not met, actions sliall be taken immediately to suspend loading irradiated fuel assemblies in the core. With no forced circulation cooling, decay heat removal from the core occurs by natural circulation to the heat sink provided by the water above the core. A minimum refueling cavity water level equivalent to the 647 ft elevation provides an adequate available heat sink.' Suspending any operation that would increase the'decay heat load, such as loading a fuel assembly, is a prudent action under this condition.

A.4 If SDC train requirements are not met, all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed to prevent fission products, if released by a loss of decay heat removal event, fronm escaping to the environment. The' 4 houtr Completion Time is based on the low probability of the coolant boiling in that time and allows time for fixing most SDC problems.

SURVEILLANCE SRR 3.9.4.1 REQUIREMENTS This Surveillance demonstrates that the SDC train is in operation and circulating primary coolant. The flow rate is sufficient to provide decay heat removal capability and to prevent thermal and boron stratification in the core. The 1000 gpm flow rate has been determined by operating experience rather than analysis. The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is sufficient, considering the flow, temperature, pump control, and alarm indications available to the operator in the control room for monitoring the SDC System.

REFERENCES 1. FSAR, Sections 6.1 and 14.3 Palisades Nuclear Plant B 3.9.4-4 Revised 07/22/2002