Text

Technical Specifications Bases Revision 21 Update
	ML030520063
Person / Time
Site:	Palo Verde
Issue date:	02/07/2003
From:	Bauer S; Arizona Public Service Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	102-04887-SAB/TNW/DWG
	Download: ML030520063 (71)
	v • d • e

ii Scott A. Bauer Department Leader Technical Specification 5.5.14 Regulatory Affairs Tel 623/393-5978 Mail Station 7636 Palo Verde Nuclear Fax 6231393-5442 P 0 Box 52034 Generating Station e-mail sbauer@apsc corn Phoenix, AZ 85072-2034 102-04887-SAB/TNW/DWG February 7, 2003 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Station P1-37 Washington, DC 20555-0001

Dear Sirs:

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2, and 3 Docket Nos. STN 50-528/529/530 Technical Specifications Bases Revision 21 Update Pursuant to PVNGS Technical Specification (TS) 5.5.14, "Technical Specifications Bases Control Program," Arizona Public Service Company (APS) is submitting changes to the TS Bases incorporated into Revision 21, implemented on January 31, 2003. The Revision 21 insertion instructions and replacement pages are provided in the Enclosure.

No commitments are being made to the NRC by this letter.

Should you have any questions, please contact Thomas N. Weber at (623) 393-5764.

Sincerely, SAB/TNW/DWG/kg

Enclosure:

PVNGS Technical Specification Bases Revision 21 Insertion Instructions and Replacement Pages cc: E. W. Merschoff J. N. Donohew N. L. Salgado A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

Comanche Peak

Diablo Canyon

Palo Verde 0 South Texas Pro3ect

Wolf Creek

ENCLOSURE PVNGS Technical Specification Bases Revision 21 Insertion Instructions and Replacement Pages

Remove Page: Insert New Page:

Cover page Cover page List of Effective Pages, List of Effective Pages, Pages 1/2 through Pages 1/2 through List of Effective Pages, List of Effective Pages, Page 7/blank Page 7/blank B 2.1.1-3/B 2.1.1-4 B 2.1.1-3/B 2.1.1-4 B 2.1.1-5/blank B 2.1.1-5/blank B 3.3.1-5/B 3.3.1-6 B 3.3.1-5/B 3.3.1-6 B 3.3.1-7/B 3.3.1-8 B 3.3.1-7/B 3.3.1-8 B 3.3.1-11/B 3.3.1-12 B 3.3.1-11/B 3.3.1-12 B 3.3.1-17/B 3.3.1-18 B 3.3.1-17/B 3.3.1-18 through through B 3.3.1-43/blank B 3.3.1-43/B 3.3.1-44 B 3.3.9-3/B 3.3.9-4 B 3.3.9-3/B 3.3.9-4 B 3.7.11-3/B 3.7.11-4 B 3.7.11-3/B 3.7.11-4 B 3.7.12-1/B 3.7.12-2 B 3.7.12-1/B 3.7.12-2 B 3.7.12-3/B 3.7.12-4 B 3.7.12-3/B 3.7.12-4 B 3.7.14-1/B 3.7.14-2 B 3.7.14-1/B 3.7.14-2 B 3.7.14-3/blank B 3.7.14-3/blank B 3.8.2-3/B 3.8.2-4 B 3.8.2-3/B 3.8.2-4 B 3.8.2-5/B 3.8.2-6 B 3.8.2-5/B 3.8.2-6 B 3.8.5-3/B 3.8.5-4 B 3.8.5-3/B 3.8.5-4 B 3.8.8-3/B 3.8.8-4 B 3.8.8-3/B 3.8.8-4 B 3.8.10-1/B 3.8.10-2 B 3.8.10-1/B 3.8.10-2

PVNGS Palo Verde Nuclear GeneratingStation Units 1, 2, and 3 Technical Specification Bases Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 2.1.1-1 0 B 3.1.4-5 0 B 2.1.1-2 0 B 3.1.5-1 0 B 2.1.1-3 21 B 3.1.5-2 12 B 2.1.1-4 21 B 3.1.5-3 0 B 2.1.1-5 21 B 3.1.5-4 0 B 2.1.2-1 0 B 3.1.5-5 7 B 2.1.2-2 0 B 3.1.5-6 0 B 2.1.2-3 0 B 3.1.5-7 1 B 2.1.2-4 0 B 3.1.5-8 1 B 2.1.2-5 0 B 3.1.5-9 0 B 3.0-1 0 B 3.1.5-10 5 B 3.0-2 0 B 3.1.5-11 12 B 3.0-3 0 B 3.1.6-1 0 B 3.0-4 0 B 3.1.6-2 0 B 3.0-5 0 B 3.1.6-3 0 B 3.0-6 1 B 3.1.6-4 0 B 3.0-7 0 B 3.1.7-1 0 B 3.0-8 0 B 3.1.7-2 0 B 3.0-9 0 B 3.1.7-3 0 B 3.0-10 14 B 3.1.7-4 0 B 3.0-11 14 B 3.1.7-5 0 B 3.0-12 14 B 3.1.7-6 0 B 3.0-13 0 B 3.1.7-7 0 B 3.0-14 0 B 3.1.7-8 0 B 3.0-15 0 B 3.1.7-9 0 B 3.0-16 17 B 3.1.8-1 0 B 3.0-17 17 B 3.1.8-2 0 B 3.0-18 17 B 3.1.8-3 0 B 3.0-19 17 B 3.1.8-4 0 B 3.1.1-1 0 B 3.1.8-5 0 B 3.1.1-2 0 B 3.1.9-1 0 B 3.1.1-3 12 B 3.1.9-2 0 B 3.1.1-4 12 B 3.1.9-3 0 B 3.1.1-5 12 B 3.1.9-4 0 B 3.1.1-6 0 B 3.1.9-5 7 B 3.1.2-1 0 B 3.1.9-6 1 B 3.1.2-2 0 B 3.1.10-1 0 B 3.1.2-3 5 B 3.1.10-2 0 B 3.1.2-4 12 B 3.1.10-3 0 B 3.1.2-5 0 B 3.1.10-4 0 B 3.1.2-6 0 B 3.1.10-5 0 B 3.1.2-7 12 B 3.1.10-6 0 B 3.1.2-8 0 B 3.1.11-1 0 B 3.1.2-9 0 B 3.1.11-2 0 B 3.1.3-1 0 B 3.1.11-3 0 B 3.1.3-2 0 B 3.1.11-4 0 B 3.1.3-3 0 B 3.1.11-5 0 B 3.1.3-4 0 B 3.2.1-1 0 B 3.1.3-5 0 B 3.2.1-2 10 B 3.1.3-6 0 B 3.2.1-3 0 B 3.1.4-1 0 B 3.2.1-4 0 B 3.1.4-2 0 B 3.2.1-5 0 B 3.1.4-3 0 B 3.2.1-6 0 B 3.1.4-4 0 B 3.2.1-7 0 PALO VERDE UNITS 1, 2, AND 3 1 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

3.2.1-8 0 3.3 .1-21 21 3.2.2-1 0 3.3 .1-22 21 3.2.2-2 10 3.3 .1-23 21 3.2.2-3 0 3.3.1-24 21 3.2.2-4 0 3.3.1-25 21 3.2.2-5 1 3.3.1-26 21 3.2.2-6 0 3.3.1-27 21 3.2.2-7 0 3.3.1-28 21 3.2.3-1 0 3.3.1-29 21 3.2.3-2 10 3.3.1-30 21 3.2.3-3 0 3.3.1-31 21 3.2.3-4 0 3.3.1-32 21 3.2.3-5 0 3.3.1-33 21 3.2.3-6 0 3.3 .1-34 21 3.2.3-7 0 3.3 .1-35 21 3.2.3-8 0 3.3.1-36 21 3.2.3-9 0 3.3.1-37 21 3.2.3-10 0 3.3.1-38 21 3.2.4-1 0 3.3.1-39 21 3.2.4-2 10 3.3.1-40 21 3.2.4-3 0 3.3 .1-41 21 3.2.4-4 0 3.3 .1-42 21 3.2.4-5 0 3.3.1-43 21 3.2.4-6 0 .3.3.1-44 21 3.2.4-7 0 3.3.2-1 0 3.2.4-8 0 3.3.2-2 0 3.2.4-9 0 3.3.2-3 1 3.2.5-1 0 3.3.2-4 1 3.2.5-2 10 3.3.2-5 0 3.2.5-3 0 3.3.2-6 15 3.2.5-4 0 3.3.2-7 15 3.2.5-5 0 3.3.2-8 15 3.2.5-6 0 3.3.2-9 15 3.2.5-7 0 3.3.2-10 15 3.3.1-1 0 3.3.2-11 15 3.3.1-2 0 3.3.2-12 15 3.3.1-3 0 3.3.2-13 15 3.3.1-4 0 3.3.2-14 15 3.3.1-5 18 3.3.2-15 15 3.3.1-6 21 3.3.2-16 15 3.3.1-7 21 3.3.2-17 15 3.3.1-8 21 3.3.3-1 0 3.3.1-9 15 3.3.3-2 18 3.3.1-10 0 3.3.3-3 0 3.3.1-11 21 3.3.3-4 0 3.3.1-12 21 3.3.3-5 7 3.3.1-13 1 3.3.3-6 0 3.3.1-14 0 3.3.3-7 0 3.3.1-15 6 3.3.3-8 0 3.3 .1-16 0 3.3.3-9 0 3.3.1-17 21 3.3.3-10 0 3.3.1-18 21 3.3.3-11 0 3.3.1-19 21 3.3.4-1 0 3.3.1-20 21 3.3.4-2 0 PALO VERDE UNITS 1, 2, AND 3 2 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

3.3.4-3 0 3.3.6-13 0 3.3.4-4 0 3.3.6-14 0 3.3.4-5 0 3.3.6-15 0 3.3.4-6 0 3.3.6-16 0 3.3.4-7 0 3.3.6-17 0 3.3.4-8 0 3.3.6-18 0 3.3.4-9 0 3.3.6-19 0 3.3.4-10 0 3.3.6-20 0 3.3.4-11 0 3.3.6-21 3.3.4-12 0 3.3.6-22 3.3.4-13 0 3.3.7-1 2 3.3.4-14 0 3.3.7-2 2 3.3.4-15 0 3.3.7-3 0 3.3.5-1 0 3.3.7-4 0 3.3.5-2 0 3.3.7-5 0 3.3.5-3 0 3.3.7-6 0 3.3.5-4 0 3.3.7-7 0 3.3.5-5 0 3.3.7-8 0 3.3.5-6 0 3.3.7-9 2 3.3.5-7 0 3.3.8-1 0 3.3.5-8 0 3.3.8-2 0 3.3.5-9 0 3.3.8-3 0 3.3.5-10 0 3.3.8-4 0 3.3.5-11 0 3.3.8-5 0 3.3.5-12 1 3.3.8-6 1 3.3.5-13 0 3.3.8-7 0 3.3.5-14 0 3.3.8-8 0 3.3.5-15 0 3.3.9-1 0 3.3.5-16 0 3.3.9-2 2 3.3.5-17 0 3.3.9-3 21 3.3.5-18 0 3.3.9-4 10 3.3.5-19 0 3.3.9-5 1 3.3.5-20 1 3.3.9-6 0 3.3.5-21 0 3.3.9-7 0 3.3.5-22 0 3.3.10-1 0 3.3.5-23 0 3.3.10-2 0 3.3.5-24 0 3.3.10-3 0 3.3.5-25 0 3.3.10-4 0 3.3.5-26 0 3.3.10-5 18 3.3.5-27 10 3.3.10-6 0 3.3.5-28 10 3.3.10-7 0 3.3.5-29 10 3.3.10-8 14 3.3.6-1 0 3.3.10-9 14 3.3.6-2 0 3.3.10-10 14 3.3.6-3 0 3.3.10-11 14 3.3.6-4 0 3.3.10-12 14 3.3.6-5 0 3.3.10-13 14 3.3.6-6 0 3.3.10-14 14 3.3.6-7 0 3.3.10-15 14 3.3.6-8 0 3.3.10-16 14 3.3.6-9 0 3.3.10-17 14 3.3.6-10 0 3.3.10-18 14 3.3.6-11 0 3.3.10-19 14 3.3.6-12 0 3.3.10-20 14 PALO VERDE UNITS 1, 2, AND 3 3 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

3.3.10-21 14 3.4.9-2 0 3.3.11-1 0 3.4.9-3 1 3.3.11-2 2 3.4.9-4 0 3.3.11-3 2 3.4.9-5 0 3.3 .11-4 2 3.4.9-6 0 3.3.11-5 19 3.4.10-1 0 3.3.11-6 2 3.4.10-2 7 3.3.11-7 2 3.4.10-3 0 3.3.12-1 15 3.4.10-4 0 3.3.12-2 15 3.4.11-1 0 3.3.12-3 5 3.4.11-2 7 3.3.12-4 5 3.4.11-3 0 3.3.12-5 6 3.4.11-4 0 3.3.12-6 6 3.4.11-5 0 3.4 .1-1 10 3.4.11-6 0 3.4.1-2 7 3.4.12-1 1 3.4.1-3 0 3.4. 12-2 1 3.4.1-4 0 3.4. 12-3 0 3.4.1-5 0 3.4.12-4 0 3.4.2-1 7 3.4.12-5 0 3.4.2-2 1 3.4.13-1 0 3.4.3-1 0 3.4.13-2 0 3.4.3-2 0 3.4.13-3 1 3.4.3-3 0 3.4.13-4 0 3.4.3-4 2 3.4.13-5 0 3.4.3-5 2 3.4.13-6 0 3.4.3-6 0 3.4.13-7 2 3.4.3-7 0 3.4.13-8 2 3.4.3-8 2 3.4.13-9 0 3.4.4-1 0 3.4.13-10 2 3.4.4-2 7 3.4.14-1 0 3.4.4-3 7 3.4.14-2 2 3.4.4-4 0 3.4.14-3 2 3.4.5-1 0 3.4.14-4 7 3.4 .5-2 6 3.4.14-5 2 3.4.5-3 6 3.4.14-6 2 3.4.5-4 0 3.4.14-7 2 3.4.5-5 6 3.4.15-1 0 3.4.6-1 0 3.4.15-2 0 3.4.6-2 6 3.4.15-3 0 3.4.6-3 6 3.4.15-4 0 3.4 .6-4 6 3.4.15-5 0 3.4.6-5 6 3.4.15-6 0 3.4.7-1 0 3.4.15-7 0 3.4.7-2 6 3.4.16-1 2 3.4.7-3 6 3.4.16-2 10 3.4 .7-4 2 3.4.16-3 0 3.4.7-5 0 3.4.16-4 0 3.4.7-6 0 3.4.16-5 0 3.4.7-7 6 3.4.16-6 0 3.4.8-1 0 3.4.17-1 0 3.4.8-2 6 3.4.17-2 0 3.4.8-3 6 3.4.17-3 0 3.4.9-1 0 3.4.17-4 0 PALO VERDE UNITS 1, 2, AND 3 4 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev Page Rev No. No. No. No.

3.4.17-5 0 3.6.2-3 0 3.4.17-6 0 3.6.2-4 0 3.5.1-1 0 3.6.2-5 0 3.5.1-2 0 3.6.2-6 0 3.5.1-3 7 3.6.2-7 0 3.5.1-4 0 3.6.2-8 0 3.5.1-5 0 3.6.3-1 0 3.5.1-6 0 3.6.3-2 0 3.5.1-7 1 3.6.3-3 0 3.5.1-8 1 3.6.3-4 1 3.5.1-9 0 3.6.3-5 1 3.5.1-10 1 3.6.3-6 1 3.5.2-1 0 3.6.3-7 1 3.5.2-2 0 3.6.3-8 11 3.5.2-3 0 3.6.3-9 1 0 3.6.3-10 11 3.5.2-4 3.5.2-5 0 3.6.3-11 11 3.5.2-6 0 3.6.3-12 11 3.5.2-7 1 3.6.3-13 1 3.5.2-8 1 3.6.3-14 1 3.5.2-9 1 3.6.3-15 1 3.5.2-10 1 3.6.3-16 1 3.5.3-1 0 3.6.3-17 1 3.5.3-2 3.6.4-1 0 3.5.3-3 3.6.4-2 1 3.5.3-4 0 3.6.4-3 1 3.5.3-5 0 3.6.5-1 0 3.5.3-6 3.6.5-2 1 3.5.3-7 2 3.6.5-3 0 3.5.3-8 0 1 3.6.5-4 0 3.5.3-9 0 3.6.6-1 0 3.5.3-10 2 3.6.6-2 2 3.6.6-3 1 3.5.4-1 15 3.5.4-2 0 3.6.6-4 7 3.5.4-3 0 3.6.6-5 1 3.5.5-1 0 3.6.6-6 0 3.5.5-2 7 3.6.6-7 1 3.5.5-3 4 3.6.6-8 1 3.6.6-9 00 3.5.5-4 4 3.5.5-5 0 3.6.7-1 0 3.5.5-6 0 3.6.7-2 0 3.5.5-7 0 3.6.7-3 0 0 3.6.7-4 0 3.5.6-1 3.5.6-2 1 3.6.7-5 0 3.5.6-3 0 3.7.1-1 7 3.5.6-4 1 3.7.1-2 7 3.5.6-5 0 3.7.1-3 0 3.6.1-1 0 3.7.1-4 0 3.6.1-2 0 3.7.1-5 1 3.6.1-3 0 3.7.1-6 7 3.6.1-4 0 3.7.2-1 0 3.6.1-5 0 3.7.2-2 0 3.6.2-1 0 3.7.2-3 0 3.6.2-2 6 3.7.2-4 0 PALO VERDE UNITS 1, 2, AND 3 5 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

3.7.2-5 0 3.7.13-3 0 3.7.2-6 0 3.7.13-4 0 3.7.3-1 1 3.7.13-5 0 3.7.3-2 1 3.7.14-1 0 3.7.3-3 1 3.7.14-2 21 3.7.3-4 0 3.7.14-3 21 3.7.3-5 0 3.7.15-1 3 3.7.4-1 0 3.7.15-2 3 3.7.4-2 0 3.7.16-1 7 3.7.4-3 0 3.7.16-2 0 3.7.4-4 0 3.7.16-3 0 3.7.5-1 0 3.7.16-4 0 3.7.5-2 0 3.7.17-1 3 3.7.5-3 0 3.7.17-2 3 3.7.5-4 0 3.7.17-3 3 3.7.5-5 9 3.7.17-4 3 3.7.5-6 9 3.7.17-5 3 3.7.5-7 9 3.7.17-6 3 3.7.5-8 9 3.8.1-1 0 3.7.5-9 9 3.8.1-2 2 3.7.5-10 9 3.8.1-3 20

.3.7.5-11 9 3.8.1-4 20 3.7.6-1 0 3.8.1-5 20 3.7.6-2 0 3.8.1-6 20 3.7.6-3 5 3.8.1-7 2 3.7.6-4 0 3.8.1-8 2 3.7.7-1 0 3.8.1-9 2 3.7.7-2 1 3.8.1-10 2 3.7.7-3 1 3.8.1-11 2 3.7.7-4 1 3.8.1-12 2 3.7.7-5 1 3.8.1-13 2 3.7.8-1 1 3.8.1-14 2 3.7.8-2 1 3.8.1-15 2 3.7.8-3 1 3.8.1-16 20 3.7.8-4 1 3.8.1-17 20 3.7.9-1 0 3.8.1-18 20 3.7.9-2 1 3.8.1-19 20 3.7.9-3 0 3 .8.1-20 20 3.7.10-1 10 3.8.1-21 20 3.7.10-2 1 3 .8.1-22 20 3.7.10-3 1 3.8.1-23 20 3.7.10-4 1 3.8.1-24 20 3.7.11-1 0 3 .8.1-25 20 3.7 .11-2 0 3.8.1-26 20 3.7.11-3 21 3.8.1-27 20 3.7.11-4 10 3.8.1-28 20 3.7.11-5 10 3.8.1-29 20 3.7.11-6 10 3.8.1-30 20 3.7.12-1 1 3.8.1-31 20 3.7.12-2 21 3.8.1-32 20 3.7.12-3 21 3.8.1-33 20 3.7.12-4 10 3.8.1-34 20 3.7.13-1 0 3.8.1-35 20 3.7.13-2 0 3.8.1-36 20 PALO VERDE UNITS 1, 2, AND 3 6 Revision 21 January 31, 2003

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

3.8.1-37 20 B 3.8.9-3 0 3.8.1-38 20 B 3.8.9-4 0 3.8.1-39 20 B 3.8.9-5 0 3.8.1-40 20 B 3.8.9-6 0 3.8.2-1 0 B 3.8.9-7 0 3.8.2-2 0 B 3.8.9-8 0 3.8.2-3 0 B 3.8.9-9 0 3.8.2-4 21 B 3.8.9-10 0 3.8.2-5 21 B 3.8.9-11 0 3.8.2-6 0 B 3.8.10-1 0 3.8.3-1 0 B 3.8.10-2 21 3.8.3-2 0 B 3.8.10-3 0 3.8.3-3 0 B 3.8.10-4 0 3.8.3-4 0 B 3.9.1-1 0 3.8.3-5 1 B 3.9.1-2 0 3.8.3-6 0 B 3.9.1-3 0 3.8.3-7 0 B 3.9.1-4 0 3.8.3-8 0 B 3.9.2-1 15 3.8.3-9 0 B 3.9.2-2 15 3.8.4-1 0 B 3.9.2-3 15 3.8.4-2 0 B 3.9.2-4 15 3.8.4-3 0 B 3.9.3-1 18 3.8.4-4 2 B 3.9.3-2 19 3.8.4-5 2 B 3.9.3-3 19 3.8.4-6 2 B 3.9.3-4 19 3.8.4-7 2 B 3.9.3-5 19 3.8.4-8 2 B.3.9.3-6 19 3.8.4-9 2 B 3.9.4-1 0 3.8.4-10 2 B 3.9.4-2 1 3.8.4-11 2 B 3.9.4-3 0 3.8.5-1 1 B 3.9.4-4 0 3.8.5-2 ,1 B 3.9.5-1 0 3.8.5-3 21 B 3.9.5-2 16 3.8.5-4 21 B 3.9.5-3 16 3.8.5-5 2 B 3.9.5-4 16 3.8.5-6 2 B.3.9.5-5 16 3 .8.6-1 0 B 3.9.6-1 0 3.8.6-2 0 B 3.9.6-2 0 3.8.6-3 0 B 3.9.6-3 0 3.8.6-4 6 B 3.9.7-1 0 3 .8.6-5 6 B 3.9.7-2 0 3.8.6-6 6 B 3.9.7-3 0 3.8.6-7 0 3.8.7-1 0 3.8.7-2 0 3.8.7-3 0 3.8.7-4 0 3.8.8-1 1 3.8.8-2 1 3.8.8-3 21 3.8.8-4 21 3.8.8-5 1 3.8.9-1 0 3.8.9-2 0 PALO VERDE UNITS 1, 2, AND 3 7 Revision 21 January 31, 2003

Reactor Core SLs B 2.1.1 BASES APPLICABLE h. Log Power Level - High trip:

SAFETY ANALYSES (continued) i. Reactor Coolant Flow - Low trip; and

j. Steam Generator Safety Valves.

The limitation that the average enthalpy in the hot leg be less than or equal to the enthalpy of-saturated liquid also ensures that the AT measured by instrumentation used in the protection system design as a measure of the core power is proportional to core power.

The SL represents a design requirement for establishing the protection system trip setpoints identified previously.

LCO 3.2.1, "Linear Heat Rate (LHR)," and LCO 3.2.4.

"Departure From Nucleate Boiling Ratio (DNBR)," or the assumed initial conditions of the safety analyses (as indicated in the UFSAR, Ref. 2) provide more restrictive limits to ensure that the SLs are not exceeded.

SAFETY LIMITS SL 2.1.1.1 and SL 2.1.1.2 ensure that the minimum DNBR is not less than the safety analyses limit and that fuel centerline temperature remains below melting.

The minimum value of the DNBR during normal operation and design basis AOOs is limited to 1.3 (this value will be 1.34 for operating cycles 11 and later). based on a statistical combination of CE-1 CHF correlation and engineering factor uncertainties, and is established as an SL. Additional factors such as rod bow and spacer grid size and placement will determine the limiting safety system settings required to ensure that the SL is maintained. Maintaining the dynamically adjusted peak LHR to s 21 kW/ft or peak fuel centerline temperature < 5080°F (decreasing by 58 0 F per 10.000 MWD/MTU for burnup and adjusting for burnable poisons per CENPD-382-P-A), ensures that fuel centerline melt will not occur during normal operating conditions or design AOOs.

The design melting point of new fuel with no burnable poison is 50800 F. The melting point is adjusted downward from this temperature depending on the amount of burnup and amount and type of burnable poison in the fuel. The 58 0F per 10,000 MWD/MTU adjustment for burnup was accepted by the NRC in (continued)

PALO VERDE UNITS 1,2,3 B 2.1.1-3 REVISION 21

Reactor Core SLs B 2.1.1 BASES SAFETY LIMITS Topical Report CEN-386-P-A, "Verification of the (continued) Acceptability of a 1-Pin Burnup Limit of 60 MWD/kgU for Combustion Engineering 16x16 PWR Fuel," August 1992.

Adjustments for burnable poisons are established based on NRC approved Topical Report CENPD-382-P-A, "Methodology for Core Designs Containing Erbium Burnable Absorbers," August 1993.

A steady state peak linear heat rate of 21 kW/ft has been established as the Limiting Safety System Setting to prevent fuel centerline melting during normal steady state operation. Following design basis anticipated operational occurrences, the transient linear heat rate may exceed 21 kW/ft provided the fuel centerline melt temperature is not exceeded. However, if the transient linear heat rate does not exceed 21 kW/ft, then the fuel centerline melt temperature is also not exceeded.

APPLICABILITY SL 2.1.1.1 and SL 2.1.1.2 only apply in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions serve to prevent RCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the unit into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1.

In MODES 3. 4, 5. and 6. Applicability is not required, since the reactor is not generating significant THERMAL POWER.

SAFETY LIMIT The following violation responses are applicable to the VIOLATIONS reactor core SLs.

2.2.1 If SL 2.1.1.1 or SL 2.1.1.2 is violated, the requirement to go to MODE 3 places the unit in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of bringing the unit to a MODE where this SL is not applicable and reduces the probability of fuel damage.

(continued)

PALO VERDE UNITS 1.2,3 B 2.1.1-4 REVISION 21

Reactor Core SLs B 2.1.1 BASES SAFETY LIMIT 2.2.3 VIOLATIONS (continued) If SL 2.1.1.1 or SL 2.1.1.2 is violated, the NRC Operations Center must be notified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , in accordance with 10 CFR 50.72 (Ref. 3).

2.2.4 If SL 2.1.1.1 or SL 2.1.1.2 is violated, the appropriate senior management of the nuclear plant and the utility shall be notified within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period provides time for the plant operators and staff to take the appropriate immediate action and assess the condition of the unit before reporting to the senior management.

2.2.5 If SL 2.1.1.1 or SL 2.1.1.2 is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in accordance with 10 CFR 50.73 (Ref. 4). A copy of the report shall also be provided to the senior management of the nuclear plant, and the utility Vice President, Nuclear Production.

2.2.6 If SL 2.1.1.1 or SL 2.1.1.2 is violated, restart of the unit shall not commence until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the unit begins its restart to normal operation.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, 1988.

2. UFSAR, Sections 6 and 15.

3. 10 CFR 50.72.

4. 10 CFR 50.73.

PALO VERDE UNITS 1,2,3 B 2.1.1-5 REVISION 21

This page intentionally blank

- Operating RPS Instrumentation RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

The LPD calculation considers APD, average power, radial peaking factors (based upon target CEA position), and CEAC penalty factors to calculate the current value-of compensated peak power density. An LPD - High trip occurs when the calculated value reaches the trip setpoint. The four CPC channels provide input to the four DNBR - Low and four LPD - High RPS trip channels. They effectively act as the sensor (using many inputs) for these trips.

The CEACs perform the calculations required to determine the position of CEAs within their subgroups for the CPCs. Two independent CEACs compare the position of each CEA to its subgroup position. If a deviation is detected by either CEAC. an annunciator sounds and appropriate "penalty factors" are transmitted to all CPCs. These penalty factors conservatively adjust the effective operating margins to the DNBR - Low and LPD - High trips. Each CEAC also drives a single visual display which is switchable between CEACs.

The visual display indicates individual CEA positions from the selected CEAC.

Each CEA has two separate reed switch assemblies mounted outside the RCPB. Each of the two CEACs receives CEA position input from one of the two reed switch position transmitters on each CEA, so that the position of all CEAs is independently monitored by both CEACs.

CEACs are addressed in LCO 3.3.3.

Bistable Trip Units Bistable trip units, mounted in the Plant Protection System (PPS) cabinet, receive an analog input from the measurement channels. They compare the analog input to trip setpoints and provide contact output to the Matrix Logic. They also provide local trip indication and remote annunciation.

There are four channels of bistables, designated A. B. C, and D. for each RPS parameter, one for each measurement channel. Bistables de-energize when a trip occurs, in turn de-energizing bistable relays mounted in the PPS relay card racks.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-5 REVISION 18

RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND Bistable Trip Units (continued)

The contacts from these bistable relays are arranged into six coincidence matrices, comprising the Matrix Logic. If bistables monitoring the same parameter in at least two channels trip, the Matrix Logic will generate a reactor trip (two-out-of-four logic).

Some measurement channels provide contact outputs to the PPS. In these cases, there is no bistable card, and opening the contact input directly de-energizes the associated bistable relays. These include the CPC generated DNBR - Low and LPD - High trips. The CPC auxiliary trip functions (e.g., CPC VOPT algorithm) do not have any direct contact outputs to the PPS. The auxiliary trip functions act through the DNBR - Low and LPD - High trip contacts to de energize the associated CPC initiation relays that provide a channel trip signal to the PPS parameters 3 and 4 bistable relays. Other CPC trip functions may also apply a penalty factor to cause a DNBR or LPD trip.

The trip setpoints used in the bistables are based on analytical limits derived from safety analyses (Ref. 5 and 8). The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, instrument drift, and severe environment errors for those RPS channels that must function in harsh environments as defined by 10 CFR 50.49 (Ref. 6). Allowable Values specified in Table 3.3.1-1, in the accompanying LCO. are conservatively adjusted with respect to the analytical limits. A detailed description of the methodology used to calculate the trip setpoints, including their explicit uncertainties, is provided in "Plant Protection System Selection of Trip Setpoint Values" (Ref. 7). The nominal trip setpoint entered into the bistable is normally still more conservative than that specified by the Allowable Value to account for changes in random measurement errors detectable by a CHANNEL FUNCTIONAL TEST. One example of such a change in measurement error is drift during the interval between surveillances. A channel is inoperable if its actual setpoint is not within its Allowable Value.

To maintain the margins of safety assumed in the safety analyses, the calculations of the trip variables for the DNBR - Low and Local Power Density - High trips include the (continued)

PALO VERDE UNITS 1,2.3 B 3.3.1-6 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND Bistable Trip Units (continued) measurement, calculational, and processor uncertainties and dynamic allowances as defined in the latest applicable revision of CEN-PSD-335-P, "Functional Design Requirements for a Core Protection Calculation" (Ref. 10) and CEN-PSD-336-P." Functional Design Requirements for a Control Element Assembly Calculator," (Ref. 11). The safety analyses also credit the CPC auxiliary trip functions (VOPT, T-hot Saturation, ASGT, and Low RCS Pressure), which act through the DNBR - Low and LPD - High trip contacts, to provide core protection during Anticipated Operational Occurrences and Design Basis Accidents (Ref. 5 and 8).

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0, "SAFETY LIMITS (SLs)," are not violated during AOOs, and the consequences of-DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

Note that in LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Functional testing of the entire RPS, from bistable input through the opening of individual RTCBs, can be performed either at power or shutdown and is normally performed on a quarterly basis. Nuclear instrumentation, the CPCs, and the CEACs can be similarly tested. UFSAR, Section 7.2 (Ref. 8),

provides more detail on RPS testing. Processing transmitter calibration is normally performed on a refueling basis.

RPS Logic The RPS Logic, addressed in LCO 3.3.4, consists of both Matrix and Initiation Logic and employs a scheme that provides a reactor trip when bista bles in any two of the four channels sense the same input parameter trip. This is called a two-out-of-four trip logic.

Bistable relay contact outputs from the four channels are configured into six logic matrices. Each logic matrix checks for a coincident trip in the same parameter in two bistable channels. The matrices are designated the AB, AC, AD, BC, BD, and CD matrices to reflect the bistable channels being monitored. Each logic matrix contains four normally (continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-7 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND RPS Logic (continued) energized matrix relays. When a coincidence is detected, consisting of a trip in the same Function in the two channels being monitored by the logic matrix, all four matrix relays de-energize.

The matrix relay contacts are arranged into trip paths, with one of the four matrix relays in each matrix opening contacts in one of the four trip paths. Each trip path provides power to one of the four normally energized RTCB initiation relays. The trip paths thus each have six contacts in series, one from each matrix, and perform a logical OR function, opening the RTCBs if any one or more of the six Togic matrices indicate a coincidence condition.

Each trip path is responsible for opening one of the four RTCBs. The RTCB initiation relays, when de-energized, interrupt power to the breaker undervoltage trip attachments and simultaneously apply power to the shunt trip attachments on each of the breakers. Actuation of either the undervoltage or shunt trip attachment is sufficient to open the RTCB and interrupt power from the motor generator (MG) sets to the control element drive mechanisms (CEDMs).

When a coincidence occurs in two RPS channels, all four matrix relays in the affected matrix de-energize. This in turn de-energizes all four initiation relays, which simultaneously de-energize the undervoltage and energize the shunt trip attachments in all four RTCBs, tripping them open.

Matrix Logic refers to the matrix power supplies, trip channel bypass contacts, and interconnecting matrix wiring between bistable relay cards, up to but not including the matrix relays. Matrix contacts on the bistable relay cards are excluded from the Matrix Logic definition, since they are addressed as part of the measurement channel.

The Initiation Logic consists of the trip path power source, matrix relays and their associated contacts, all interconnecting wiring, initiation relays, and the initiation relay contacts in the RTCB control circuitry.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-8 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABLE Design Basis Definition (continued)

SAFETY ANALYSES Each of the analyzed accidents and transients can be detected by one or more RPS Functions. The accident analysis takes credit for most of the RPS trip'Functions.

Those functions for which no credit is taken, termed equipment protective functions, are not needed from a safety perspective.

Each RPS setpoint is chosen to be consistent with the function of the respective trip. The basis for each trip setpoint falls into one of three general categories:

Category 1: To ensure that the SLs are not exceeded during AOOs:

Category 2: To assist the ESFAS during accTdents: and Category 3: To prevent material damage to major plant components (equipment protective).

The RPS maintains the SLs during ACOs and mitigates the consequences of DBAs in all MODES in which the RTCBs are closed.

Each of the analyzed transients and accidents can be detected by one or more RPS Functions. Functions not specifically credited in the accident analysis are part of the NRC staff approved licensing basis for the plant.

Noncredited Functions include the Steam Generator #1 Level - High. and the Steam Generator #2 Level- High. These trips minimize the potential for equipment damage.

The specific safety analysis applicable to each protective function are identified below:

1. Variable Over Power-High (RPS)

The Variable Over Power - High Trip (RPS-VOPT) is provided to protect the reactor core during positive reactivity addition excursions. Under steady state conditions the trip setpoint will stay above the neutron power level signal by a preset value, called the band function.- When the power level increases the setpoint will increase to attempt to maintain the separation defined by the Band function, however the (continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-11 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABLE Design Basis Definition (continued)

SAFETY ANALYSES

1. Variable Over Power-High (RPS) (continued) rate of the setpoint change is limited by the rate function. If the power level signal increases faster than the setpoint, a trip will occur when the power level eventually equals the trip setpoint. The maximum value the setpoint can have is determined by the ceiling function.

A positive reactivity excursion transient will be detected by one or more RPS Functions. The Variable Over Power-High trip (RPS-VOPT) can provide protection against core damage during the following events:

"* Uncontrolled CEA Withdrawal From Subcritical and Low Power (AOO): and

"* CEA Ejection (Accident).

2. Logarithmic Power Level - High The Logarithmic Power Level - High trip protects the integrity of the fuel cladding and helps protect the RCPB in the event of an unplanned criticality from a shutdown condition.

In MODES 2. 3, 4, and 5, with the RTCBs closed and the CEA Drive System capable of CEA withdrawal, protection is required for CEA withdrawal events originating when logarithmic power is < 1E-4% NRTP. For events originating above this power level, other trips provide adequate protection.

MODES 3. 4, and 5, with the RTCBs closed, are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Instrumentation - Shutdown."

In MODES 3. 4, or 5, with the RTCBs open or the CEAs not capable of withdrawal, the Logarithmic Power Level - High trip does not have to be OPERABLE. The indication and alarm functions required to indicate a boron dilution event are addressed in LCO 3.3.12, "Boron Dilution Alarm System (BDAS)".

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-12 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABLE 15. Departure from Nucleate Boiling Ratio (DNBR)-Low SAFETY ANALYSES (continued)

In the safety analyses for transients involving reactivity and power distribution anomalies, credit may be taken for the CPC VOPT auxiliary trip algorithm in lieu of the RPS VOPT trip function. The exact trip credited (CPC or RPS) is documented in chapter 15 of the UFSAR under the individual event sections. The CPC VOPT auxiliary trip acts through the CPC DNBR-Low and LPD-High trip contacts to provide over power protection. When credit is taken for the CPC VOPT algorithm, the CPC VOPT setpoints installed in the plant are based on the safety analyses and may differ from the RPS VOPT allowable values and nominal setpoints. The setpoints associated with the CPC VOPT are controlled via Addressable Constants (JSSection 5.4.1) and Reload Data Block Constants (Ref. 8 and 13). The CPC VOPT auxiliary trip algorithm may provide protection against core damage during the following events:

"* Uncontrolled CEA Withdrawal From Low Power (AQO):

"* Uncontrolled CEA Withdrawal at Power (AOO);

"* Single CEA Withdrawal within Deadband (AOO):

Steam Bypass Control System Misoperation (AOO):

CEA Ejection (Accident); and

Main Steam Line Break (Accident).

(conti nued)

PALO VERDE UNITS 1,2,3 B 3.3.1-17 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABLE 15. Departure from Nucleate Boiling Ratio (DNBR)-Low SAFETY ANALYSES (continued)

The DNBR algorithm used in the CPC is valid only within the limits indicated below and operation outside of these limits will result in a CPC initiated trip.

PARAMETER LIMITING VALUE RCS Cold Leg Temperature - Low a 505°F RCS Cold Leg Temperature - High < 590OF Axial Shape Index - Positive Not more positive than +0 5 Axial Shape Index - Negative Not more negative than -0 5 Pressurizer Pressure - Low _ 1860 psia Pressurizer Pressure - High _ 2388 psia Integrated Radial Peaking Factor - Low _1 28 Integrated Radial Peaking Factor - High _7 00 Quality Margin - Low >0 Interlocks/Bypasses The operating bypasses and their Allowable Values are addressed in footnotes to Table 3.3.1-1. They are not otherwise addressed as specific Table entries.

The automatic operating bypass removal features must function as a backup to manual actions for all safety related trips to ensure the trip Functions are not operationally bypassed when the safety analysis assumes the Functions are not bypassed. The basis for each of the operating bypasses is discussed under individual trips in the LCO section:

a. Logarithmic Power Level - High:

b. DNBR - Low and LPD - High.

The RPS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(conti nued)

PALO VERDE UNITS 1.2.3 B 3.3.1-18 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of any required portion of the instrument channel renders the affected channel(s) inoperable and reduces the reliability of the affected Functions.

Actions allow maintenance (trip channel) bypass of individual channels, but the bypass activates interlocks that prevent operation with a second channel in the same Function bypassed. With one channel in each Function trip channel bypassed, this effectively places the plant in a two-out-of-three logic configuration in those Functions.

Only the Allowable Values are specified for each RPS trip Function in the LCO. Nominal trip setpoints are specified in the plant specific setpoint calculations. The nominal setpoints are selected .to ensure the setpoints measured by CHANNEL FUNCTIONAL TESTS do not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable, provided that operation and testing are consistent with the assumptions of the plant specific setpoint calculations. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis in order to account for instrument uncertainties appropriate to the trip Function.

These uncertainties are defined in the "Plant Protection System Selection of Trip Setpoint Values" (Ref. 7).

The Bases for the individual Function requirements are as follows:

1. Variable Over Power-High (RPS)

This LCO requires all four channels of Variable Over Power High (RPS) to be OPERABLE in MODES 1 and 2.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary Variable Over Power High (RPS) reactor trips during normal plant operations. When the RPS VOPT trip function is credited in the safety analyses, the Allowable Value is based on the analyses and is low enough for the system to maintain a margin to unacceptable fuel or fuel cladding damage should a positive reactivity excursion event occur.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-19 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 2. Logarithmic Power Level - High (continued)

This LCO requires all four channels of Logarithmic Power Level - High to be OPERABLE in MODE 2.

In MODES 3, 4, or 5 when the RTCBs are shut and the CEA Drive System is capable of CEA withdrawal conditions are addressed in LCO 3.3.2.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary Logarithmic Power Level - High reactor trips during normal plant operations. The Allowable Value is low enough for the system to maintain a margin to unacceptable fuel cladding damage should a CEA withdrawal event occur.

The Logarithmic Power Level - High trip may be bypassed when logarithmic power is above 1E-4% NRTP to allow the reactor to be brought to power during a reactor startup. This operating bypass is automatically removed when logarithmic power decreases below 1E-4% NRTP. Above 1E-4% NRTP, the Variable Over Power - High and Pressurizer Pressure - High trips provide protection for reactivity transients.

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%). the automatic Hi-Log power trip bypass removal feature in that channel cannot function.

Similarly, when the indicated Log power channel is failed low (below 1E-4%), the automatic DNBR-LPD trip bypass removal feature in that channel cannot function.

Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4%

NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-20 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 2. Logarithmic Power Level - High (continued)

When a Log channel is INOPERABLE. both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE. Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required. These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

3. Pressurizer Pressure - High This LCO requires four channels of Pressurizer Pressure - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is set below the nominal lift setting of the pressurizer code safety valves, and its operation avoids the undesirable operation of these valves during normal plant operation. In the event of a loss of condenser vacuum at 100% power, this setpoint ensures the reactor trip will take place, thereby limiting further heat input to the RCS and consequent pressure rise. The pressurizer safety valves may lift to prevent overpressurization of the RCS.

4. Pressurizer Pressure - Low This LCO requires four channels of Pressurizer Pressure - Low to be OPERABLE in MODES 1 and 2.

The Allowable Value is set low enough to prevent a reactor trip during normal plant operation and pressurizer pressure transients. However, the setpoint is high enough that with a LOCA, the reactor trip will occur soon enough to allow the ESF systems to perform as expected in the analyses and mitigate the consequences of the accident.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-21 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 5. Containment Pressure - High (continued)

The LCO requires four channels of Containment Pressure - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is set high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) and is not indicative of an abnormal condition. It is set low enough to initiate a reactor trip when an abnormal condition is indicated.

6. 7. Steam Generator Pressure - Low This LCO requires four channels of Steam Generator #1 Pressure - Low and Steam Generator #2 Pressure - Low to be OPERABLE in MODES 1 and 2.

This Allowable Value is sufficiently'below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand. Since excessive steam demand causes the RCS to cool down, resulting in positive reactivity addition to the core. If the moderator temperature coefficient is negative a reactor trip is required to offset that effect.

The trip setpoint may be manually decreased as steam generator pressure is reduced during controlled plant cooldown, provided the margin between steam generator pressure and the setpoint is maintained : 200 psia.

This allows for controlled depressurization of the secondary system while still maintaining an active reactor trip setpoint and MSIS setpoint, until the time is reached when the setpoints are no longer needed to protect the plant. The setpoint increases automatically as steam generator pressure increases until the specified trip setpoint is reached 8, 9. Steam Generator Level - Low This LCO requires four channels of Steam Generator #1 Level - Low and Steam Generator #2 Level - Low for each steam generator to be OPERABLE in MODES 1 and 2. The Allowable Value is sufficiently below the normal operating level for the steam generators so as not to (continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-22 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 8, 9. Steam Generator Level - Low (continued) cause a reactor trip during normal plant operations.

The input signal providing the reactor trip input also provides an input to a bistable that initiates auxiliary feedwater to the affected generator via the Auxiliary Feedwater Actuation Signal WAFAS). The trip setpoint ensures that there will be sufficient water inventory in the steam generator at the time of the trip to provide a margin of at least 10 minutes before auxiliary feedwater is required to prevent degraded core cooling. The reactor trip will remove the heat source (except decay heat), thereby conserving the reactor heat sink.

10, 11. Steam Generator Level - High This LCO requires four channels of Steam Generator #1 Level - High and Steam Generator #2 Level - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is high enough to allow for normal plant operation and transients without causing a reactor trip. It is set low enough to ensure a reactor trip occurs before the level reaches the steam dryers. Having steam generator water level at the trip value is indicative of the plant not being operated in a controlled manner.

12, 13. Reactor Coolant Flow - Low This LCO requires four channels of Reactor Coolant Flow Steam Generator #1-Low and Reactor Coolant Flow Steam Generator # 2-Low to be OPERABLE in MODES 1 and 2. The Allowable Value is set low enough to allow for slight variations in reactor coolant flow during normal plant operations while providing the required protection. Tripping the reactor ensures that the resultant power to flow ratio provides adequate core cooling to maintain DNBR under the expected pressure conditions for this event.

LCO 3.4.5. "RCS Loops - MODE 3." LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7. "RCS Loops - MODE 5.

Loops Filled," ensure adequate RCS flow rate is maintained.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-23 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 14. Local Power Density - High (continued)

This LCO requires four channels of LPD - High to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AOOs and the consequences of accidents are acceptable.

A CPC is not considered inoperable if CEAC inputs to the CPC are inoperable. The Required Actions required in the event of CEAC channel failures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below 1E-4% NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR - Low and LPD - High trips from the RPS Logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are no longer satisfied.

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%). the automatic Hi-Log power trip bypass removal feature in that channel cannot function. Similarly, when the indicated Log power channel is failed low (below 1E-4%), the automatic DNBR-LPD trip bypass removal feature in that channel cannot function. Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4% NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-24 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 14. Local Power Density - High (continued)

When a Log channel is INOPERABLE, both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE. Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required.

These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

This operating bypass is required to perform a plant startup, since both CPC generated trips will be in effect whenever shutdown CEAs are inserted. It also allows system tests at low power with Pressurizer Pressure - Low or RCPs off.

15. Departure from Nucleate Boiling Ratio (DNBR) - Low This LCO requires four channels of DNBR - Low to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AOOs and the consequences of accidents are acceptable.

A CPC is not considered inoperable if CEAC inputs to the CPC are inoperable. The Required Actions required in the event of CEAC channel failures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below 1E-4% NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR - Low and LPD - High trips from the RPS logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are no longer satisfied.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-25 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO 15. Departure from Nucleate Boiling Ratio (DNBR) - Low (continued)

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%). the automatic Hi-Log power trip bypass removal feature in that channel cannot function.

Similarly, when the indicated Log power channel is failed low (below 1E-4%), the automatic DNBR-LPD trip bypass removal feature in that channel cannot function. Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4% NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

When a Log channel is INOPERABLE, both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE.

Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required.

These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

This operating bypass is required to perform a plant startup, since both CPC generated trips will be in effect whenever shutdown CEAs are inserted. It also allows system tests at low power with Pressurizer Pressure - Low or RCPs off.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-26 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES LCO Interlocks/Bypasses (continued)

The LCO on operating bypass permissive removal channels requires that the automatic operating bypass removal feature of all four operating bypass channels be OPERABLE for each RPS Function with an operating bypass in the MODES addressed in the specific LCO for each Function. All four bypass removal channels must be OPERABLE to ensure that none of the four RPS channels are inadvertently bypassed. Refer also to B 3.3.5 for ESFAS operating bypasses.

This LCO applies to the operating bypass removal feature only. If the bypass enable Function is failed so as to prevent entering a bypass condition, operation may continue.

In the case of the Logarithmic Power Level - High trip (Function 2), the absence of a bypass will limit maximum power to below the trip setpoint.

The interlock function Allowable Values are based upon analysis of functional requirements for the bypassed Functions. These are discussed above as part of the LCO discussion for the affected Functions.

APPLICABILITY This LCO is applicable to the RPS Instrumentation in MODES 1 and 2. LCO 3.3.2 is applicable to the RPS Instrumentation in MODES 3. 4, and 5 with any RTCB closed and any CEA capable of withdrawal. The requirements for the CEACs in MODES 1 and 2 are addressed in LCO 3.3.3. The RPS Matrix Logic, Initiation Logic, RTCBs, and Manual Trips in MODES 1, 2, 3,

4. and 5 are addressed in LCO 3.3.4.

Most RPS trips are required to be OPERABLE in MODES 1 and 2 because the reactor is critical in these MODES. The reactor trips are designed to take the reactor subcritical, which maintains the SLs during AOOs and assists the ESFAS in providing acceptable consequences during accidents. Most trips are not required to be OPERABLE in MODES 3. 4. and 5.

In MODES 3. 4. and 5, the emphasis is placed on return to power events. The reactor is protected in these MODES by ensuring adequate SOM. Exceptions to this are:

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-27 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABILITY The Logarithmic Power Level - High trip, RPS Logic (continued) RTCBs, and Manual Trip are required in MODES 3, 4, and 5, with the RTCBs closed, to provide protection for boron dilution and CEA withdrawal events.

Steam Generator Pressure-Low trip, is required in MODE 3, with the RTCBs closed to provide protection for steam line break events in MODE 3.

The Logarithmic Power Level - High trip, and the Steam Generator Pressure-Low trip in these lower MODES are addressed in LCO 3.3.2. The Logarithmic Power Level - High trip is bypassed prior to MODE 1 entry and is not required in MODE 1.

ACTIONS The most common causes of channel inoperability are outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific setpoint analysis. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the trip setpoint is less conservative than the Allowable Value in Table 3.3.1-1, the channel is declared inoperable immediately, and the appropriate Condition(s) must be entered immediately.

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is found inoperable, then all affected functions provided by that channel must be declared inoperable, and the unit must enter the Condition for the particular protection Function affected.

When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-28 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS One Note has been added to the ACTIONS. Note 1 has been (continued) added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered for that Function.

With a channel process measurement circuit that affects multiple functional units inoperable or in test, bypass or trip all associated functional units as listed below:

Process Measurement Circuit Functional Unit (Bypassed or Tripped)

1. Linear Power Variable Overpower (RPS)

(Subchannel or Linear) Local Power Density-High (RPS)

DNBR-Low (RPS)

2. Pressurizer Pressure-High Pressurizer Pressure-High (RPS)

(Narrow Range) Local Power Density-High (RPS)

DNBR-Low (RPS)

3. Steam Generator Pressure-Low Steam Generator Pressure-Low (RPS)

Steam Generator #1 Level-Low (ESF)

Steam Generator #2 Level-Low (ESF)

4. Steam Generator Level-Low Steam Generator Level-Low (RPS)

(Wide Range) Steam Generator #1 Level-Low (ESF)

Steam Generator #2 Level-Low (ESF)

5. Core Protection Calculator Local Power Density-High (RPS)

DNBR-Low (RPS)

A.1 and A.2 Condition A applies to the failure of a single trip channel or associated instrument channel inoperable in any RPS automatic trip Function. RPS coincidence logic is two-out-of-four.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-29 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS A.1 and A.2 (continued)

If one RPS channel is inoperable, startup or power operation is allowed to continue, providing the inoperable channel is placed in bypass or trip in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allotted to bypass or trip the channel is sufficient to allow the operator to take all appropriate actions for the failed channel and still ensures that the risk involved in operating with the failed channel is acceptable. The failed channel must be restored to OPERABLE status prior to entering MODE 2 following the next MODE 5 entry. With a channel in bypass, the coincidence logic is now in a two-out-of-three configuration.

The Completion Time of prior to entering MODE 2 following the next MODE 5 entry is based on adequate channel to channel independence, which allows a two-out-of-three channel operation since no single failure will cause or prevent a reactor trip.

B1 Condition B applies to the failure of two channels in any RPS automatic trip Function.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES, even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

Required Action B.1 provides for placing one inoperable channel in bypass and the other channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed, the RPS is in a two-out-of-three logic: but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in trip.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-30 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS B.1 (continued)

This places the RPS in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, the reactor will trip.

One of the two inoperable channels will need to be restored to operable status prior to the next required CHANNEL FUNCTIONAL TEST, because channel surveillance testing on an OPERABLE channel requires that the OPERABLE channel be placed in bypass. However, it is not possible to bypass more than one RPS channel, and placing a second channel in trip will result in a reactor trip. Therefore, if one RPS channel is in trip and a second channel is in bypass, a third inoperable channel would place the unit in LCO 3.0.3.

C.1. C.2.1, and C.2.2 Condition C applies to one automatic bypass removal channel inoperable. If the inoperable operating bypass removal channel for any operating bypass channel cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channel must be declared inoperable, as in Condition A, and the affected automatic trip channel placed in maintenance (trip channel) bypass or trip. The operating bypass removal channel and the automatic trip channel must be repaired prior to entering MODE 2 following the next MODE 5 entry. The Bases for the Required Actions and required Completion Times are consistent with Condition A.

D.1 and D.2 Condition D applies to two inoperable automatic operating bypass removal channels. If the operating bypass removal channels for two operating bypasses cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channels must be declared inoperable, as in Condition B, and the operating bypass either removed or one automatic trip channel placed in maintenance (trip channel) bypass and the other in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-31 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST, or the plant must shut down per LCO 3.0.3 as explained in Condition B.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

E1 Condition E applies if any CPC cabinet receives a high temperature alarm. There are redundant temperature sensors in each of the four CPC bays. Since CPC bays B and C also house CEAC calculators 1 and 2, respectively, a high temperature in either of these bays requires entry into LCO 3.3.3. Condition C.

If a CPC cabinet high temperature alarm is received, it is possible for an OPERABLE CPC to be affected and not be completely reliable. Therefore, a CHANNEL FUNCTIONAL TEST must be performed on OPERABLE CPCs within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate considering the low probability of undetected failure, the consequences of a single channel failure, and the time required to perform a CHANNEL FUNCTIONAL TEST.

F.1 Condition F applies if an OPERABLE CPC has three or more autorestarts in a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period.

CPCs and CEACs will attempt to autorestart if they detect a fault condition, such as a calculator malfunction or loss of power. A successful autorestart restores the calculator to operation: however, excessive autorestarts might be indicative of a calculator problem. The autorestart periodic test restart (Code 30). and normal system load (Code 33) are not included in the total.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-32 REVISION 21

- Operating RPS Instrumentation RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS F.1 (continued)

If a nonbypassed CPC has three or more autorestarts, it may not be completely reliable. Therefore, a CHANNEL FUNCTIONAL TEST must be performed on the CPC to ensure it is functioning properly. Based on plant operating experience, the Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is adequate and reasonable to perform the test while still keeping the risk of operating in this condition at an acceptable level, since overt channel failure will most likely be indicated and annunciated in the control room by CPC online diagnostics.

G.1 Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C. D, E. or F are not met.

If the Required Actions associated with these Conditions cannot be completed within the required Completion Time, the reactor must be brought to a MODE where the Required Actions do not apply. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR REQUIREMENTS column of Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK. CHANNEL FUNCTIONAL TEST.

CHANNEL CALIBRATION, and response time testing.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-33 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties.

including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

In the case of RPS trips with multiple inputs, such as the DNBR and LPD inputs to the CPCs, a CHANNEL CHECK must be performed on all inputs.

SR 3.3.1.2 The RCS flow rate indicated by each CPC is verified, as required by a Note, to be less than or equal to the actual RCS total flow rate, determined by either using the reactor coolant pump differential pressure instrumentation or by calorimetric calculations, every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when THERMAL POWER is Ž 70% RTP. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 70% RTP is for plant stabilization, data taking, and flow verification. This check (and if necessary, the adjustment of the CPC addressable constant flow coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications, as determined by the Core Operating Limits Supervisory System (COLSS).

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-34 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS The flow measurement uncertainty may be included in the BERRI term in the CPC and is equal to or greater than 4%.

SR 3.3.1.3 The CPC autorestart count is checked every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to monitor the CPC and CEAC for normal operation. If three or more autorestarts of a nonbypassed CPC occur within a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the CPC may not be completely reliable.

Therefore, the Required Action of Condition F must be performed. The auto restart periodic tests restart (Code 30) and normal system load (Code 33) are not included in this total. The Frequency is based on operating experience that demonstrates the rarity of more than one channel failing within the same 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval.

SR 3.3.1.4 A daily calibration (heat balance) is performed when THERMAL POWER is Ž 20%. The Linear Power Level signaland the CPC addressable constant multipliers are adjusted to make the CPC AT power and nuclear power calculations agree with the calorimetric calculation if the absolute difference is Ž 2%when THERMAL POWER is Ž 80% RTP, and

-0.5% to 10% when THERMAL POWER is between 20% and 80%.

The value of 2% when THERMAL POWER is Ž 80% RTP, and -0.5%

to 10% when THERMAL POWER is between 20% and 80% is adequate because this value is assumed in the safety analysis. These checks (and, if necessary, the adjustment of the Linear Power Level signal and the CPC addressable constant coefficients) are adequate to ensure that the accuracy of these CPC calculations is maintained within the analyzed error margins. The power level must be > 20% RTP to obtain accurate data. At lower power levels, the accuracy of calorimetric data is questionable.

The tolerance between 20% and 80% RTP is +10% to reduce the number of adjustments required as the power level increases. The -0.5% tolerance between 20% and 80% RTP is based on the reduced accuracy of the calorimetric data inputs at low power levels. Performing a calorimetric (continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-35 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS calibration with a -0.5% tolerance at low power levels ensures the difference will remain within -2.0% when power is increased above 80% RTP. If a calorimetric calculation is performed above 80% RTP, it will use accurate inputs to the calorimetric calculation available at higher power levels. When the power level is decreased below 80% RTP an additional performance of the SR to the -0.5% to 10%

tolerance is not required if the SR has been performed above 80% RTP.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs. The Frequency is modified by a Note indicating this Surveillance need only be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP.

The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP is required for plant stabilization, data taking, and flow verification. The secondary calorimetric is inaccurate at lower power levels.

A second Note in the SR indicates the SR may be suspended during PHYSICS TESTS. The conditional suspension of the daily calibrations under strict administrative control is necessary to allow special testing to occur.

SR 3.3.1.5 The RCS flow rate indicated by each CPC is verified to be less than or equal to the RCS total flow rate every 31 days. The Note indicates the Surveillance is performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is ý 70% RTP. This check (and, if necessary, the adjustment of the CPC addressable flow constant coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications as determined either using the reactor coolant pump differential pressure instrumentation and the ultrasonic flow meter adjusted pump curves or by a calorimetric calculation. Operating experience has shown the specified Frequency is adequate, as instrument drift is minimal and changes in actual flow rate are minimal over core life.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.1-36 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) The three vertically mounted excore nuclear instrumentation detectors in each channel are used to determine APD for use in the DNBR and LPD calculations. Because the detectors are mounted outside the reactor vessel, a portion of the signal from each detector is from core sections not adjacent to the detector. This is termed shape annealing and is compensated for after every refueling by performing SR 3.3.1.11, which adjusts the gains of the three detector amplifiers for shape annealing. SR 3.3.1.6 ensures that the preassigned gains are still proper. When power is

< 15% the CPCs do not use the excore generated signals for axial flux shape information. The Note allowing 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 15% RTP is required for plant stabilization and testing. The 31 day Frequency is adequate because the demonstrated long term drift of the instrument channels is minimal.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on each channel is performed every 92 days to ensure the entire channel will perform its intended function when needed. The SR is modified by two Notes. Note 1 is a requirement to verify the correct CPC addressable constant values are installed in the CPCs when the CPC CHANNEL FUNCTIONAL TEST is performed. Note 2 allows the CHANNEL FUNCTIONAL TEST for the Logarithmic Power Level - High channels to be performed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after logarithmic power drops below 1E-4% NRTP.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 8. These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs. They include:

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-37 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE Bistable Tests REQUIREMENTS (continued) A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS channel trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis.

The requirements for this review are outlined in Reference 9.

Matrix Logic Tests Matrix Logic tests are addressed in LCO 3.3.4. This test is performed one matrix at a time. It verifies that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state. This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path Tests Trip path (Initiation Logic) tests are addressed in LCO 3.3.4. These tests are similar to the Matrix Logic tests, except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, thereby opening the affected RTCB. The RTCB must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

The CPC and CEAC channels and excore nuclear instrumentation channels are tested separately.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-38 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE Trip Path Tests (continued)

REQUIREMENTS The excore channels use preassigned test signals to verify proper channel alignment. The excore logarithmic channel test signal is inserted into the preamplifier input, so as to test the first active element downstream of the detector.

The power range excore test signal is inserted at the drawer input, since there is no preamplifier.

The quarterly CPC CHANNEL FUNCTIONAL TEST is performed using software. This software includes preassigned addressable constant values that may differ from the current values.

Provisions are made to store the addressable constant values on a computer disk prior to testing and to reload them after testing. A Note is added to the Surveillance Requirements to verify that the CPC CHANNEL FUNCTIONAL TEST includes the correct values of addressable constants.

SR 3.3.1.8 A Note indicates that neutron detectors are excluded from CHANNEL CALIBRATION. A CHANNEL CALIBRATION of the power range neutron flux channels every 92 days ensures that the channels are reading accurately and within tolerance (Ref. 9). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis.

The requirements for this review are outlined in Reference 9. Operating experience has shown this Frequency to be satisfactory. The detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a (continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-39 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 (continued)

REQUIREMENTS meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4) and the monthly linear subchannel]

gain check (SR 3.3.1.6). In addition, the associated control room indications are monitored by the operators.

SR 3.3.1.9 SR 3.3.1.9 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis as well as operating experience and consistency with the typical 18 month fuel cycle.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4) and the monthly linear subchannel gain check (SR 3.3.1.6).

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-40 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.10 REQUIREMENTS (continued) Every 18 months, a CHANNEL FUNCTIONAL TEST is performed on the CPCs. The CHANNEL FUNCTIONAL TEST shall include the injection of a signal as close to the sensors as practicable to verify OPERABILITY including alarm and trip Functions.

The basis for the 18 month Frequency is that the CPCs perform a continuous self monitoring function that eliminates the need for frequent CHANNEL FUNCTIONAL TESTS.

This CHANNEL FUNCTIONAL TEST essentially validates the self monitoring function and checks for a small set of failure modes that are undetectable by the self monitoring function. Operating experience has shown that undetected CPC or CEAC failures do not occur in any given 18 month interval.

SR 3.3.1.11 The three excore detectors used by each CPC channel for axial flux distribution information are far enough from the core to be exposed to flux from all heights in the core.

although it is desired that they only read their particular level. The CPCs adjust for this flux overlap by using the predetermined shape annealing matrix elements in the CPC software.

After refueling, it is necessary to re-establish or verify the shape annealing matrix elements for the excore detectors based on more accurate incore detector readings.

This is necessary because refueling could possibly produce a significant change in the shape annealing matrix coefficients.

Incore detectors are inaccurate at low power levels.

THERMAL POWER should be significant but < 70% to perform an accurate axial shape calculation used to derive the shape annealing matrix elements.

By restricting power to

70% until shape annealing matrix elements are verified, excessive local power peaks within the fuel are avoided. Operating experience has shown this Frequency to be acceptab1e.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-41 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.12 REQUIREMENTS (continued) SR 3.3.1.12 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.1.7, except SR 3.3.1.12 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify operating bypass removal function OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST. SR 3 3 1.7.

Therefore, further testing of the operating bypass function after startup is unnecessary.

SR 3.3.1.13 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response times are conducted on an 18 month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of 18 months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. Response time testing may be performed at power on a single channel or during plant outages when the equipment is not required to be operable.

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

(continued)

PALO VERDE UNITS 1,2,3 B 3 3.1-42 REVISION 21

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.13 (continued)

REQUIREMENTS Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from the records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements." (Ref. 12) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4)

REFERENCES 1. 10 CFR 50, Appendix A. GDC 21

2. 10 CFR 100.

3. NRC Safety Evaluation Report, July 15, 1994.

4. IEEE Standard 279-1971, April 5, 1972.

5. UFSAR, Chapters 6 and 15.

6. 10 CFR 50.49.

7. "Calculation of Trip Setpoint Values, Plant Protection System". CEN-286(v), or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip function.

8. UFSAR, Section 7.2.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-43 REVISION 21

BASES REFERENCES 9. CEN-327, June 2, 1986, including Supplement 1, (continued) March3. 1989, and Calculation 13-JC-SB-200.

10. CEN-PSD-335-P, "Functional Design Requirements for a Core Protection Calculator."

11. CEN-PSD-336-P, "Functional Design Requirements for a Control Element Assembly Calculator."

12. CEOG Topical Report CE NPSD-1167-A. "Elimination of Pressure Sensor Response Time Testing Requirements

13. CEN-323-P-A, "Reload Data Block Constant Installation Guidelines", Combustion Engineering, Inc., September.

1986.

PALO VERDE UNITS 1,2.3 B 3 3.1-44 REVISION 21

CREFAS B 3.3.9 BASES LCO a. Manual Trip (continued)

The LCO on Manual Trip backs up the automatic trips and ensures operators have the capability to rapidly initiate the CREFAS Function if any parameter is trending toward its setpoint. One channel must be OPERABLE. This considers that the Manual Trip capability is a backup and that other means are available to actuate the redundant train if required, including manual SIAS, FBEVAS, or CPIAS.

b. Radiation Monitors One channel of radiation monitor is required to be OPERABLE to ensure the control room filtration actuates on high gaseous activity.

c. Actuation Logic One train of Actuation Logic must be OPERABLE, since there are alternate means available to actuate the redundant train, including SIAS.

APPLICABILITY The CREFAS Functions must be OPERABLE in MODES 1. 2. 3, 4,

5. and 6 and during movement of irradiated fuel assemblies in either the fuel building or the containment building, to ensure a habitable environment for the control room operators.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

The CREFAS must be OPERABLE in MODES 5 and 6 to provfde protection for a Waste Gas Decay Tank rupture accident.

ACTIONS A CREFAS channel is inoperable when it does not satisfy the OPERABILITY criteria for the channel's function. The most common cause of channel inoperability is outright failure.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.9-3 REVISION 21

CREFAS B 3.3.9 BASES ACTIONS A.1, B.1, B.2, C.1. C.2 1, C.2.2, and C.2.3 (continued)

Conditions A. B. and C are applicable to manual and automatic actuation of the CREFAS. Condition A applies to the failure of two channels of the CREFAS Manual Trip, Actuation Logic, and radiation monitor channel in MODE 1,

2. 3. or 4. Entry into this Condition requires action to either restore the failed channel or manually perform the CREFS safety function (Required Action A.1). The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is sufficient to complete the Required Actions and accounts for the fact that CREFAS supplements control room filtration by other Functions (e.g., SIAS) in MODES 1. 2, 3. and 4. If Required Action A.1 and the associated completion time are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action B.1) and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months (Required Action B.2). The Completion Times of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months for reaching MODES 3 and 5 from MODE 1 are reasonable, based on operating experience and normal cooldown rates, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant safety systems or operators.

Condition C applies to the failure of two channels of CREFAS Manual Trip, Actuation Logic, and radiation monitor channel in MODE 5 or 6, or when moving irradiated fuel assemblies.

The Required Actions are immediately taken to place one OPERABLE CREFS train in the emergency mode of operation (i.e., fan running, valves/dampers aligned to the post CREFAS mode, etc.) or to suspend CORE ALTERATIONS, positive reactivity additions, and movement of irradiated fuel assemblies. The Completion Time recognizes the fact that FBEVAS, or CPIAS are available to initiate control room filtration in the event of a fuel handling accident.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.9-4 REVISION 10

CREFS B 3.7.11 BASES APPLICABLE The worst case single active failure of a component of the SAFETY ANALYSES CREFS, assuming a loss of offsite power, does not impair (continued) the ability of the system to perform its design function.

The CREFS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two independent and redundant trains of the CREFS are required to be OPERABLE to ensure that at least one is available, assuming that a single failure disables the other train. Total system failure could result in a control room operator receiving a dose in excess of 5 rem whole body or its equivalent in the event of a large radioactive release.

The CREFS is considered OPERABLE when the individual components necessary to control operator exposure are OPERABLE in both trains. A CREFS train is considered OPERABLE when the associated:

a. Fan is OPERABLE:

b. HEPA filters and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration functions; and

c. Ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In addition, the control room boundary must be maintained, including the integrity of the walls, floors, ceilings, ductwork, and access doors.

APPLICABILITY In MODES 1. 2, 3, and 4. the CREFS must be OPERABLE to limit operator exposure during and following a DBA.

In MODES 5 and 6, the CREFS is required to cope with the release from a rupture of a waste gas tank.

Movement of spent fuel casks containing irradiated fuel assemblies is not within-the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

During movement of irradiated fuel assemblies, the CREFS must be OPERABLE to cope with the release from a fuel handling accident.

(continued)

PALO VERDE UNITS 1,2.3 B 3.7.11-3 REVISION 21

CREFS B 3.7.11 BASES ACTIONS A.1 With one CREFS train inoperable, action must be taken to restore OPERABLE status within 7 days. In this Condition.

the remaining OPERABLE CREFS subsystem is adequate to perform control room radiation protection function. However, the overall reliability is reduced because a single failure in the OPERABLE CREFS train could result in loss of CREFS function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability.

B.1 and B.2 If the inoperable CREFS cannot be restored to OPERABLE status within the required Completion Time in MODE 1. 2, 3. or 4, the unit must be placed in a MODE that minimizes the accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 In MODE 5 or 6. if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE CREFS train must be immediately placed in the emergency mode of operation (i.e., fan running, valves/dampers aligned to the post-CREFAS mode, etc.). This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation will occur, and that any active failure will be readily detected.

D.1 and D.2 During movement of irradiated fuel assemblies, if required Action A.1 cannot be completed within the required Completion Time, the OPERABLE CREFS train must be immediately placed in the emergency mode of operation (i.e.. fan running, valves/dampers aligned to the post-CREFAS mode, etc.) or movement of irradiated fuel assemblies must be suspended immediately. The first action ensures that the remaining train is OPERABLE, that no undetected failures preventing system operation will occur, and that any active failure will be readily detected. If the system is not placed in the emergency mode of operation, this action requires suspension (continued)

PALO VERDE UNITS 1,2,3 B 3 7.11-4 REVISION 10

CREATCS B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS)

BASES BACKGROUND The CREATCS provides temperature control for the control room following isolation of the control room.

The CREATCS consists of two independent, redundant trains that provide cooling of recirculated control room air. Each train consists of cooling coils, instrumentation, and controls to provide for control room temperature control.

The CREATCS is a subsystem providing air temperature control for the control room.

The CREATCS is an emergency system, which is part of the Control Room Essential Filtration System (CREFS). A single train will provide the required temperature control to maintain the control room between 701F and 80'F. The CREATCS operation to maintain the control room temperature is discussed in the UFSAR, Section 9.4 (Ref. 1).

APPLICABLE The design basis of the CREATCS is to maintain temperature SAFETY ANALYSES of the control-room environment throughout 30 days of continuous occupancy.

The CREATCS components are arranged in redundant safety related trains. During emergency operation, the CREATCS maintains the temperature between 70°F and 80 0 F. A single active failure of a component of the CREATCS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The CREATCS is designed in accordance with Seismic CategoryI requirements. The CREATCS is capable of removing sensible and latent heat loads from the control room, considering equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.

The CREATCS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.12-1 REVISION 1

CREATCS B 3.7.12 BASES (continued)

LCO Two independent and redundant trains of the CREATCS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.

The CREATCS is considered OPERABLE when the individual components that are necessary to maintain the control room temperature are OPERABLE in both trains. These components include the cooling coils and associated temperature control instrumentation. In addition, the CREATCS must be OPERABLE to the extent that air circulation can be maintained.

APPLICABILITY In MODES 1, 2. 3. 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREATCS must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY requirements following isolation of the control room.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

ACTIONS A.1 With one CREATCS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CREATCS train is adequate to maintain the control room temperature within limits. The 30 day Completion Time is reasonable, based on the low probability of an event occurring requiring control room isolation, consideration that the remaining train can provide the required capabilities, and the alternate safety or nonsafety related cooling means that are available.

(continued)

PALO VERDE UNITS 1.2,3 B 3.7.12-2 REVISION 21

CREATCS B 3.7.12 BASES (continued)

ACTIONS B.1 and B.2 (continued) In MODE 1. 2, 3, or 4, when Required Action A.1 cannot be completed within the required Completion Time, the unit must be placed in a MODE that minimizes the accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 In MODE 5 or 6, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE CREATCS train must be immediately placed in the emergency mode of operation (i.e., fan running, valves/dampers aligned to the post-CREATCS mode, etc.) This action ensures that the remaining train is OPERABLE, that no failures preventing automatic actuation-will occur, and that any active failure will be readily detected.

D.1 and D.2 During movement of irradiated fuel assemblies, if Required Action A.1 cannot be completed within the Required Completion Time, the OPERABLE CREATCS train must be immediately placed in the emergency mode of operation (i.e., fan running, valves/dampers aligned to the post-CREATCS mode, etc.) or movement of irradiated fuel assemblies must be suspended immediately. The first action ensures that the remaining train is OPERABLE, that no undetected failures preventing system operation will occur, and that any active failure will be readily detected. If the system is not placed in the emergency mode of operation, this action requires suspension of the movement of irradiated fuel assemblies in order to minimize the risk of a release of radioactivity that might require the actuation of CREATCS. This does not preclude the movement of fuel to a safe position.

E.1 and E.2 In MODE 5 or 6, or during movement of irradiated fuel assemblies with two CREATCS trains inoperable, action must be taken immediately to suspend activities that could result in a release of radioactivity that might require actuation of CREATCS. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position. (continued)

PALO VERDE UNITS 1,2,3 B 3.7.12-3 REVISION 21

CREATCS B 3.7.12 BASES (continued)

ACTIONS F.1 (continued)

If both CREATCS trains are inoperable in MODE 1, 2, 3, or 4, the CREATCS may not be capable of performing the intended function and the unit is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be entered immediately SURVEILLANCE SR 3.7.12.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to meet design requirements. This SR consists of a combination of testing and calculations. An 18 month Frequency is appropriate, since significant degradation of the CREATCS is slow and is not expected over this time period REFERENCES 1. UFSAR, Section 9.4.

PALO VERDE UNITS 1,2.3 B 3 7 12-4 REVISION 10

Fuel Storage Pool Water Level B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Fuel Storage Pool Water Level BASES BACKGROUND The minimum water level in the fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident. The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.

A general description of the fuel storage pool design is given in the UFSAR, Section 9.1.2, Reference 1, and the Spent Fuel Pool Cooling and Cleanup System is given in the UFSAR, Section 9.1.3 (Ref. 2). The assumptions of the fuel handling accident are given in the UFSAR, Section 15.7.4 (Ref. 3).

APPLICABLE The minimum water level in the fuel storage pool meets the SAFETY ANALYSES intent of the assumptions of the fuel handling accident described in Regulatory Guide 1.25 (Ref. 4). The resultant 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to a person at the exclusion area boundary is less than one-third of the 10 CFR 100 (Ref. 5) limits.

According to Reference 4, there is 23 ft of water between the top of the damaged fuel bundle and the fuel pool surface for a fuel handling accident. With a 23 ft water level, the assumptions of Reference 4 can be used directly. In practice, this LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single bundle, dropped and lying horizontally on top of the spent fuel racks, however, there may be < 23 ft of water above the top of the bundle and the surface, by the width of the bundle. The decontamination factor for 22 ft-6 in of water is essentially the same as that for 23 ft of water so the intent of Regulatory Guide 1.25-is met.

The fuel storage pool water level satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2.3 B 3.7.14-1 REVISION 0

Fuel Storage Pool Water Level B 3.7.14 BASES LCO The specified water level preserves the assumptions of the fuel handling accident analysis (Ref. 3). As such, it is the minimum required for fuel storage and movement within the fuel storage pool.

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the fuel storage pool since the potential for a release of fission products exists.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply.

When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. When the fuel storage pool water level is lower than the required level, the movement of irradiated fuel assemblies in the fuel storage pool is immediately suspended. This effectively precludes a spent fuel handling accident from occurring This does not preclude moving a fuel assembly to a safe position.

If moving irradiated fuel assemblies while in MODE 5 or 6.

LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODES 1. 2. 3. and 4.

the fuel movement is independent of reactor operations.

Therefore, in either case, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.14-2 REVISION 21

Fuel Storage Pool Water Level B 3.7.14 BASES SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. The 7 day Frequency is appropriate because the volume in the pool is normally stable. Water level changes are control led by unit procedures and are acceptable, based on operating experience.

During refueling operations, the level in the fuel storage pool is at equilibrium with that of the refueling canal, and the level in the refueling canal is checked daily in accordance with LCO 3.9.6, "Refueling Water Level-Fuel Assemblies".

REFERENCES 1. UFSAR, Section 9.1.2.

2. UFSAR, Section 9.1.3.

3. UFSAR, Section 15.7.4.

4. Regulatory Guide 1.25

5. 10 FR 100.11.

PALO VERDE UNITS 1,2.3 B 3.7.14-3 REVISION 21

This page intentionally blank AC Sources - Shutdown B 3.8.2 BASES LCO offsite circuit. Together, OPERABILITY of the required (continued) offsite circuit and DG ensures the availability of sufficient AC sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

The offsite circuit must be capable of maintaining rated frequency and voltage, and accepting required loads during an accident, while connected to the Engineered Safety Feature (ESF) bus(es). Offsite circuits are those that are described in the updated FSAR and are part of the licensing basis for the unit. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of the offsite circuit.

The DG must be capable of starting, accelerating to rated speed and voltage, connecting to its respective ESF bus on detection of bus undervoltage. This sequence must be accomplished within 10 seconds. The DG must be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby condition with the engine hot and DG in standby condition at normal keep-warm conditions.

Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY.

In addition, proper sequencer operation is an integral part of offsite circuit OPERABILITY since its inoperability impacts on the ability to start and maintain energized loads required OPERABLE by LCO 3.8.10.

It is acceptable for trains to-be cross tied during shutdown conditions, allowing a single offsite power circuit to supply all required trains.

APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6. and during movement of irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel assemblies:

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.2-3 REVISION 0

AC Sources - Shutdown B 3.8.2 BASES APPLICABILITY b. Systems needed to mitigate a fuel handling accident (continued) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

The AC power requirements for MODES 1, 2. 3. and 4 are covered in LCO 3 8.1.

ACTIONS The ACTIONS are modified by a Note that identifies required Actions A 2.3 and B.3 are not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A.1 An offsite circuit would be considered inoperable if it were not available to one required ESF train. Although two trains may be required by LCO 3.8 10. the remaining train with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the option to declare required features inoperable, with no offsite power available, appropriate restrictions will be implemented in accordance with the affected required features LCO's ACTIONS.

A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4 With the offsite circuit not available to all required trains, the option would still exist to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for (continued)

PALO VERDE UNITS 1.2.3 B 3.8.2-4 REVISION 21

AC Sources - Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, A.2.4, B.1. B.2. B.3, and B.4 (continued) sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is. therefore, required to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions. The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the required SDM is maintained.

Suspension of these activities does not preclude completion of actions to establish a safe conservative condition. If moving irradiated fuel assemblies while in MODES 1, 2, 3. or 4, the fuel movement is independent of reactor operations.

Therefore, inability to immediately suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the unit safety systems may be without sufficient power.

Pursuant to LCO 3.0.6. the Distribution System's ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A are modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must be immediately entered. 'This Note allows Condition A to provide requirements for the loss of the offsite circuit, whether or not a train is de-energized. LCO 3.8.10 provides the appropriate restrictions for the situation involving a de-energized train.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.2-5 REVISION 21

AC Sources - Shutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 REQUIREMENTS SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 3. and 4. The SRs that are applicable and required to be performed are SR 3.8.1.1, SR 3.8.1.2, SR 3.8.1.4, SR 3.8.1.5, and SR 3.8.1.7. The SRs listed in the Note are not required to be performed as a condition of OPERABILITY because their performance would unnecessarily challenge the only remaining OPERABLE DG or offsite circuit. In addition, SR 3.8.1.6 is not required to be performed since the fuel oil transfer pump would not cycle without the one-hour load demand SR or the 24-hour run SR, neither of which is required to be performed.

The reasons for the exception to SR 3.8.2.1 applicability are as follows: SR 3 8.1.8 is not applicable since only one offsite circuit is required to be OPERABLE and an alternate offsite circuit may not be available; SR 3 8.1.12, SR 3.8.1.17. and SR 3.8.1 19 are not applicable because the ESF functions (i.e., AFAS and SIAS) are not required to be OPERABLE during shutdown: SR 3.8.1.17 is not applicable because the required OPERABLE DG(s) is not required to undergo periods of being load tested (parallel to the offsite circuit). SR 3.8.1.20 is not applicable because starting independence is not required with DG(s) that are not required to be OPERABLE.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during performance of SRs, and to preclude deenergizing a required 4160 V ESF bus of disconnecting a required offsite circuit during performance of SRs. With limited AC Sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE.

Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.

REFERENCES None.

PALO VERDE UNITS 1,2,3 B 3.8.2-6 REVISION 0

DC Sources - Shutdown B 3.8.5 BASES LCO required to be OPERABLE by LCO 3.8.10, the necessary (continued) DC buses of that additional DC distribution subsystem train shall be energized by a minimum of its associated battery charger or backup battery charger. Should the minimum battery charger requirements not be maintained for that additional DC distribution subsystem train required by LCO 3.8.10, then LCO 3.8.10 (Condition 'A') would be applicable and not LCO 3.8.5. This is because the requirements of LCO 3.8.5 would still be met (i.e. one OPERABLE DC electrical power subsystem maintained).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 and 6. and during movement of irradiated fuel assemblies provide assurance that:

a. Required features needed to mitigate a fuel handling accident are available:

b. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available: and

c. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

The DC electrical power requirements for MODES 1, 2, 3.

and 4 are covered in LCO 3.8.4.

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A.1. A.2.1. A.2.2, A.2.3. and A.2.4 If two 125 VDC trains' buses are required to be energized per LCO 3.8.10, of the two required trains, the remaining (continued)

PALO VERDE UNITS 1,2,3 B 3.8.5-3 REVISION 21

DC Sources - Shutdown B 3.8.5 BASES ACTIONS A.1, A.2.1. A.2.2, A.2.3, and A.2.4 (continued) buses with DC power available may be capable of supporting sufficient systems to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCO ACTIONS. For example, assume that the

'A' train 125 VDC sources are required to be OPERABLE per LCO 3.8.5. Also assume that two SDC trains are required to be OPERABLE and the corresponding 125VDC trains' buses energized (i.e. PK system buses 'A' and 'C' for train 'A' and buses 'B' and 'D' for train 'B') per LCO 3.8.10 Finally, assume that an electrical fault occurs on the PK system channel 'C' bus and the bus has been declared INOPERABLE. The action of LCO 3.8.5 would allow declaring the corresponding SDC suction valve J-SIC-UV-653 INOPERABLE.

However the SDC system itself would not necessarily need to be declared INOPERABLE and this would allow CORE ALTERATIONS to continue. However, in many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions). The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required SDM is maintained.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. If moving irradiated fuel assemblies while in MODES 1. 2, 3, or 4, the fuel movement is independent of reactor operations.

Therefore, inability to immediately suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystem and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystem should be completed as quickly as possible in order to (continued)

PALO VERDE UNITS 1.2.3 B 3.8.5-4 REVISION 21

Inverters - Shutdown B 3.8.8 BASES LCO equipment are required to be OPERABLE by LCO 3.8.10, the (continued) necessary AC vital instrument bus(es) associated with the additional train of inverters shall be energized by either the bus(es)' associated inverter or AC voltage regulator.

For those situations where an AC vital instrument bus associated with the additional train of inverters is energized by its inverter, the corresponding DC bus must be energized by a minimum of its associated battery charger or backup battery charger per LCO 3.8.5.

APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6. and during movement of irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core:

b. Systems needed to mitigate a fuel handling accident are available:

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available: and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

Inverter requirements for MODES 1. 2, 3, and 4 are covered in LCO 3.8.7.

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A.1, A.2.1, A.2.2, A.2.3. and A.2.4 If two trains of AC vital instrument buses are required by LCO 3.8.10, "Distribution Systems - Shutdown," of the two required trains, the remaining bus(es) with AC power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, fuel (continued)

PALO VERDE UNITS 1.2,3 B 3.8.8-3 REVISION 21

Inverters - Shutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3. and A.2.4 (continued) movement, operations with a potential for draining the reactor vessel, and operations with a potential for positive reactivity additions. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions). The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required SDM is maintained.

Suspension of these activities shall not preclude completion of actions to establish a.safe conservative condition. If moving irradiated fuel assemblies while in MODES 1, 2. 3, or 4, the fuel movement is independent of reactor operations.

Therefore, inability to immediately suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital instrument buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital instrument buses. The 7 day Frequency takes into account the redundant (continued)

PALO VERDE UNITS 1,2.3 B 3.8.8-4 REVISION 21

Distribution Systems - Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems - Shutdown BASES BACKGROUND A description of the AC, DC, and AC vital instrument bus electrical power distribution systems is provided in the Bases for LCO 3.8.9. "Distribution Systems - Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2). assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC. and AC vital instrument bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC, DC, and AC vital instrument bus electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC, DC, and AC vital instrument bus electrical power distribution subsystems during MODES 5 and 6, and during movement of irradiated fuel assemblies, ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods:

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

The AC and DC electrical power distribution systems satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.10-1 REVISION 0

I Distribution Systems - Shutdown B 3.8.10 BASES (continued)

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific unit condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of required systems, equipment and components - all specifically addressed in each LCO and implicitly required via the definition of OPERABILITY.

Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the unit in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,

fuel handling accidents).

APPLICABILITY The AC, DC, and AC vital instrument bus electrical power distribution subsystems required to be OPERABLE in MODES 5 and 6. and during movement of irradiated fuel assemblies, provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core:

b. Systems needed to mitigate a fuel handling accident are available:

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition and refueling condition.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

The AC, DC, and AC vital instrument bus electrical power distribution subsystem requirements for MODES 1. 2, 3. and 4 are covered in LCO 3.8.9.

(continued)

PALO VERDE UNITS 1,2.3 B 3.8.10-2 REVISION 21

ML030520063

Contents

Text

Dear Sirs:

Subject:

Enclosure:

Navigation menu

ML030520063

Text

Dear Sirs:

Subject:

Enclosure:

Navigation menu

Search