Text

Report of Changes to Technical Specifications Bases
	ML033000111
Person / Time
Site:	Palisades
Issue date:	10/17/2003
From:	Domonique Malone; Nuclear Management Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML033000111 (226)
	v • d • e

Nt cn Commited to NudearExce~ Palisades Nuclear Plant Operated by Nuclear Management Company, LLC October 17, 2003 10 CFR 50.4 U S Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 PALISADES NUCLEAR PLANT DOCKET 50-255 LICENSE No. DPR-20 REPORT OF CHANGES TO TECHNICAL SPECIFICATIONS BASES This report is submitted in accordance with Palisades Technical Specification 5.5.12.d, which requires that changes to the Technical Specifications Bases, implemented without prior Nuclear Regulatory Commission (NRC) approval, be provided to the NRC on a frequency consistent with 10 CFR 50.71(e). Attachment 1 provides a listing of all bases changes since issuance of the previous report, dated October 31, 2002, and identifies the affected sections and nature of the changes. Attachment 2 provides page change instructions and a copy of the current Technical Specifications Bases List of Effective Pages, Title Page, and the revised Technical Specification Bases sections listed in Attachment 1.

This letter contains no new commitments and no revisions to existing commitments.

Daniel J. Mat Site Vice-President, Palisades Nuclear Plant CC Regional Administrator, USNRC, Region IlIl Project Manager, Palisades Nuclear Plant, USNRC, NRR NRC Resident Inspector - Palisades Nuclear Plant Attachments 601 27780 Blue Star Memorial Highway Covert, Michigan 49043-9530 Telephone: 269.764.2000 I

ATTACHMENT I NUCLEAR MANAGEMENT COMPANY PALISADES NUCLEAR PLANT DOCKET 50-255 October 17, 2003 TECHNICAL SPECIFICATIONS BASES CHANGES CHRONOLOGY 2 Pages Follow

TECHNICAL SPECIFICATION BASES CHANGE CHRONOLOGY AFFECTED DATE SECTION(S) CHANGE(S)

12/02/02 B 3.4.7 Clarified description of primary coolant system (PCS) loops filled and incorporated recommendations of Nuclear Regulatory Commission (NRC) Information Notice 95-35, "Degraded Ability of Steam Generator to Remove Decay Heat by Natural Circulation."

12/02/02 B 3.7.2 Clarified description of when surveillance requirements B 3.7.3 (SRs) for main steam isolation valves and main feedwater regulating valves are performed.

12/10/02 B 3.6.1 Clarified relationship of Palisades design and licensing B 3.6.2 bases for Containment limiting conditions for operation B 3.6.3 (LCOs.)

12/30/02 B 3.1.4 Clarified description for operability of primary and secondary rod position indication channels.

1/22/03 B 3.3.1 Human factor changes to Table B 3.3.1-1, "Instruments B 3.3.3 Affecting Multiple Specifications," and corrections.

1/22/03 B 3.6.6 Clarified 100% post accident containment cooling requirements.

4/4/03 B 3.0 Make bases consistent with NRC approved Amendment 210, which addressed SR 3.0.3 delay period before entering an LCO following a missed surveillance.

4/4/03 B 3.6.6 Make bases consistent with NRC approved Amendment 211, which addressed testing frequency for containment spray nozzles.

7/16/03 B 3.7.12 Deletes unnecessary information concerning charcoal filter bypass during a fuel cask drop event that is more correctly described in the Final Safety Analysis Report, which is referenced by B 3.7.12.

7/16/03 B 3.8.1 Clarifies reason why diesel generator is considered inoperable when paralleled to the grid. Also made editorial correction to SR 3.8.1.8 with respect to testing conducted and relationship to Regulatory Guide 1.9,

'Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants."

7/16/03 B 3.4.16 Clarifies requirements in SR 3.4.16.2 for PCS activity sample requirements following power changes of 2_15%.

1

TECHNICAL SPECIFICATION BASES CHANGE CHRONOLOGY AFFECTED:,

DATE SECTION(S) CHANGE(S)-

7/30/03 B 3.1.4 Clarifies term "immovable" for a full-length control rod in B 3.1.5 LCO 3.1.4 Condition D and corrects editorial errors in B 3.1.6 existing bases.

8/12/03 B 3.6.2 Clarifies that air lock test isolation valves are considered to be part of associated containment air lock door for purposes of operability.

9/9/03 B 3.1.2 Corrects editorial errors in existing bases.

B 3.3.4 B 3.6.5 B 3.7.14 2

ATTACHMENT 2 NUCLEAR MANAGEMENT COMPANY PALISADES NUCLEAR PLANT DOCKET 50-255 October 17, 2003 REVISED TECHNICAL SPECIFICATIONS BASES Page Change Instructions List of Effective Pages Title Page B 3.0, B 3.1.2, B 3.1.4, B 3.1.5, B 3.1.6, B 3.3.1, B 3.3.3, B 3.3.4, B 3.4.7, B 3.4.16, B 3.6.1, B 3.6.2, B 3.6.3, B 3.6.5, B 3.6.6, B 3.7.2 B 3.7.3, B 3.7.12, B 3.7.14, B 3.8.1 (List of Effective Pages and Bases section pages are double-sided) 117 Pages Follow

TECHNICAL SPECIFICATIONS BASES CHANGES: OCTOBER 2003 FACILITY OPERATING LICENSE DPR-20 DOCKET NO. 50-255 Page Change Instructions Revise your copy of the Palisades Technical Specifications Bases with the attached revised pages. The revised pages are identified by amendment number or revision date at the bottom of the pages and contain vertical lines in the margin indicating the areas of change.

REMOVE INSERT List of Effective Pages List of Effective Pages Title Page Title Page Section B 3.0 Section B 3.0 Section B 3.1.2 Section B 3.1.2 Section B 3.1.4 Section B 3.1.4 Section B 3.1.5 Section B 3.1.5 Section B 3.1.6 Section B 3.1.6 Section B 3.3.1 Section B 3.3.1 Section B 3.3.3 Section B 3.3.3 Section B 3.3.4 Section B 3.3.4 Section B 3.4.7 Section B 3.4.7 Section B 3.4.16 Section B 3.4.16 Section B 3.6.1 Section B 3.6.1 Section B 3.6.2 Section B 3.6.2 Section B 3.6.3 Section B 3.6.3 Section B 3.6.5 Section B 3.6.5 Section B 3.6.6 Section B 3.6.6 Section B 3.7.2 Section B 3.7.2 Section B 3.7.3 Section B 3.7.3 Section B 3.7.12 Section B 3.7.12 Section B 3.7.14 Section B 3.7.14 Section B 3.8.1 Section B 3.8.1 I,

PALISADES TECHNICAL SPECIFICATIONS BASES I LIST OF EFFECTIVE PAGES COVERSHEET Title Page 211 - Revised 04/04/03 TABLE OF CONTENTS Page i 205 Page ii 189 TECHNICAL SPECIFICATIONS BASES Bases 2.0 Pages B 2.1.1-1 -B 2.1.1-4. Revised 09/28/01 Pages B 2.1.2 B 2.1.2-4 189 Bases 3.0 Pages B 3.0 B 3.0-15 Revised 04/04/03 Bases 3.1 Pages B 3.1.1-1 - B 3.1.1-5 189 Pages B 3.1.2-1 - B 3.1.2-6 Revised 09/09/03 I Pages B3.1.3-1 -B3.1.3-4 189 Pages B 3.1.4-1 - B 3.1.4-13 Revised 07/30/03 Pages B 3.1.5-1 - B 3.1.5-7 Revised 07/30/03 Pages B 3.1.6-1 - B 3.1.6-9 Revised 07/30/03 Pages B 3.1.7-1 - B 3.1.7-6 189 - Revised 08/09/00 Bases 3.2 Pages B 3.2.1-1 - B 3.2.1-11 Revised 09/28/01 Pages B 3.2.2 B 3.2.2-3 Revised 09/28/01 Pages B 3.2.3 B 3.2.3-3 Revised 09/28/01 Pages B 3.2.4 B 3.2.4-3 189- Revised 08/09/00 Bases 3.3 'Pages B 3.3.1 B 3.3.1-35 Revised 01/22/03 Pages B 3.3.2 B 3.3.210 189- Revised 02/12/01 Pages B 3.3.3 B 3.3.3-24 -Revised 01/22/03 Pages B 3.3.4 B 3.3.4-12 Revised 09/09/03 I Pages B 3.3.5 B 3.3.56 - 189 Pages B 3.3.6 B 3.3.6-6 189 - Revised 02/12/01 Pages B 3.3.7 B 3.3.7-12 Revised 05/04/01 Pages B 3.3.8 B 3.3.8-6 189 Pages B 3.3.9 B 3.3.9-5 189 - Revised 08/09/00 Pages B 3.3.10 B 3.3.1074 189 Bases 3.4 Pages B 3.4.1 B 3.4.1-5 189 Pages B 3.4.2 B 3.4.2-2 189 Pages B 3.4.3 B 3.4.3-7, 189 Pages B 3.4.4 B 3.4.4-4 189 Pages B 3.4.5 B 3.4.5-5 189 - Revised 08/09/00 Pages B 3.4.6 B 3.4.6-6 189 - Revised 02/12/01 Pages B 3.4.7 B 3.4.7-7 Revised 12/02/02 Pages B 3.4.8 B 3.4.8-5 189- Revised 02/12/01 Pages B 3.4.9 B 3.9.6 189 Pages B 3.4.10 B 3.4.10-4 189 Pages B 3.4.11 B 3.4.11-7 189- Revised 08/09/00 Pages B 3.4.12 B 3.4.12-13 Revised 07/22/02 Pages B 3.4.13 B 3.4.13-6 Revised 07/22/02 Pages B 3.4.14 B 3.4.14-8 189 - Revised 08/09/00 Pages B 3.4.15 B 3.4.15-6 Revised 07/22/02 Pages B 3.4.16 B 3.4.16-5 Revised 07/16/03 Revised 09/09/2003

PALISADES TECHNICAL SPECIFICATIONS BASES 2 LIST OF EFFECTIVE PAGES Bases 3.5 Pages B 3.5.1-1 - B 3.5.1-5 189 Page B 3.5.1-6 191 Page B 3.5.1-7 189 Page B 3.5.1-8 191 Pages B 3.5.2-1 - B 3.5.2-12 Revised 04/22/2002 Pages B 3.5.3-1 - B 3.5.3-4 Revised 07/22/02 Pages B 3.5.4-1 - B 3.5.4-7 Revised 04/22/2002 Pages B 3.5.5-1 - B 3.5.5-5 189 Bases 3.6 Pages B 3.6.1-1 -B3.6.1-4 Revised 12/10/02 Pages B 3.6.2-1 - B 3.6.2-8 Revised 08/12/03 Pages B 3.6.3-1 - B 3.6.3-11 Revised 12/10/02 Pages B 3.6.4-1 - B 3.6.4-3 Revised 04/27/01 Pages B 3.6.5-1 - B 3.6.5-3 Revised 09/09/03 Pages B 3.6.6-1 - B 3.6.6-12 Revised 04/04/03 Pages B 3.6.7-1 - B 3.6.7-6 189- Revised 11/09/00 Bases 3.7 Pages B 3.7.1 B 3.7.1-4 189- Revised 02/12/01 Pages B 3.7.2 B 3.7.2-6 Revised 12/02/02 Pages B 3.7.3 B 3.7.3-5 Revised 12/02102 Pages B 3.7.4 B 3.7.4-4 189 - Revised 08/09/00 Pages B 3.7.5 B 3.7.5-9 Revised 08/01/01 Pages B 3.7.6 B 3.7.6-4 189 - Revised 08/09/00 Pages B 3.7.7 B 3.7.7-9 Revised 07/22/02 Pages B 3.7.8 B 3.7.8-8 Revised 08/01/01 Pages B 3.7.9 B 3.7.9-3 Revised 07/16/01 Pages B 3.7.10 B 3.7.10-7 Revised 08/01/01 Pages B 3.7.11 B 3.7.11-5 189 Pages B 3.7.12 B 3.7.12-7 Revised 07/16/03 Pages B 3.7.13 B 3.7.13-3 189 - Revised 08/09/00 Pages B 3.7.14 B 3.7.14-3 Revised 09/09/03 Pages B 3.7.15 B 3.7.15-2 207 Pages B 3.7.16 B 3.7.16-3 207 Pages B 3.7.17 B 3.7.17-3 Revised 07/22/02 Bases 3.8 Pages B 3.8.1 B 3.8.1-24 Revised 07/16/03 Pages B 3.8.2 B 3.8.2-4 Revised 11/06/01 Pages B 3.8.3 B 3.8.3-7 Revised 07/22/02 Pages B 3.8.4 B 3.8.4-9 189 - Revised 08/09/00 Pages B 3.8.5 B 3.8.5-3 Revised 11/06/01 Pages B 3.8.6 B 3.8.6-6 189 - Revised 08/09/00 Pages B 3.8.7 B 3.8.7-3 189 Pages B 3.8.8 B 3.8.8-3 Revised 11/06/01 Pages B 3.8.9 B 3.8.9-7 Revised 11/06/01 Pages B 3.8.10 B 3.8.10-3 Revised 11/06/01 Bases 3.9 Pages B 3.9.1 B 3.9.1-4 189 - Revised 08/09/00 Pages B 3.9.2 B 3.9.2-3 189 - Revised 02/12/01 Pages B 3.9.3 B 3.9.3-6 189 - Revised 08/09/00 Pages B 3.9.4 B 3.9.44 Revised 07/22/02 Pages B 3.9.5 B 3.9.5-4 189 - Revised 02/12/01 Pages B 3.9.6 B 3.9.6-3 189- Revised 02/27/01 C

Revised 09/09/2003

I If PALISADES PLANT FACILITY OPERATING LICENSE DPR-20 APPENDIX A TECHNICAL SPECIFICATIONS BASES As Amended Through Amendment No. 211 Revised 04/04/2003

LCO Applicability B3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCO - LCO 3.0.1 through LCO 3.0.7 establish the general requirements applicable to all Specifications and apply at all times unless otherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the plant is in the MODES or other specified conditions of the Applicability statement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon'discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is'applicable from the point in time that an ACTIONS Condition is entered. The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which'the LCO must be met. This time limit is the Completion Time to restore an'inoperable system or component to OPERABLE status or to restore variables to within specified limits.

If this type of Required Action is not completed within the specified Compl6tion Time, a shutdown may be required to place the plant in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.)

Palisades Nuclear Plant B 3.0-1 Revised 04/04/2003

LCO Applicability B 3.0, BASES LCO 3.0.2 The second type of Required Action specifies the remedial measures that (continued) permit continued operation of the plant that is not further restricted by the Completion Time. In this case, compliance with the Required Actions provides an acceptable level of safety for continued operation.

Completing the Required Actions is not required when an LCO is met or is no longer applicable, unless otherwise stated in the individual Specifications.

The nature of some Required Actions of some Conditions necessitates that, once the Condition is entered, the Required Actions must be completed even though the associated Conditions no longer exist. The individual LCO's ACTIONS specify the Required Actions where this is the case. An example of this is in LCO 3.4.3, "PCS Pressure and Temperature (PIT) Limits."

The Completion Times of the Required Actions are also applicable when a system or component is removed from service intentionally. The reasons for intentionally relying on the ACTIONS include, but are not limited to, performance of Surveillances, preventive maintenance, corrective maintenance, or investigation of operational problems.

Entering ACTIONS for these reasons must be done in a manner that (

does not compromise safety. Intentional entry into ACTIONS should not be made for operational convenience. Additionally, if intentional entry into ACTIONS would result in redundant equipment being inoperable, alternatives should be used instead. Doing so limits the time both subsystems/trains of a safety function are inoperable and limits the time conditions exist which may result in LCO 3.0.3 being entered. Individual Specifications may specify a time limit for performing an SR when equipment is removed from service or bypassed for testing. In this case, the Completion Times of the Required Actions are applicable when this time limit expires, if the equipment remains removed from service or bypassed.

When a change in MODE or other specified condition is required to comply with Required Actions, the plant may enter a MODE or other specified condition in which another Specification becomes applicable.

In this case, the Completion Times of the associated Required Actions would apply from the point in time that the new Specification becomes applicable and the ACTIONS Condition(s) are entered.

Palisades Nuclear Plant B 3.0-2 Revised 0410412003

LCO Applicability B 3.q BASES LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or

b. The condition of the plant is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the plant. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.

This Specification delineates the time limits for placing the plant in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

Upon entering LCO 3.0.3,'1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to prepare for an orderly shutdown before initiating a change in plant operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to reach lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is w'-ell within the specified maximum cooldown rate and within the capabilities of the plant, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Primary Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.

Palisades Nuclear Plant B 3.0-3 Revised 04/04/2003

LCO Applicability B 3.0 BASES (

LCO 3.0.3 A plant shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCOis now met.

b. A Condition exists for which the Required Actions have now been performed.

C. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the plant to be in MODE 5 when a shutdown is required during MODE 1 operation. If the plant is in a lower MODE of operation when a shutdown is required, the time limit for reaching the next lower MODE applies. If a lower MODE is reached in less time than allowed, however, the total allowable time to reach MODE 5, or other applicable MODE, is not reduced. For example, if MODE 3 is reached in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for reaching MODE 4 is the next 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months , because the total time for reaching MODE 4 is not reduced from the allowable limit of 31 hours3.587963e-4 days 0.00861 hours 5.125661e-5 weeks 1.17955e-5 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to reach a lower MODE of operation in less'than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 5 and 6 because the plant is already in the most restrictive Condition required by LCO 3.0.3.

The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken. Exceptions to LCO 3.0.3 are provided in instances where requiring a plant shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the plant.

An example of this is in LCO 3.7.14, "Spent Fuel Pool Water Level."

Palisades Nuclear Plant B 3.0-4 Revised 04104/2003

LCO Applicability B3.0 BASES t

LCO 3.0.3 LCO 3.7.14 has an Applicability of "During movement of irradiated fuel (continued) assemblies in the spent fuel pool." Therefore, this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.14 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the plant ina shutdown condition. The Required Action of LCO 37.14 of "Suspend movement of irradiated fuel assemblies in spent fuel pool" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the

-individual Specifications.

LCO 3.0.4' LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It precludes placing the plant in a MODE or other specified condition stated in that Applicability (e.g., Applicability desired to be entered) when the following exist:

a. Plant conditions are such that the requirements of the LCO would not be met in the Applicability desired to be entered; and

b. Continued noncompliance with the LCO requirements, if the Applicability were entered, would result in the plant being required to exit the Applicability desired to be entered to comply with the Required Actions.

Compliance with Required Actions that permit continued operation of the plant for an unlimited period of time in a MODE or other-specified condition provides an acceptable level of safety for continued operation.

This is without regard to the status of the plant before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other'specified condition in the Applicability.

The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS.

Palisades Nuclear Plant B 3.0-5 Revised 04/04/2003-

LCO Applicability B 3.0 BASES LCO 3.0.4 Exceptions to LCO 3.0.4 are stated in the individual Specifications. The (continued) exceptions allow entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time. Exceptions may apply to all the ACTIONS or to a specific Required Action of a Specification.

Surveillances do not have to be performed on the associated inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, changing MODES or other specified conditions while in an ACTIONS Condition, in compliance with LCO 3.0.4 or where an exception to LCO 3.0.4 is stated, is not a violation of SR 3.0.1 or SR 3.0.4 for those Surveillances that do not have to be performed due to the associated inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of required testing to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the required testing to demonstrate OPERABILITY. This Specification does not provide time to perform any other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being returned to service is reopening a containment isolation valve that has been closed to comply with Required Actions and must be reopened to perform the required testing.

Palisades Nuclear Plant B 3.0-6 Revised 04/04/2003

LCO Applicability B 3.Q BASES LCO 3.0.5 An example of demonstrating the OPERABILITY of other equipment is (continued) taking an inoperable channel or trip system out of the tripped condition to prevent the trip function from occurring during the performance of required testing on another channel in the other trip system. A similar example of demonstrating the OPERABILITY of other equipment is taking an inoperable channel or trip system out of the tripped condition to permit the logic to function and indicate the appropriate response during the performance of required testing on another channel in the same trip system.

LCO 3.0.6 LCO 3.0.6 establishes an 6xception to LCO 3.0.2 for support systems that have an LCO specified in the Technical Specifications (TS). This exception is provided because LCO 3.0.2 would require that the Conditions and Required Actions of the associated inoperable supported system LCO be entered solely due to the inoperability of the support system. This exception is justified because the actions that are required to ensure the plant is maintained in a safe condition are specified in the support system LCO's Required Actions. These Required Actions may include entering the supported system's Conditions and Required Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it in the TS, the supported system(s) are required to be declared inoperable if determined to be inoperable as a result of the support system inoperability. However, it is not necessary to enter into the supported systems' Conditions and Required Actions unless directed to do so by the support system's Required Actions. The potential confusion and inconsistency of requirements related to the entry into multiple support and supported systems' LCO's Conditions and Required Actions are eliminated by providing all the actions that are necessary to ensure the plant is maintained in a safe condition in the support system's Required Actions.

However, there are instances where a support system's Required Action may either direct a supported system to be declared inoperable or direct entry into Conditions and Required Actions for the supported system.

This may occur immediately or after some specified delay to perform some other Required Action. Regardless of whether it is immediate or after some delay, when a support system's Required Action directs a supported system to be declared inoperable or directs entry into, Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

Palisades Nuclear Plant B 3.0-7 Revised 04/04/2003

LCO Applicability B 3.0 BASES LCO 3.0.6 Specification 5.5.13, "Safety Functions Determination Program (SFDP),"

(continued) ensures loss of safety function is detected and appropriate actions are taken. Upon entry into LCO 3.0.6, an evaluation shall be made to determine if oss of safety function exists Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of LCO 3.0.6.

Cross train checks to identify a loss of safety function for those support systems that support multiple and redundant safety systems are required.

The cross train check verifies that the supported systems of the redundant OPERABLE support system are OPERABLE, thereby ensuring safety function is retained.

If this evaluation determines that a loss of safety function exists, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

LCO 3.0.7 Special tests and operations are required at various times over the plant's life to demonstrate performance characteristics, to perform maintenance activities, and to perform special evaluations. Because TS normally K,-

preclude these tests and operations, Special Test Exceptions (STEs) allov specified requirements to be changed or suspended under controlled conditions. STEs are included in applicable sections of the Specifications. Unless otherwise specified, all other TS requirements remain unchanged and in effect as applicable. This will ensure that all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed or suspended to perform the special test or operation will remain in effect.

The Applicability of an STE LCO represents a condition not necessarily in compliance with the normal requirements of the TS. Compliance with STE LCO is optional.

A special test may be performed under either the provisions of the appropriate STE LCO or the other applicable TS requirements. If it is desired to perform the special test under the provisions of the STE LCO, the requirements of the STE LCO shall be followed. This includes the SRs specified in the STE LCO.

{

Palisades Nuclear Plant B 3.0-8 Revised 04/04/2003

LCO Applicability B 3.0 BASES I.

LCO 3.0.7 Some of the STE LCO require that one or more of the LCO for normal (continued) operation be met (i.e., meeting the STE LCO requires meeting the specified normal LCO). The Applicability, ACTIONS, and SRs of the specified normal LCO, however, are not required to be met in order to meet the STE LCO when it is in effect. This means that, upon failure to meet a specified normal LCO, the associated ACTIONS of the STE LCO apply, in lieu of the ACTIONS of the normal LCO. Exceptions to the abbve do exist.

There are instances when the Applicability of the specified normal LCO must be met, where its ACTIONS must be taken, where certain of its Surveillances must be performed, or where all of these requirements must be met concurrently with the' requirements of the STE LCO.

Unless the SRs of the specified normal LCO are suspended or changed by the special test, those SRs that are necessary to meet the specified normal LCO must be met prior to performing the special test. Durihg the conduct of the special test, those Surveiflances need not be performed unless specified by the ACTIONS or SRs of the STE LCO.

ACTIONS for STE LCO provide appropriate remedial measures upon failure to meet the STE LCO. Upon failure to meet these ACTIONS, suspend the performance of the special test and enter the ACTIONS for all LCOs that are then not met. Entry into LCO 3.0.3 may possibly be required, but this determination should not be made by considering only the failure to meet the ACTIONS of the STE LCO.

Palisades Nuclear Plant B 3.0 Revised 04104/2003

SR Applicability B 3.Q B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known to be not met between required Surveillance performances.

Surveillances do not have to be performed when the plant is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Test Exception (STE) are only applicable when the STE is used as an allowable exception to the requirements of a Specification.

Unplanned events may satisfy the requirements (including applicable acceptance criteria) for a given SR. In this case, the unplanned event may be credited as fulfilling the performance of the SR. This allowance includes those SRs whose performance is normally precluded in a given MODE or other specified condition.

Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply. Surveillances have to be met and performed in accordance with SR 3.0.2, prior to returning equipment to OPERABLE status.

Palisades Nuclear Plant B 3.0-10 Revised 04/04/2003

SR Applicability B 3.0 BASES SR 3.0.1 Upon completion of maintenance, appropriate post maintenance testing (continued) is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary plant parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed.

An example of this process is:

a. High Pressure Safety Injection (HPSI) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with HPSI considered OPERABLE.

This allows operation to'reach the 'pecified'pressure to complete the necessary post maintenance testing.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a once per. . ." interval.

SR 3.0.2 permits a 25% extension of the interval specified in the Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g., transient conditions or other ongoing Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. An example of where SR 3.0.2 does not apply is the Containment Leak Rate Testing Program.

Palisades Nuclear Plant B 3.0-11 Revised 04/04/2003

SR Applicability B 3.0 BASES (

SR 3.0.2 As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be (continued) applied to Required Actions whose Completion Time is stated as "once per. . . however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely as an operational convenience to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been completed within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is I discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the time that the specified Frequency was not met.

This delay period provides an adequate time to complete Surveillances that have been missed. This delay period permits the completion of a Surveillance before complying with Required Actions or other remedial measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of plant conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

Palisades Nuclear Plant B 3.0-12 Revised 04/04/2003

SR Applicability B 3.Q BASES SR 3.0.3 When a Surveillance with a Frequency based not on time intervals, but (continued) upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become'applicable as a consequence of MODE changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used as an operational convenience to extend Surveillance intervals.

While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillanc'e, it is e6pected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate'risk impacts, determination of risk management action thresholds, and risk management action up to

- and including plant shutdow'r. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensee's Corrective Action Program.

Palisades Nuclear Plant B 3.0-1 3 Revised 04/04/2003

SR Applicability B 3.0 BASES SR 3.0.3 If a Surveiltance is not completed within the allowed delay period, then (continued) the equipment is considered inoperable or the variable is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 , SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified Condition in the Applicability.

This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the plant.

The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are nct required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment.

When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed.

Theref6re, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability. However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes.

The provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS.

Palisades Nuclear Plant B 3.0-14 Revised 04/04/2003

SR Applicability B3.0 BASES SR 3.0.4 The precise requirements for performance of SRs are specified such that (continued) exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite c6ndition(s) specified in a Surveillance procedure require ehtry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met.

Alternately, the Surveillance may be stated in the form of a Note as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

Palisades Nuclear Plant B 3.0-1 5 Revised 04/04/2003

.I Reactivity Balance B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Reactivity Balance BASES BACKGROUND According to the Palisades Nuclear Plant design criteria (Ref. 1),

reactivity shall be controllable, such that, subcriticality is maintained under cold conditions, and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Therefore, reactivity balance is used as a measure of the predicted versus measured core reactivity during power operation. The periodic confirmation of core reactivity is necessary to ensure that Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity difference could be the result of unanticipated changes in fuel, control rod worth, or operation at conditions not consistent with those assumed in the predictions of core reactivity, and could potentially result in a loss of SHUTDOWN MARGIN (SDM) or violation of acceptable fuel design limits. Comparing predicted versus I measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to cold, subcritical conditions.

When the reactor core is critical, a reactivity balance exists and the net reactivity is zero. A comparison of predicted and measured reactivity is convenient under such a balance, since parameters are being maintained relatively stable under steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons such as burnable absorbers. Excess reactivity can be inferred from the critical boron curve, which provides an indication of the soluble boron concentration in the Primary Coolant System (PCS) versus cycle bumup. Periodic measurement of the PCS boron concentration for comparison with the predicted value with other variables fixed (such as control rod height, temperature, pressure, and power) provides a convenient method of ensuring that core reactivity is within design expectations, and that the calculational models used to generate the safety analysis are adequate.

Plant Nuclear Plant Palisades Nuclear B3.1.2-1 Revised 09/09/2003 B 3.1.2-1 Revised 09/0912003

Reactivity Balance B 3.1.2 BASES BACKGROUND In order to achieve the required fuel cycle energy output, the uranium (continued) enrichment in the new fuel loading and in the fuel remaining from the previous cycle, provides excess positive reactivity beyond that required to sustain steady state operation throughout the cycle. When the reactor is critical at RTP and moderator temperature, the excess positive reactivity is compensated by burnable poisons, full-length control rods, neutron poisons (mainly xenon and samarium) in the fuel, and the PCS boron concentration.

When the core is producing THERMAL POWER, the fuel is being depleted and excess reactivity is decreasing. As the fuel depletes, the PCS boron concentration is reduced to decrease negative reactivity and maintain constant THERMAL POWER. The critical boron curve is based on steady state operation at RTP. Therefore, deviations from the predicted critical boron curve may indicate deficiencies in the design analysis, deficiencies in the calculational models, or abnormal core conditions, and must be evaluated.

APPLICABLE Accurate prediction of core reactivity is either an explicit or implicit SAFETY ANALYSES assumption in the accident analysis evaluations. Every accident evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of core reactivity. In particular, SDM and reactivity transients, such as control rod withdrawal accidents or control rod ejection accidents, are very sensitive to accurate prediction of core reactivity. These accident analysis evaluations rely on computer codes that have been qualified against available test data, operating plant data, and analytical benchmarks. Monitoring reactivity balance additionally ensures that the nuclear methods provide an accurate representation of the core reactivity.

Design calculations and safety analyses are performed for each fuel cycle for the purpose of predetermining reactivity behavior and the PCS boron concentration requirements for reactivity control during fuel depletion.

Revised 09/09/2003 Palisades Nuclear Plant Plant BB3.1.2-2 3.1 .2-2 Revised 09/09/2003

Reactivity Balance B 3.1.2 BASES APPLICABLE The comparison between measured and predicted initial core reactivity SAFETY ANALYSES provides a normalization for calculational models used to predict core (continued) reactivity. If the measured and predicted PCS boron concentrations for identical core conditions at Beginning Of Cycle (BOC) are not within design tolerances, then the assumptions used in the reload cycle design analysis or the calculational models used to predict soluble boron requirements may not be accurate. If reasonable agreement between measured and predicted core reactivity exists at BOC, then the prediction may be normalized to the measured boron concentration.

Thereafter, any significant deviations in the measured boron concentration from the predicted critical boron curve that develop during fuel depletion may be an indication that the calculational model is not adequate for core bumups beyond BOC, or that an unexpected change in core conditions has occurred.

The normalization of predicted PCS boron concentration to the measured value is typically performed after reaching RTP following startup from a refueling outage, with the control rods in their normal positions for power operation. The normalization is performed at BOC conditions, so that core reactivity relative to predicted values can be continually monitored and evaluated as core conditions change during the cycle.

The reactivity balance satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO The reactivity balance limit Is established to ensure plant operation Is maintained within the assumptions of the safety analyses. Large differences between actual and predicted core reactivity may indicate that the assumptions of the DBA and transient analyses are no longer valid, or that the uncertainties in the nuclear design methodology are, larger than expected. A limit on the reactivity balance of + 1% Ap has been established, based on engineering judgment. A 1% deviation in reactivity from that predicted is larger than expected for normal operation and should therefore be evaluated.

Revised 09/0912003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.1.2-3 B 3.1 .2-3 Revised 09/09/2003

Reactivity Balance B 3.1.2 BASES LCO When measured core reactivity is within +/- 1% Ap of the predicted value (continued) at steady state thermal conditions, the core is considered to be operating within acceptable design limits. Since deviations from the limits are normally detected by comparing predicted and measured steady state PCS critical boron concentrations, the difference between measured and predicted values would be approximately 100 ppm (depending on the boron worth) before the limit is reached. These values are well within the uncertainty limits for analysis of boron concentration samples, so that spurious violations of the limit due to uncertainty in measuring the PCS boron concentration is unlikely.

APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 because a reactivity balance must exist when the reactor is critical or producing THERMAL POWER. As the fuel depletes, core conditions are changing, and confirmation of the reactivity balance ensures the core is operating as designed. This specification does not apply in MODE 2 because enough operating margin exists to limit the effects of a reactivity anomaly, and THERMAL POWER is low enough

(< 5% RTP) such that reactivity anomalies are unlikely to occur. This Specification does not apply in MODES 3, 4, and 5 because the reactor is shut down and the reactivity balance is not changing.

In MODE 6, fuel loading results in a continually changing core reactivity.

Boron concentration requirements (LCO 3.9.1, "Boron Concentration")

ensure that fuel movements are performed within the bounds of the safety analysis.

ACTIONS A.1 and A.2 Should an imbalance develop between measured and predicted core reactivity, an evaluation of the core design and safety analysis must be performed. Core conditions are evaluated to determine their consistency with input to design calculations. Measured core and process parameters are evaluated to determine that they are within the bounds of the safety analysis, and safety analysis calculational models are reviewed to verify that they are adequate for representation of the core conditions.

Palisades Nuclear Plant Nuclear Plant B 3.1.2-4 B 3.1 .2-4 Revised 0910912003 Palisades Revised 09109/2003

Reactivity Balance B 3.1.2 BASES ACTIONS A.1 and A.2 (continued)

The required Completion Time of 7 days is based on the low probability of a DBA occurring during this period,' and allows sufficient time to assess the physical condition of the reactor and complete the evaluation of the core design and safety analysis.

Following evaluations of the core design and safety analysis, the cause of the reactivity imbalance may be resolved. If the cause of the reactivity imbalance is a mismatch in core conditions at the time of PCS boron concentration sampling, then a recalculation of the PCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected. 'If an unexpected physical change in the condition of the core has occurred, it must be evaluated and corrected, If possible. If the cause of the reactivity imbalance is In the calculation technique, then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated, and It is concluded that the reactor core is acceptable for continued operation, then the critical boron curve may be renormalized, and power operation may continue. If operational restrictions or additional SRs are necessary to ensure the reactor core is acceptable for continued operation, then they must be defined.

The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.

B.1 If the Required Actions for Condition A are not met within 7 days, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time is reasonable, based on operating experience, for reaching MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

3.1.2-5 Revised 09109/2003 Nuclear Plant Palisades Nuclear Plant BB3.1.2-5 Revised 09109/2003

Reactivity Balance B 3.1.2 BASES SURVEILLANCE SR 3.1.2.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted PCS boron concentrations. The comparison is made considering that other core conditions are fixed or stable including control rod position, moderator temperature, fuel temperature, fuel depletion, and xenon concentration. The Surveillance is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at BOC. The SR is modified by a Note in the Surveillance column which indicates that if the normalization of predicted core reactivity to the measured value is to occur, it must take place within the first 60 Effective Full Power Days (EFPD) after each refueling. This allows sufficient time for core conditions to reach steady state, but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations. The required subsequent Frequency of 31 EFPD following the initial 60 EFPD after entering MODE 1, is acceptable, based on the slow rate of core changes due to fuel depletion and the presence of other indicators (e.g., Tq, etc.) for prompt indication of an imbalance. A second Note, "only required after initial 60 EFPD," is added to the Frequency column to allow this.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Chapter 14 Palisades Nuclear Plant B 3.1.2-6 Revised 09/09/2003

Control Rod Alignment B 3.1.4 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 Control Rod Alignment BASES BACKGROUND The OPERABILITY (e.g., trippability) of the shutdown and regulating rods is an initial assumption in all safety analyses that assume full-length control rod insertion upon reactor trip. Maximum control rod misalignment is an initial assumption in the safety analysis that directly affects core power distributions and assumptions of available SDM.

The Palisades Nuclear Plant design criteria contain the applicable criteria for these reactivity and power distribution design requirements (Ref. 1).

Mechanical or electrical failures may cause a control rod to become inoperable or to become misaligned from its group. Control rod misalignment may cause increased power peaking, due to the asymmetric reactivity distribution, and a reduction in the total available control rod worth for reactor shutdown. Therefore, control rod alignment and OPERABILITY are related to core operation in design power peaking limits and the core design requirement of a minimum SDM.

Limits on control rod alignment and OPERABILITY have been established, and all control rod positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking and SDM limits are preserved.

Control rods are moved by their Control Rod Drive Mechanisms (CRDMs). Each CRDM moves its rod at a fixed rate of approximately 46 inches per minute. Although the ability to move a full-length control rod by its drive mechanism'is not an initial'assumption used in the safety analyses, it is required to support OPERABILITY. As such, the inability to move a full-length control 'rod results in'that full-length control rod being inoperable.

The control rods are arranged into groups that are radially symmetric.

Therefore, movement of the control rod groups does not introduce radial asymmetries in the core power distribution. The shutdown and regulating rods provide the required reactivity worth for immediate reactor shutdown upon a reactor trip. The regulating rods also provide reactivity (power level) control during nomial operation and transients.

Palisades Nuclear Plant B 3.1.4-1 Revised 07/3012003

Control Rod Alignment B 3.1.4 BASES BACKGROUND The axial position of shutdown and regulating rods is indicated by two (continued) separate and independent systems, which are 1) synchro based position indication system, and 2) the reed switch based position indication system.

The synchro based position indication system measures the phase angle of a synchro geared to the CRDM rack. Full control rod travel corresponds to less than 1 turn of the synchro. Each control rod has its own synchro. The Primary Information Processor (PIP) node scans and converts synchro outputs into inches of control rod withdrawal. The resolution of this system is approximately 0.5 inches. Each synchro also has cam operated limit switches that provide input to the matrix indication lights of control rod status indication for various key positions.

The reed switch based position indication system is referred to as the Secondary Position Indication (SPI) system. This system provides a highly accurate indication of actual control rod position, but at a lower precision than the synchros. The reed switches are wired so that the voltage read across the reed switch stack is proportional to rod position.

The reed switches are spaced along a tube with a center-to-center spacing distance of 1.5 inches. The resolution of the SPI reed switch stacks is 1.5 inches. The reed switches also provide input to the matrix indication lights that provide control rod status indication for various key positions. To increase the reliability of the system, there are redundant reed switches that prevent false indication in the event an individual reed switch fails.

A control rod position deviation alarm is provided to alert the operator when any two control rods in the same group are more than 8 inches apart. This helps to ensure any control rod misalignments are minimized. The alarm can be generated by either the SPI system or PIP node since the SPI system, in conjunction with the host computer, is redundant to the PIP node in the task of control rod measurements, control rod monitoring, and limit processing.

Palisades Nuclear Plant B 3.1.4-2 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES APPLICABLE Control rod misalignment accidents are analyzed in the safety analysis SAFETY ANALYSES (Refs. 3 and 4). The accident analysis defines control rod misoperation as any event, with the exception of sequential group withdrawals, which could result from a single malfunction in the reactivity control systems.

For example, control rod misalignment may be caused by a malfunction of the Rod Control System, or by operator error. A stuck rod may be caused by mechanical jamming. Inadvertent withdrawal of a single control rod may be caused by an electrical or mechanical failure in the Rod Control System. A dropped control rod could be caused by an electrical or mechanical failure in the CRDM.

The acceptance criteria for addressing control rod inoperability/misalignment are that:

a. There shall be no violations of:

1. Specified Acceptable Fuel Design Limits (SAFDL), or

2. Primary Coolant System (PCS) pressure boundary integrity; and

b. The core must remain-subcritical after accident transients.

Three types of misoperations are discussed in the safety analysis (Ref. 4). During movement of a group, one control rod may stop moving while the other control rods in the group continue. This condition may cause excessive power peaking. The second type of misoperations occurs if one control rod fails to insert upon a reactor trip and remains stuck fully withdrawn. This condition requires an evaluation to determine that sufficient reactivity worth is held in the remaining control rods to meet the SDM requirement with the maximum worth rod stuck fully withdrawn.

If a control rod is stuck in the fully withdrawn position, its worth is added to the SDM requirement, since the safety analysis does not take two stuck rods into account. The third type of misoperations occurs when one rod drops partially or fully into the reactor core. This event causes an initial power reduction followed by a return towards the original power, due to positive reactivity feedback from the negative moderator temperature coefficient. Increased peaking during the power increase may result in excessive local Linear Heat Rates (LHRs).

Palisades Plant Nuclear Plant 63.1.4-3 Revised 07/30/2003 Palisades Nuclear B 3.1.4-3 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES APPLICABLE The most limiting static misalignment occurs when Bank 4 is fully SAFETY ANALYSES inserted with one rod fully withdrawn ([Bank 4 is 99 inches out of (continued) alignment with the rated Power Dependent Insertion Limit [PDIL].) This event was bounded by the dropped full-length control rod event (Ref. 4).

Since the control rod drop incidents result in the most rapid approach to SAFDLs caused by a control rod misoperation, the accident analysis analyzed a single full-length control rod drop.

The above control rod misoperations may or may not result in an automatic reactor trip. In the case of the full-length rod drop, a prompt decrease in core average power and a distortion in radial power are initially produced, which, when conservatively coupled, result in a local power and heat flux increase, and a decrease in DNBR parameters.

The results of the control rod misoperation analysis show that during the most limiting misoperation events, no violations of the SAFDLs, fuel centerline temperature, or PCS pressure occur.

Control rod alignment satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2).

LCO The limits on shutdown, regulating, and part-length rod alignments ensure that the assumptions in the safety analysis will remain valid. The requirements on OPERABILITY ensure that upon reactor trip, the full-length control rods will be available and will be inserted to provide enough negative reactivity to shut down the reactor. The OPERABILITY requirements also ensure that the control rod banks maintain the correct alignment and that each full-length control rod is capable of being moved by its CRDM. The OPERABILITY requirement for the part-length rods is that they are fully withdrawn.

The requirement is to maintain the control rod alignment to within 8 inches between any control rod and all other rods in its group. To help ensure this requirement is met, the control rod position deviation alarm generated by either the PIP node or the SPI system, must be OPERABLE and provide an alarm when any control rod becomes misaligned

> 8 inches from any other rod in its group. The safety analysis assumes a total misalignment from fully withdrawn to fully inserted. This case bounds the safety analysis for a single rod in any intermediate position.

B 3.1.44 Revised 07/30/2003 Palisades Nuclear Plant Plant B 3.1.4-4 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES LCO The primary rod position indication system is considered OPERABLE, (continued) for purposes of this specification, if the digital position readout or the PPC display provides valid rod position indication, or if the cam operated red matrix light (regulating and part-length rods only) gives positive (ON) indication of rod position. The secondary rod position indication system is considered OPERABLE, for purposes of this specification, if the magnetically operated reed switches are providing valid indication of rod position either via the plant process computer or by taking direct readings of the output from the magnetic reed switches or if the reed switch operated red matrix light (shutdown rods only) gives positive (ON) indication of rod position.

Failure to meet the requirements of this LCO may produce unacceptable power peaking factors and LHRs, or unacceptable SDM, any of which may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on control rod OPERABILITY and alignment are applicable in MODES 1 and 2 because these are the only MODES in which neutron (or fission) power is generated, and the OPERABILITY (e.g., trippability) and alignment of control rods have the potential to affect the safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not apply because the reactor Is shut down and not producing fission power. In the shutdown MODES, the OPERABILITY of the shutdown and regulating rods has the potential to affect the required SDM, but this effect can be compensated for by an increase in the boron concentration of the PCS. See LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5, and LCO 3.9.1, "Boron Concentration," for boron concentration requirements during refueling.

ACTIONS LCOs 3.1.4, 3.1.5, and 31.6, and their ACTIONS were written to support each other. The combined intent Is to assure the following:

1. There is adequate SDM available in withdrawn control rods to assure the reactor is shutdown by, and remains shutdown following, a reactor trip,

2. The control rod positioning does not cause unacceptable axial or radial flux peaking, and

3. The programmed rod withdrawal sequence and group overlap result in reactivity insertion rates within the assumptions of the Inadvertent Control Rod Bank Withdrawal Analyses.

Revised 07/30/2003 Palisades Nuclear Palisades Plant Nuclear Plant B 3.1.4-5 B 3.1.4-5 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES ACTIONS The ACTIONS for rods that are mispositioned (misaligned or inserted (continued) beyond the limit) were written assuming that an OPERABLE rod discovered to be mispositioned would simply be re-positioned correctly.

While the associated Conditions would have to be entered, the rod could be re-positioned (thus exiting the LCO) without taking any other Required Action. A rod that remains mispositioned was assumed to be inoperable. The analyses account for operation with one (and only one) mispositioned rod (a dropped rod being the limiting case). With more than cne mispositioned rod, the plant would be outside the bounds of the analyses and must be shutdown.

If a rod is discovered to be misaligned (ie, there is more than 8 inches between it and any other rod in its group, but all remaining rods in that group are within 8 inches of each other) Condition 3.1.4 C allows 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore the rod alignment (thus exiting the LCO), perform SR 3.2.2.1 (verification that radial peaking is within limits), or reduce power to

75%

RTP.

If one or more shutdown rods are inserted beyond the insertion limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 D (when one rod is immovable but trippable) or Condition 3.1.4 E (when a movable rod is inserted beyond its insertion limit, or when .

more than one rod is inoperable for any reason) must be entered.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If one rod cannot be moved (but is still considered trippable),

operation may continue in accordance with Condition 3.1.4 D (and 3.1.4 C if it is misaligned).

If more than one rod cannot be moved, Condition 3.1.4 E must also be entered. The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more part length rods are inserted beyond the limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 E is entered (and 3.1.4 C if it is misaligned). Condition 3.1.4 D is not applicable to part-length rods since it only addresses full-length rods. I If the rods can be moved, they should be withdrawn and all Conditions exited.

Revised 07/3012003 Palisades Nuclear Palisades Plant Nuclear Plant BB3.1.4-6 3.1 .4-6 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES ACTIONS If any part-length rods are inserted beyond the limit and cannot (continued) be moved, the plant must be placed in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more OPERABLE regulating rods are inserted beyond the limit, Condition 3.1.6 A is entered.

The rods must be restored to within limits (by rod withdrawal or power reduction) within two hours.

If a rod cannot be moved, it must be considered inoperable and Condition 3.1.4 D must be entered (and 3.1.4 C if it is misaligned).

Condition 3.1.4 D allows continued operation with one inoperable, but trippable, rod until the next reactor shutdown (MODE 3 entry). If more than one rod cannot be moved, Condition 3.1.4 E must be'entered. The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.A E.1.

The analyses do not account for the possibility of more then one rod failing to insert on a trip. While boron concentration might be adjusted to restore SHUTDOWN MARGIN, if two adjacent rods fail to insert that portion of the core could remain excessively reactive. Since the analyses must assume that one rod fails to insert, operation may not continue with a known untrippable rod. A shutdown would be required by Condition 3.1.4 E.

A.1 Rod position indication is required to allow verification that the rods are positioned and aligned as assumed in the safety analysis. If one rod position indication channel is inoperable for one or more control rods then SR 3.1.4.1 (rod position verification) is required to be performed once within 15 minutes following any rod motion in that group. This ensures that the rods are positioned as required.

B 3.1.4-7 Revised 07/3012003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.1.4-7 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES ACTIONS B.1 (continued)

When the control rod deviation alarm is inoperable, performing SR 3.1.4.1, once within 15 minutes of movement of any control rod, ensures improper control rod alignments are identified before unacceptable flux distributions occur. The specified Completion Times take into account other information continuously available to the operator in the control room, so that during control rod movement, deviations can be detected, and the protection provided by the control rod and deviation circuit is not required.

C.1 and C.2 Condition C addresses the situation where one rod in a group is misaligned, ie. there is more than 8 inches between that rod and any other rod in its group, but all remaining rods in that group are within 8 inches of each other.

A full-length control rod may become misaligned yet remain trippable. In this condition, the control rod can still perform its required function of adding negative reactivity should a reactor trip be necessary.

Regulating rod alignment can be restored by either aligning the misaligned rod(s) to within 8 inches of all other rods in its group or, aligning the misaligned rod's group to within 8 inches of the misaligned rod if allowed by the rod group insertion limits. Shutdown rod alignment can be restored by aligning the misaligned rod to within 8 inches of all other rods in its group.

If one control rod is misaligned by > 8 inches continued operation in MODES 1 and 2 may continue, provided, within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the TOTAL RADIAL PEAKING FACTOR has been verified acceptable in accordance with SR 3.2.2.1, or the power is reduced to

75% RTP.

Xenon redistribution in the core starts to occur as soon as a rod becomes misaligned. Reducing THERMAL POWER to

75% RTP ensures acceptable power distributions are maintained.

Reie 07/30/200--

Palisades Nuclear Plan Palisade Nula Plant 5 3.-

3.1 .4-8 Revised 07130/2003

Control Rod Alignment B 3.1.4 BASES ACTIONS C.1 and C.2 (continued)

For small misalignments of the control rods, there is:

a. A small effect on the time dependent long-term power distributions relative to those used in generating LCOs and Limiting Safety System Settings (LSSS) setpoints;

b. A negligible effect on the available SDM; and

c. A small effect on the ejected rod worth used in the accident analysis.

With a large control rod misalignment, however, this misalignment would cause distortion of the core power distribution. This distortion may, in turn, have a significant effect on the time dependent, long-term power distributions relative to those used in generating LCOs and LSSS setpoints.

The effect on the available SDM and the ejected rod worth used in the accident analysis remains small.

In both cases, a 2-hour time period is sufficient to:

a. Identify cause of a misaligned rod;

b. Take appropriate corrective action to realign the rods; and

c. Minimize the effects of xenon redistribution.

The Palisades analysis for rod misalignment is bounded by a single dropped rod. Therefore, rod misalignments are limited to one rod being misaligned from its group. If a full-length control rod is untrippable, it is not available for reactivity insertion during a reactor trip. With an untrippable full-length control rod, meeting the insertion limits of LCO 3.1.5, uShutdown and Part-Length Rod Group Insertion Limits," and LCO 3.1.6, Regulating Rod Group Position Limits," does not ensure that adequate SDM exists and therefore, the Actions of Condition E must be met.

Palisades Nuclear Plant B 3.1.4-9 .Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES ACTIONS D.1 (continued)

Condition D is entered whenever it is discovered that a single full-length control rod cannot be moved by its operator, either functionally or administratively, yet the control rod is still capable of being tripped (or is fully inserted). Although the ability to move a full-length control rod is not an initial assumption used in the safety analyses, it does relate to full-length control rod OPERABILITY. The inability to move a full-length control rod by its operator may be indicative of a systemic failure (other than trippability) that could potentially affect other rods. Thus, declaring a full-length control rod inoperable in this instance is conservative since it limits the number of full-length control rods that cannot be moved by their operators to only one. The Completion Time to restore an inoperable control rod to OPERABLE status is stated as prior to entering MODE 2 following next MODE 3 entry. This Completion Time allows unrestricted operation in MODES 1 and 2 while conservatively preventing a reactor startup with an immovable full-length control rod.

E.1 If the Required Action or associated Completion Time of Condition A, Condition B, Condition C, or Condition D is not met; one or more control rods are inoperable for reasons other than Condition D (ie, one full length control rod is inoperable for reasons other than being "immovable but trippable," or more than one control rod, whether full length or part length, are inoperable for any reasons); or two or more control rods are misaligned by > 8 inches, or two channels of control rod position indication are inoperable for one or more control rods, the plant is required to be brought to MODE 3. By being brought to MODE 3, the plant is brought outside its MODE of applicability. Continued operation is not allowed in the case of more than one control rod misaligned from any other rod in its group by > 8 inches, or two or more rods inoperable. This is because these cases may be indicative of a loss of SDM and power re-distribution, and a loss of safety function, respectively.

Also, if no rod position indication exists for one or more control rods, continued operation is not allowed because the safety analysis assumptions of rod position cannot be ensured.

When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

Revised 07/30/2003 Palisades Nuclear Plant Plant B 3.1.4-10 B 3.1 .4-1 0 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES SURVEILLANCE SR 3.1.4.1 REQUIREMENTS Verification that individual control rod positions are within 8 inches of all other control rods in the group at a 12-hour Frequency allows the operator to detect a control rod that is beginning to deviate from its expected position. The specified Frequency takes into account other control rod position information that is continuously available to the operator in the control room, so that during control rod movement, deviations can be detected. Also protection can be provided by the control rod deviation alarm.

SR 3.1.4.2 OPERABILITY of two control rod position indicator channels is required to determine control rod positions, and thereby ensure compliance with the control rod alignment and insertion limits. Performance of a CHANNEL CHECK on the primary and secondary control rod position indication channels provides confidence in the accuracy of the rod position indication systems. The control rod "full in" and "full outr lights, which correspond to the lower electrical limit and the upper electrical limit respectively, provide an additional means for determining the control rod positions when the control rods are at either their fully inserted or fully withdrawn positions.

The 12-hour Frequency takes into consideration other information continuously available to the operator in the control room, so that during control rod movement, deviations can be detected, and protection can be provided by the control rod deviation alarm.-

Palisades Nuclear Plant B 3.1.4-1 1 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES SURVEILLANCE SR 3.1.4.3 REQUIREMENTS (continued) Verifying each full-length control rod is trippable would require that each full-length control rod be tripped. In MODES 1 and 2, tripping each full-length control rod would result in radial or axial power tilts, or oscillations. Therefore, individual full-length control rods are exercised every 92 days to provide increased confidence that all full-length control rods continue to be trippable, even if they are not regularly tripped. A movement of 6 inches is adequate to demonstrate motion without exceeding the alignment limit when only one control rod is being moved.

The 92-day Frequency takes into consideration other information available to the operator in the control room and other surveillances being performed more frequently, which add to the determination of OPERABILITY of the control rods. At any time, if a control rod(s) is inoperable, a determination of the trippability of the control rod(s) must be made, and appropriate action taken. Condition 3.1.4 D would apply whenever it is discovered that a single full-length control rod cannot be moved by its operator, either functionally or administratively, yet the control rod is still capable of being tripped (or is fully inserted.)

SR 3.1.4.4 Demonstrating the rod position deviation alarm is OPERABLE verifies'the alarm is functional. The 18-month Frequency takes into account other I infornation continuously available to the operator in the control room, so that during control rod movement, deviations'can be detected.

SR :3.1.4.5 Performance of a CHANNEL CALIBRATION of each control rod position indication channel ensures the channel is OPERABLE and capable of indicating control rod position over the entire length of the control rod's travel with the exception of the secondary rod position indicating channel dead band near the bottom of travel. This dead band exists because the control rod drive mechanism housing seismic support prevents operation of the reed switches. Since this Surveillance must be performed when the reactor is shut down, an 18-month Frequency to be coincident with I refueling outage was selected. Operating experience has shown that these components usually pass this Surveillance when performed at a Frequency of once every 18 months. Furthermore, the Frequency takes into account other surveillances being performed at shorter Frequencies, which determine the OPERABILITY of the control rod position indicating systems.

Plant Nuclear Plant B 3.1.4-12 Revised 07/30/2003 Palisades Palisades Nuclear B 3.1.4-12 Revised 07/30/2003

Control Rod Alignment B 3.1.4 BASES SURVEILLANCE SR 3.1.4.6 REQUIREMENTS (continued) Verification of full-length control rod drop times determines that the maximum control rod drop time is consistent with the assumed drop time used in that safety analysis (Ref. 2). The 2.5-second acceptance criteria I is measured from the time the CRDM clutch is deenergized by the reactor protection system or test switch to 90% insertion. This time is bounded by that assumed in the safety analysis (Ref.2). Measuring drop times prior to reactor criticality, after reactor vessel head reinstallation, ensures that reactor intemals and CRDMs will not interfere with full-length control rod motion or drop time and that no degradation in these systems has occurred that would adversely affect full-length control rod motion or drop time. Individual full-length control rods whose drop times are greater than safety analysis assumptions are not OPERABLE. This SR is performed prior to criticality, based on the need to perform this Surveillance under the conditions that apply during a plant outage and because of the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.1

3. FSAR, Section 14.4

4. FSAR, Section 14.6 Palisades Nuclear Plant B 3.1.4-13 Revised 07/30/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.5 Shutdown and Part-Length Rod Group Insertion Limits BASES BACKGROUND The insertion limits of the shutdown rods are initial assumptions in all safety analyses that assume full-length control rod Insertion upon reactor trip.

The insertion limits directly affect core power distributions and assumptions of available SDM,-ejected rod worth, and initial reactivity Insertion rate.

The Palisades Nuclear Plant design criteria (Ref. 1)and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors," contain the applicable criteria for these reactivity and power distribution design requirements. Limits on shutdown rod insertion have been established, and all rod positions are monitored and controlled during power operation to ensure that the reactivity limits, ejected rod worth, and SDM limits are preserved.

The shutdown rods are arranged nto groups that are radially symmetric.

Therefore, movement of the shutdown rod groups does not introduce radial asymmetries In the core power distribution. The shutdown and regulating rod groups provide the required reactivity worth for immediate reactor shutdown upon a reactor trip.

The Palisades Nuclear Plant has four part-length control rods installed.

The part-length rods are required to remain completely withdrawn during power operation except during rod exercising performed in conjunction with SR 3.1.A.3. The part-length rods do not insert on a reactor trip.

The design calculations are performed with the assumption that the shutdown rod groups are withdrawn prior to the regulating rod groups. The shutdown rods can be fully withdrawn without the core going critical. This provides available negative reactivity for SDM In the event of boration errors. All control rod groups are controlled manually by the control room operator. During norimal plant operation, the shutdown rod groups are fully withdrawn. The shutdown rod groups must be completely withdrawn from the core prior to withdrawing any regulating rods during an approach to criticality. The shutdown rod groups are then left in this position until the reactor is shut down.

They affect core power, bumup distribution, and add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.

Palisades Nuclear Plant B 3.1.5-1 -Revised 07/30/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES APPLICABLE Accident analysis assumes that the shutdown rod groups are fully SAFETY ANALYSES withdrawn any time the reactor is critical. This ensures that:

a. The minimum SDM is maintained; and

b. The potential effects of a control rod ejection accident are limited to acceptable limits.

Control rods are considered fully withdrawn at 128 inches, since this position places them in an insignificant reactivity worth region of the integral worth curve for each bank.

On a reactor trip, all full-length control rods (shutdown and regulating),

except the most reactive rod, are assumed to insert into the core. The shutdown and regulating rod groups shall be at or above their insertion limits and available to insert the required amount of negative reactivity on a reactor trip signal. The regulating rods may be partially inserted in the core as allowed by LCO 3.1.6, "Regulating Rod Group Position Limits." The shutdown rod group insertion limit is established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)) following a reactor trip from full power.

The combination of regulating rod and shutdown rods (less the most reactive rod, which is assumed to remain fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 2). The shutdown rod group insertion limit also limits the reactivity worth of an ejected shutdown rod.

The acceptance criteria for addressing shutdown rods as well as regulating rod insertion limits and inoperability or misalignment are that:

a. There be no violation of:

1. Specified acceptable fuel design limits, or

2. Primary Coolant System pressure boundary damage; and

b. The core remains subcritical after accident transients.

Revised 0713012003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.1.5-2 B 3.1 .5-2 Revised 07/30/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES APPLICABLE As such, the shutdown and part-length rod group insertion limits affect SAFETY-ANALYSES safety analyses involving core reactivity, ejected rod worth, and SDM (continued) (Ref. 2). The part-length control rods have the potential to cause power distribution envelopes to be exceeded if inserted while the reactor is critical. Therefore, they must remain withdrawn in accordance with the limits of the LCO (Ref. 3).

The shutdown and part-length rod group insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).

LCO The shutdown and part-length rod groups must be within their insertion limits any time the reactor is critical or approaching criticality. For a control rod group to be considered above its insertion limit, all OPERABLE rods in that group, which are not misaligned, must be above the insertion limit (inoperable and misaligned rods are addressed by LCO 3.1.4). Maintaining the shutdown rod groups within their insertion limits ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. Maintaining the part-length rod group within its insertion limit ensures that the power distribution envelope is maintained.

.; APPLICABILITY The shutdown and part-length rod groups must be within their insertion limits, with the reactor in MODES I and 2. In MODE 2 the Applicability begins anytime any regulating rod is withdrawn above 5 inches. This ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. In MODE 4, 5, or 6, the shutdown rod groups are inserted in the core to at least the lower electrical limit and contribute to the SDM. In MODE 3 the shutdown rod groups may be withdrawn in preparation of a reactor startup. Refer to LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," for SDM requirements in MODES 3, 4, and 5.

LCO 3.9.1, "Boron Concentration," ensures adequate SDM in MODE 6.

The Applicability has been modified by a Note indicating the LCO requirement is suspended during SR 3.1.4.3 (rod exercise test). Control rod exercising verifies the freedom of the rods to move, and requires the individual shutdown rods to move below the LCO limits for their group.

Only the full-length rods are required to be tested by SR 3.1.4.3. The part-length rods may also be moved however, if a part-length rod is moved below the limit of the associated LCO, the Required Actions of Condition A must be taken. Positioning of an individual control rod within its group is addressed by LCO 3.1.4, "Control Rod Alignment."

Palisades Nuclear Plant IB 3.1 .5-3 Revised 07/30/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES ACTIONS LCOs 3.1.4, 3.1.5, and 3.1.6, and their ACTIONS were written to support each other. The combined intent is to assure the following:

1. There is adequate SDM available in withdrawn control rods to assure the reactor is shutdown by, and remains shutdown following, a reactor trip,

2. The control rod positioning does not cause unacceptable axial or radial flux peaking, and

3. The programmed rod withdrawal sequence and group overlap result in reactivity insertion rates within the assumptions of the Inadvertent Control Rod Bank Withdrawal Analyses.

The ACTIONS for rods that are mispositioned (misaligned or inserted beyond the limit) were written assuming that an OPERABLE rod discovered to be mispositioned would simply be re-positioned correctly.

While the associated Conditions would have to be entered, the rod could be re-positioned (thus exiting the LCO) without taking any other Required Action. A rod that remains mispositioned was assumed to be inoperable. The analyses account for operation with one (and only one) mispositioned rod (a dropped rod being the limiting case). With more than one mispositioned rod, the plant would be outside the bounds of the analyses and must be shutdown.

If a rod is discovered to be misaligned (ie, there is more than 8 inches between it and any other rod in its group, but all remaining rods in that group are within 8 inches of each other) Condition 3.1.4 C allows 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore the rod alignment (thus exiting the LCO), perform SR 3.2.2.1 (verification that radial peaking is within limits), or reduce power to

75% RTP.

If one or more shutdown rods are inserted beyond the insertion limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 D (when one rod is immovable but trippable) or Condition 3.1.4 E (when a movable rod is inserted beyond its insertion limit, or when more than one rod is inoperable for any reason) must be entered.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If one rod cannot be moved (but is still considered trippable),

operation may continue in accordance with Condition 3.1.4 D (and 3.1.4 C if it is misaligned).

Revised 0713012003 Nuclear Plant Palisades Nuclear Plant B 3.1.-4 B 3.1 .5-4 Revised 07130/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES ACTIONS If more than one rod cannot be moved, Condition 3.1.4 E must also (continued) be entered. The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more part-length rods are inserted beyond the limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 E is entered (and 3.1.4 C if it is misaligned). Condition 3.1.4 D is not applicable to part-length rods since it only addresses full-length rods.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If any part-length rods are inserted beyond the limit and cannot be moved, the plant must be placed in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more OPERABLE regulating rods are inserted beyond the limit, Condition 3.1.6 A is entered; The rods must be restored to within limits (by rod withdrawal or power reduction) within two hours.

If a rod cannot be moved, it must be considered inoperable and Condition 3.1.4 D must be entered (and 3.1.4 C if it is misaligned).

Condition 3.1.4 D allows continued operation with one inoperable, but trippable, rod until the next reactor shutdown (MODE 3 entry). If more than one rod cannot be moved, Condition 3.1.4 E must be entered.

The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

The analyses do not account for the possibility of more then one rod failing to insert on a trip. While boron concentration might be adjusted to restore SHUTDOWN MARGIN, if two adjacent rods fail to insert that portion of the core could remain excessively reactive. Since the analyses must assume that one rod fails to insert, operation may not continue with a known untrippable rod. A shutdown would be required by Condition 3.1.4 E.

Revised 07130/2003 PalisadesNuclearPlant Palisades Nuclear Plant BB3.1.5-5 3.1 .5-5 Revised 07/30/2003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES ACTIONS A.1 (continued)

Prior to entering this condition, the shutdown and part-length rod groups were fully withdrawn. If a shutdown rod group is then inserted into the core, its potential negative reactivity is added to the core as it is inserted.

If one or more shutdown or part-length rods are not within limits, the affected rod(s) must be declared inoperable and the applicable Conditions and Required Actions of LCO 3.1.4 entered immediately.

This Required Action is based on the recognition that the shutdown and part-length rods are normally withdrawn beyond their insertion limits and are capable of being moved by their control rod drive mechanism.

Although the requirements of this LCO are not applicable during performance of the control rod exercise test, the inability to restore a control rod to within the limits of the LCO following rod exercising would be indicative of a problem affecting the OPERABILITY of the control rod. Therefore, entering the applicable Conditions and Required Actions of LCO 3.1.4 is appropriate since they provide the applicable compensatory measures commensurate with the inoperability of the control rod.

B.1 When Required Action A.1 cannot be met or completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

3.1.5-6 Revised 07130/2003 Palisades Nuclear Plant Palisades Nuclear Plant BB3.1.5-6 Revised 07/3012003

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES SURVEILLANCE SR 3.1.5.1 REQUIREMENTS Verification that the shutdown and part-length rod groups are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken critical, the shutdown rods will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. Verification that the part-length rod groups are within their insertion limits ensures that they do not adversely affect power distribution requirements. This SR and Frequency ensure that the shutdown and part-length rod groups are withdrawn before the regulating rods are withdrawn during a plant startup.

Since control rod groups are positioned manually by the control room operator, verification of shutdown and part-length rod group position at a Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate to ensure that the shutdown and part-length rod groups are within their insertion limits. Also, the 12-hour Frequency takes into account other information available to the operator in the control room for the purpose of monitoring the status of the shutdown and part-length rod groups.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.2

3. FSAR, Section 14.6 Palisades Nuclear Plant B 3.1.5-7 Revised 07/3012003

Regulating Rod Group Position Limits B 3.1.6 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.6 Regulating Rod Group Position Limits BASES BACKGROUND The insertion limits of the regulating rod groups are initial assumptions in all safety analyses that assume full-length rod insertion upon reactor trip. The insertion limits directly affect core power distributions, assumptions of available SDM, and initial reactivity insertion rate. The applicable criteria for these reactivity and power distribution design requirements are contained in the Palisades Nuclear Plant design criteria (Ref. 1), 'and 10 CFR 50.46, "Acceptance Criteria for Emergency Core'Cooling Systems for Light Water Nuclear Power Reactors" (Ref. 2).

Limits on regulating rod group insertion have been established, and all regulating rod group positions are monitored and controlled during power operation to ensure that the power distribution and reactivity limits defined by the design power peaking, ejected rod worth, reactivity insertion rate,'and SDM limits are' preserved.

The regulating rod groups operate with a predetermined amount of position overlap, in order to approximate a linear relation between rod worth and rod position (integral rod worth). The regulating rod groups are withdrawn and operate in a predetermined sequence. The group sequence and overlap limits are specified in the COLR.

The regulating rods' are used for precise reactivity control of the reactor. The positions of the regulating rods are manually controlled.

They are capable of changing reactivity very quickly (compared to borating or diluting).

The power density at any point in the core must be limited to maintain specified acceptable fuel design limits, including limits that preserve the criteria specified in'10 CFR 50.46 (Ref. 2). Together, LCO 3.1.6; LCO 3.2.3, "QUADRANT POWER TILT (Tq)"; and LCO 3.2.4, "AXIAL SHAPE INDEX (ASI)," provide limits on control component operation and on monitored process variables to ensure the core operates within the linear heat rate'(LCO 3.2.1, "Linear Heat Rate (LHR)") and FRT (LCO 3.2.2, "TOTAL RADIAL PEAKING FACTOR (FR )') limits in the COLR.

Revised 07/3012003 Nuclear Plant Palisades Nuclear Plant B 3.1.6-1 B 3.1 .6-1 Revised 07/30/2003

Regulating Rod Group Position Limits B 3.1.6 BASES BACKGROUND Operation within the LHR limits given in the COLR prevents power (continued) peaks that would exceed the Loss Of Coolant Accident (LOCA) limits derived by the Emergency Core Cooling System analysis. Operation within the FRT limits given in the COLR prevents Departure from Nucleate Boiling (DNB) during a loss of forced reactor coolant flow accident. In addition to the LHR and FRT limits, certain reactivity limits are preserved by regulating rod insertion limits. The regulating rod group insertion limits also restrict the ejected rod worth to the values assumed in the safety analysis and preserve the minimum required SDM in MODES 1 and 2.

The ejected rod case is limited to the reactivity worth for the highest worth rod ejected from the PDIL limit, thus limiting the maximum possible reactivity excursion.

The establishment of limiting safety system settings and LCOs requires that the expected long and short term behavior of the FRT be determined. The long term behavior relates to the variation of the steady state FRT with core bumup and is affected by the amount of rod insertion assumed, the portion of a bumup cycle over which such insertion is assumed, and the expected power level variation throughout the cycle. The short term behavior relates to transient perturbations to the steady state radial peaks, due to radial xenon redistribution. The magnitudes of such perturbations depend upon the expected use of the rods during anticipated power reductions and load maneuvering.

Analyses are performed, based on the expected mode of operation of the Nuclear Steam Supply System (base loaded, maneuvering, etc.).

The PDIL curve stated in the COLR dictates the acceptable regulating rod group positioning for anticipated power maneuvers and transient mitigation within the limits. The PDIL limitations stated in the COLR reflect the assumptions made in the safety analyses. This ensures that the FRT limits are not violated during power level maneuvering or transient mitigation.

The regulating rod group insertion and alignment limits are process variables that together characterize and control the three-dimensional power distribution of the reactor core. Additionally, the regulating rod group insertion limits control the reactivity that could be added in the event of a control rod ejection accident, and the shutdown and regulating bank insertion limits ensure the required SDM is maintained.

Plant Nuclear Plant Palisades Nuclear B 3.1.6-2 evised U7I3OIUUJ Palisades B 3.1 .6-2 Revised 07/30/2003

Regulating Rod Group Position Limits B 3.1.6 BASES BACKGROUND Operation within the subject LCO limits will prevent fuel cladding (continued) failures that would breach the primary fission product barrier and release fission products to the reactor coolant in the event of a LOCA, loss of flow, ejected rod, or other accident requiring termination by a Reactor Protection System trip function.

APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY ANALYSES operation (Condition I) and anticipated operational occurrences (Condition II). The acceptance criteria for the regulating rod group position, ASI, and Tq LCOs are'such as'to preclude core power distributions from occurring that would violate the following fuel design criteria:

a. During a large break LOCA, the peak cladding temperature must not exceed a limit of 2200 0F, (Ref. 2);

b. During a loss of forced reactor coolant flow accident, there must be at least a 95% probability at a 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition.

c. During an ejected rod accident, the fission energy input to the fuel must not exceed 280 cal/gm (Ref. 3); and

d. The rods must be capable'of shutting down the reactor with a minimum required SDM, with the highest worth rod stuck fully withdrawn (Ref. 1).

Regulating rod group position, ASI, and Tq are process variables that together characterize and control the three-dimensional power I distribution'of the reactor core.

Fuel cladding damage does not occur when the core is operated outside these LCOs during normal operation. However, fuel cladding damage could result, should an accident occur with simultaneous violation of one or more of these LCOs. Changes in the power distribution can cause increased power peaking and corresponding increased local LHRs.

Palisades Nuclear Plant B 3.1 .6-3 IIRevised 07/30/2003

Regulating Rod Group Position Limits B 3.1.6 BASES APPLICABLE The SDM requirement is ensured by limiting the regulating and SAFETY ANALYSES shutdown rod group insertion limits, so that the allowable inserted worth (continued) of the rods is such that sufficient reactivity is available to shut down the reactor to hot zero power. SDM assumes the maximum worth rod remains fully withdrawn upon trip (Ref. 4).

The most limiting SDM requirements for Mode 1 and 2 conditions at Beginning of Cycle (BOC) are determined by the requirements of several transients, e.g., Loss of Flow, etc. However, the most limiting SDM requirements for MODES 1 and 2 at End of Cycle (EOC) come from just one transient, Main Steam Line Break (MSLB). The requirements of the MSLB event at EOC for the full power and no load conditions are significantly larger than those of any other event at that time in cycle and, also, considerably larger than the most limiting requirements at BOC.

Although the most limiting SDM requirements at EOC are much larger than those at BOC, the available SDMs obtained via tripping the full-length control rods are substantially larger due to the much lower boron concentration at EOC. To verify that adequate SDMs are available throughout the cycle to satisfy the changing requirements, calculations are performed at both BOC and EOC. It has been determined that calculations at these two times in cycle are sufficient since the difference between available SDMs and the limiting SDM requirements are the smallest at these times in cycle. The measurement of full-length control rod bank worth performed as part of the Startup Testing Program demonstrates that the core has the expected shutdown capability. Consequently, adherence to LCO 3.1.5, Shutdown and Part-Length Rod Group Insertion Limits," and LCO 3.1.6 provides assurance that the available SDM at any time in cycle will exceed the limiting SDM requirements at that time in cycle.

Operation at the insertion limits or ASI limits may approach the maximum allowable linear heat generation rate or peaking factor, with the allowed Tq present. Operation at the insertion limit may also indicate the maximum ejected rod worth could be equal to the limiting value in fuel cycles that have sufficiently high ejected rod worth.

The regulating and shutdown rod insertion limits ensure that safety analyses assumptions for reactivity insertion rate, SDM, ejected rod worth, and peaking factors are preserved.

The regulating rod group position limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).

Revised 0713012003 Plant Nuclear Plant Palisades Nuclear B 3.1.6-4 B 3.1.6-4 Revised 07/30/2003

Regulating Rod Group Position Limits B 3.1.6 BASES LCO The limits on regulating rod group sequence, overlap, and physical insertion, as defined in the COLR, must be maintained because they serve the function of preserving power distribution, ensuring that the SDM is maintained, ensuring that ejected rod worth is maintained, and ensuring adequate negative reactivity insertion on trip. The overlap between regulating rod groups provides more uniform rates of reactivity insertion and withdrawal and is imposed to maintain acceptable power peaking during regulating rod group motion. For a control rod group to be considered above its insertion limit, all OPERABLE rods in that group, which are not misaligned, must be above the insertion limit (inoperable and misaligned rods are addressed by LCO 3.1.4).

The Power Dependent Insertion Limit (PDIL) alarm circuit is required to be OPERABLE for notification that the regulating rod groups are outside the required insertion limits. The Control Rod Out Of Sequence (CROOS) alarm circuit is required to be OPERABLE for notification that the rods are not within the required sequence and overlap limits. When the PDIL or the CROOS alarm circuit is inoperable, the verification of rod group positions is increased to ensure improper rod alignment is identified before unacceptable flux distribution occurs. The PDIL and CROOS alarms can be generated by either the synchro based Primary Indication Processor (PIP) node, or the reed switch based Secondary Position Indication (SPI) system since the SPI system, in conjunction with the host computer, Is redundant to the PIP node in the task of control rod measurement, control rod monitoring and limit processing.

APPLICABILITY The regulating rod group sequence, overlap, and physical insertion limits shall be maintained with the reactor in MODES I and 2. These limits must be maintained, since they preserve the assumed power distribution, ejected rod worth, SDM, and reactivity rate insertion assumptions. Applicability in MODES 3, 4, and 5 is not required, since neither the power distribution nor ejected rod worth assumptions would be exceeded in these MODES. SDM is preserved in MODES 3, 4, and 5 by adjustments to the soluble boron concentration.

The Applicability has been modified by a Note indicating the LCO requirement is suspended while performing SR 3.1.4.3 (rod exercise test). Control rod exercising verifies the freedom of the rods to move, and requires the individual regulating rods to move below the LCO limits which could violate the LCO for their group.

Revised O7I3OI2OO Palisades Nuclear Plant Palisades Nuclear Plant B 3.1.6-5 B 3.1 .6-5 Revised 07130/2003

Regulating Rod Group Position Limits B 3.1.6 BASES ACTIONS LCOs 3.1.4, 3.1.5, and 3.1.6, and their ACTIONS were written to support each other. The combined intent is to assure the following:

1. There is adequate SDM available in withdrawn control rods to assure the reactor is shutdown by, and remains shutdown following, a reactor trip,

2. The control rod positioning does not cause unacceptable axial or radial flux peaking, and

3. The programmed rod withdrawal sequence and group overlap result in reactivity insertion rates within the assumptions of the Inadvertent Control Rod Bank Withdrawal Analyses.

The ACTIONS for rods that are mispositioned (misaligned or inserted beyond the limit) were written assuming that an OPERABLE rod discovered to be mispositioned would simply be re-positioned correctly.

While the associated Conditions would have to be entered, the rod could be re-positioned (thus exiting the LCO) without taking any other Required Action. A rod that remains mispositioned was assumed to be l inoperable. The analyses account for operation with one (and only one) mispositioned rod (a dropped rod being the limiting case). With more than one mispositioned rod, the plant would be outside the bounds of the analyses and must be shutdown.

If a rod is discovered to be misaligned (le, there is more than 8 inches between it and any other rod in its group, but all remaining rods in that group are within 8 inches of each other) Condition 3.1.4 C allows 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore the rod alignment (thus exiting the LCO), perform SR 3 2.2.1 (verification that radial peaking is within limits), or reduce power to

75% RTP.

If one or more shutdown rods are inserted beyond the insertion limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 D (when one rod is immovable but trippable) or Condition 3.1.4 E (when a movable rod is inserted beyond its insertion limit, or when more than one rod is inoperable for any reason) must be entered.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If one rod cannot be moved (but is still considered trippable),

operation may continue in accordance with Condition 3.1.4 D (and 3.1.4 C if it is misaligned).

Palisades Nuclear Plant Nuclear Plant 3.1.6-6 BB3.1.646 Revised 0713012003 Revised 07/30/2003 Palisades

Regulating Rod Group Position Limits B 3.1.6 BASES ACTIONS If more than one rod cannot be moved, Condition 3.1.4 E must (continued) also be entered. The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more part length rods are inserted beyond the limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 E is entered (and 3.1.4 C if it is misaligned). Condition 3.1.4 D is not applicable to part-length rods since it only addresses full-length rods.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If any part-length rods are inserted beyond the limit and cannot be moved, the plant must be placed in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

If one or more OPERABLE regulating rods are inserted beyond the limit, Condition 3.1.6 A is entered; The rods must be restored to within limits (by rod withdrawal or power reduction) within two hours.

If a rod cannot be moved, it must be considered inoperable and Condition 3.1.4 D must be entered (and 3.1.4 C if it Is misaligned).

Condition 3.1.4 D allows continued operation with one inoperable, but trippable, rod until the next reactor shutdown (MODE 3 entry). If more than one rod cannot be moved, Condition 3.1.4 E must be entered.

The plant must be in MODE 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in accordance with ACTION 3.1.4 E.1.

The analyses do not account for the possibility of more then one rod failing to insert on a trip. While boron concentration might be adjusted to restore SHUTDOWN MARGIN, if two adjacent rods fail to insert that portion of the core could remain excessively reactive. Since the analyses must assume that one rod fails to insert, operation may not continue with a known untrippable rod. A shutdown would be required by Condition 3.1.4 E. ,-

Revised 07/30/2003 Plant Nuclear Plant Palisades Nuclear B 3.1.6-7 B 3.1 .6-7 Revised 07/3012003

Regulating Rod Group Position Limits B 3.1.6 BASES ACTIONS A.1 and A.2 (continued)

Operation beyond the insertion limit may result in a loss of SDM and excessive peaking factors. The insertion limit should not be violated during normal operation; this violation, however, may occur during transients when the operator is manually controlling the regulating rods in response to changing plant conditions.

When the regulating groups are inserted beyond the insertion limits, actions must be taken to either withdraw the regulating groups beyond the limits or to reduce THERMAL POWER to less than or equal to that allowed for the actual rod group position limit. Two hours provides a reasonable time to accomplish this, allowing the operator to deal with current plant conditions while limiting peaking factors to acceptable levels.

B.1 Operating outside the regulating rod group sequence and overlap limits specified in the COLR may result in excessive peaking factors. If the sequence and overlap limits are exceeded, the regulating rod groups must be restored to within the appropriate sequence and overlap. Two hours provides adequate time for the operator to restore the regulating rod group to within the appropriate sequence and overlap limits.

C.1 When the PDIL or the CROOS alarm circuit is inoperable, performing SR 3.1.6.1 once within 15 minutes following any rod motion ensures improper rod alignments are identified before unacceptable flux distributions occur.

D.1 When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

Revised 07/30/2003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.1.6-8 B 3.1.6-8 Revised 07/30/2003

Regulating Rod Group Position Limits B 3.1.6 BASES SURVEILLANCE SR 3.1.6.1 REQUIREMENTS With the PDIL alarm circuit OPERABLE, verification of each regulating rod group position every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient to detect rod positions that may approach the acceptable limits, and to provide the operator with time to undertake the Required Action(s) should the sequence or insertion limits be found to be exceeded.

The 12-hour Frequency also takes into account the indication provided I by the PDIL alarm circuit and other information about rod group positions available to the operator in the control room.

SR 3.1.6.2 Demonstrating the PDIL alarm circuit OPERABLE verifies that the PDIL alarm circuit is functional. The 31-day Frequency takes into account I other Surveillances being performed at shorter Frequencies that identify improper control rod alignments.

SR 3.1.6.3 Demonstrating the CROOS alarm circuit OPERABLE verifies that the CROOS alarm circuit is functional. The 31-day Frequency takes Into I account other Surveillances being performed at shorter Frequencies that identify improper control rod alignment.

REFERENCES 1. FSAR, Section 5.1

2. 10 CFR 50.46

3. FSAR, Section 14.16

4. FSAR, Section 14.4 Palisades Nuclear Plant B 3.1.6-9 Revised 07/30/2003

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the acceptable fuel design limits and breaching the reactor coolant pressure boundary during Anticipated Operational Occurrences (AOOs). (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.') By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those'events expected to occur one or more times during the plant life, the acceptable limits are:

. - The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

Fuel centerline melting shall not occur; and The Primary Coolant System (PCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during A0Os.

Palisades Nuclear Plant B 3.3.1 -1 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES (

BACKGROUND Accidents are events that are analyzed even though they are not (continued) expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS is segmented into four interconnected modules. These modules are:

Measurement channels;

RPS trip units;

Matrix Logic; and

Trip Initiation Logic.

This LCO addresses measurement channels and RPS trip units. It also addresses the automatic bypass removal feature for those trips with Zero Power Mode bypasses. The RPS Logic and Trip Initiation Logic are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Logic and Trip Initiation." The role of the measurement channels, RPS trip units, and RPS Bypasses is discussed below.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

With the exception of Hi Startup Rate, which employs two instrument channels, and Loss of Load, which employs a single pressure sensor, four identical measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated channels A through D.

Some measurement channels provide input to more than one RPS trip unit within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features (ESF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1-2 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

In the case of Hi Startup Rate and Loss of Load, where fewer than four sensor channels are employed, the reactor trips provided are not relied upon by the plant safety analyses. The sensor channels do however, provide trip input signals to all four RPS channels.

When a channel monitoring a parameter exceeds a predetermined setpoint, indicating an abnormal condition, the bistable monitoring the parameter in that channel will trip. Tripping two or more channels of bistable trip units monitoring the same parameter de-energizes Matrix Logic, (addressed by LCO 3.3.2) which in turn de-energizes the Trip Initiation Logic. This causes all four DC clutch power supplies to de-energize, interrupting power to the control rod drive mechanism clutches, allowing the full length control rods to insert into the core.

For those trips relied upon in the safety analyses, three of the four measurement and trip unit channels can meet the redundancy and testability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LCO requires, however, that four channels be OPERABLE. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip channel bypassed) for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation, this arrangement meets the requirements of IEEE Standard 279-1971 (Ref. 3).

Most of the RPS trips are generated by comparing a single measurement to a fixed bistable setpoint. Two trip Functions, Variable High Power Trip and Thermal Margin Low Pressure Trip, make use of more than one measurement to provide a trip.

The required RPS Trip Functions utilize the following input instrumentation:

Variable Hiqh PowerTriP (VHPT)

The VHPT uses Q Power as its input. Q Power is the higher of NI power from the power range NI drawer and primary calorimetric power (AT power) based on PCS hot leg and cold leg temperatures. The measurement channels associated with the VHPT are the power range excore channels, and the PCS hot and cold leg temperature channels.

Palisades Nuclear Plant B 3.3.1-3 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

Variable High Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signal processing necessary to calculate the TM/LP trip setpoint, VHPT trip setpoint and trip comparison, and Q Power calculation. On power decreases the VHPT setpoint tracks power levels downward so that it is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point it increases to the new setpoint, a fixed increment above Q Power at the time of reset, subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

High Startup Rate TriO The High Startup Rate trip uses the wide range Nuclear Instruments (NIs) to provide an input signal. There are only two wide range NI channels. The wide range channel signal processing electronics are physically mounted in RPS cabinet channels C (NI-113) and D (NI-214). Separate bistable trip units mounted within the NI-1/3 wide range channel drawer supply High Startup Rate trip signals to RPS channels A and C. Separate bistable trip units mounted within the Nl-214 wide range channel drawer provide High Startup Rate trip signals to RPS channels B and D.

Low Primary Coolant Flow Trip The Low Primary Coolant Flow Trip utilizes 16 flow measurement channels which monitor the differential pressure across the primary side of the steam generators. Each RPS channel, A, B, C, and D, receives a signal which is the sum of four differential pressure signals. This totalized signal is compared with a setpoint in the RPS Low Flow bistable trip unit for that RPS channel.

Palisades Nuclear Plant 8 3.3.1-4 Revised 01/2212003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

Low Steam Generator Level Trips There are two separate Low Steam Generator Level trips, one for each steam generator. Each Low Steam Generator Level trip monitors four level measurement channels for the associated steam generator, one for each RPS channel.

- Low Steam Generator Pressure TriDs There are also two separate Low Steam Generator Pressure trips, one for each steam generator. Each Low Steam Generator Pressure trip monitors four pressure measurement channels for the associated steam generator, one for each RPS channel.

High Pressurizer Pressure TriD The High Pressurizer Pressure Trip monitors four pressurizer pressure channels, one for each RPS channel.

Thermal Margin Low Pressure (TM/LP) TriD The TM/LP Trip utilizes bistable trip units. Each of these bistable trip units receives a calculated trip setpoint from the Thermal Margin Monitor (TMM) and compares it to the measured pressurizer pressure signal. The TMILP setpoint is based on Q power (the higher of NI power from the power range NI drawer, or AT power, based on PCS hot leg and cold leg temperatures) pressurizer pressure, PCS cold leg temperature, and Axial Shape Index. The TMM provide the complex signal processing necessary to calculate the TMLP trip setpoint, TMILP trip comparison signal, and Q Power.

Palisades Nuclear Plant B 3.3.1-5 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

Loss of Load Trip The Loss of Load trip uses a single pressure switch, 63/AST-2, in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units. The Loss of Load Trip is actuated by turbine auxiliary relays 305L and 305R. Relay 305L provides input to RPS channels A and C; 305R to channels B and D.

Relays 305L and 305R are energized on a turbine trip. Their inputs are the same as the inputs to the turbine solenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, auto stop oil pressure switch 63/AST-2 will actuate relays 305L and 305R and generate a reactor trip. If a turbine trip is generated by an input to the solenoid trip valve, relays 305L and 305R, which are wired in parallel, will also be actuated and will generate a reactor trip.

Containment High Pressure Trip The Containment High Pressure Trip is actuated by four pressure switches, one for each RPS channel.

Zero Power Mode Bvpass Automatic Removal The Zero Power Bypass allows manually bypassing (i.e., disabling) four reactor trip functions, Low PCS Flow, Low SG A Pressure, Low SG B Pressure, and TM/LP (low PCS pressure),

when reactor power (as indicated by the wide range nuclear instrument channels) is below 104%. This bypassing is necessary to allow RPS testing and control rod drive mechanism testing when the reactor is shutdown and plant conditions would cause a reactor trip to be present.

The Zero Power Mode Bypass removal interlock uses the wide range nuclear instruments (Nls) as measurement channels.

There are only two wide range NI channels. Separate bistables are provided to actuate the bypass removal for each RPS channel. Bistables in the NI-1/3 channel provide the bypass removal function for RPS channels A and C; bistables in the NI-2/4 channel for RPS channels B and D.

Palisades Nuclear Plant B 3.3.1-6 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Several measurement instrument channels provide more than one (continued) required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

RPS Trip Units Two types of RPS trip units are used in the RPS cabinets; bistable trip units and auxiliary trip units:

A bistable trip unit receives a measured process signal from its instrument channel and compares it to a setpoint; the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the measured signal is less conservative than the setpoint.

They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open or closed); the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the digital input is received. They also provide local trip indication and remote annunciation.

Each RPS channel has four auxiliary trip units and seven bistable trip units.

The contacts from these trip unit relays are arranged into six coincidence matrices, comprising the Matrix Logic. If bistable trip units monitoring the same parameter in at least two channels trip, the Matrix Logic will generate a reactor trip (two-out-of-four logic).

Four of the RPS measurement channels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpoint is not necessary. In these cases, the bistable trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contact multiplication so the single input contact opening can provide multiple contact outputs to the coincidence logic as well as trip indication and annunciation.

Palisades Nuclear Plant B 3.3.1-7 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Trip Units (continued)

(continued)

Trips employing auxiliary trip units include the VHPT, which receives contact inputs from the Thermal Margin Monitors; the High Startup Rate trip which employs contact inputs from bistables mounted in the two wide range drawers; the Loss of Load Trip which receives contact inputs from one of two auxiliary relays which are operated by a single switch sensing turbine auto stop oil pressure; and the Containment High Pressure (CHP) trip, which employs containment pressure switch contacts.

There are four RPS trip units, designated as channels A through D, each channel having eleven trip units, one for each RPS Function. Trip unit output relays de-energize when a trip occurs.

All RPS Trip Functions, with the exception of the Loss of Load and CHP trips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Palisades Nuclear Plant B 3.3.1-8 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Protective System Bypasses (continued)

Three different types of trip bypass are utilized in the RPS, Operating Bypass, Zero Power Mode Bypass, and Trip Channel Bypass. The Operating Bypass or Zero Power Mode Bypass prevent the actuation of a trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the trip unit output from affecting the Logic Matrix. A channel which is bypassed,-other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must be considered to be inoperable.

Operating Bypasses The Operating Bypasses are initiated and removed automatically during startup and shutdown as power level changes. An Operating Bypass prevents the associated RPS auxiliary trip unit from receiving a trip signal from the associated measurement channel. With the bypass in place, neither the pre-trip alarm nor the trip will actuate if the measured parameter exceeds the set point. An annunciator is provided for each Operating Bypass. The RPS trips with Operating Bypasses are:

a. High Startup Rate Trip bypass. The High Startup Rate trip is K.>,_;,,! automatically bypassed when the associated wide range channel indicates below 1E4% RTP, and when the associated power range excore channel indicates above 13% RTP. These bypasses are automatically removed between 1E-4% RTP and 13% RTP.

b. Loss of Load bypass. The Loss of Load trip is automatically bypassed when the associated power range excore channel indicates below 17% RTP. The bypass is automatically removed when the channel indicates above the set point. The same power range excore channel bistable is used to bypass the High Startup Rate trip and the Loss of Load trip for that RPS channel.

Palisades Nuclear Plant B 3.3.1-9 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Operating Bypasses (continued)

(continued)

Each wide range channel contains two bistables set at 1E4% RTP, one bistable unit for each associated RPS channel. Each of the two wide range channels affect the Operating Bypasses for two RPS channels; wide range channel NI-1/3 for RPS channels A and C, wide range channel NI-2/4 for RPS channels B and D. Each of the four power range excore channel affects the Operating Bypasses for the associated RPS channel. The power range excore channel bistables associated with the Operating Bypasses are set at a nominal 15%, and are required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow, pressure or temperature too low for the RPS trips to be reset. ZPM bypasses may be manually initiated and removed when wide range power is below 1E4% RTP, and are automatically removed if the associated wide range NI indicated power exceeds 1E4% RTP. A ZPM bypass prevents the RPS trip unit from actuating if the measured parameter exceeds the set point. Operation of the pretrip alarm is unaffected by the zero power mode bypass. An annunciator indicates the presence of any ZPM bypass. The RPS trips with ZPM bypasses are:

a. Low Primary Coolant System Flow.

b. Low Steam Generator Pressure.

c. Thermal Margin/Low Pressure.

The wide range NI channels provide contact closure permissive signals when indicated power is below 1E4% RTP. The ZPM bypasses may then be manually initiated or removed by actuation of key-lock switches.

One key-lock switch located on each RPS cabinet controls the ZPM Bypass for the associated RPS trip channels. The bypass is automatically removed if the associated wide range NI indicated power exceeds 1E4% RTP. The same wide range NI channel bistables that provide the ZPM Bypass permissive and removal signals also provide the high startup rate trip Operating Bypass actuation and removal.

Palisades Nuclear Plant B 3.3.1 -10 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES BACKGROUND Trip Channel Bypass (continued)

A Trip Channel Bypass is used when it is desired to physically remove an individual trip unit from the system, or when calibration or servicing of a trip channel could cause an inadvertent trip. A trip Channel Bypass may be manually initiated or removed at any time by actuation of a key-lock switch. A Trip Channel Bypass prevents the trip unit output from affecting the RPS logic matrix. A light above the bypass switch indicates that the trip channel has been bypassed. Each RPS trip unit has an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.

The key cannot be removed when in the bypass position. Only one key for each trip parameter is provided, therefore the operator can bypass only one channel of a given parameter at a time. During the bypass condition, system logic changes from two-out-of-four to two-out-of-three channels required for trip.

APPLICABLE Each of the analyzed accidents and transients can be detected by one SAFETY ANALYSES or more RPS Functions. The accident analysis contained in Reference 4 takes credit for most RPS trip Functions. The High Startup Rate and Loss of Load Functions, which are not specifically credited in the accident analysis are part of the NRC approved licensing basis for the plant. The High Startup Rate and Loss of Load trips are purely equipment protective, and their use minimizes the potential for equipment damage.

The specific safety analyses applicable to each protective Function are identified below.

1. Variable High Power Trip VHPT)

The VHPT provides reactor core protection against positive reactivity excursions.

The safety analysis assumes that this trip is OPERABLE to terminate excessive positive reactivity insertions during power operation and while shut down.

Palisades Nuclear Plant B 3.3.1 -11 Revised 01/2212003

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. High Startup Rate TriO SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the High Startup Rate Trip. The High Startup Rate trip is used to trip the reactor when excore wide range power indicates an excessive rate of change. The High Startup Rate trip minimizes transients for events such as a continuous control rod withdrawal or a boron dilution event from low power levels. The trip may be operationally bypassed when THERMAL POWER is

< 1E-4% RTP, when poor counting statistics may lead to erroneous indication. It may also be operationally bypassed at

> 13% RTP, where moderator temperature coefficient and fuel temperature coefficient make high rate of change of power unlikely.

There are only two wide range drawers, with each supplying contact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolant System Flow Trio The Low PCS Flow trip provides DNB protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a primary coolant pump.

Flow in each of the four PCS loops is determined from pressure drop from inlet to outlet of the SGs. The total PCS flow is determined, for the RPS flow channels, by summing the loop pressure drops across the SGs and correlating this pressure sum with the sum of SG differential pressures which exist at 100% flow (four pump operation at full power Tave). Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

4, 5. Low Steam Generator Level Trip The Low Steam Generator Level trips are provided to trip the reactor in the event of excessive steam demand (to prevent overcooling the PCS) and loss of feedwater events (to prevent overpressurization of the PCS).

The Allowable Value assures that there will be sufficient water inventory in the SG at the time of trip to allow a safe and orderly plant shutdown and to prevent SG dryout assuming minimum AFW capacity.

Palisades Nuclear Plant B 3.3.1-12 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES APPLICABLE 4, 5. Low Steam Generator Level Tri (continued)

SAFETY ANALYSIS (continued) Each SG level is sensed by measuring the differential pressure in the upper portion of the downcomer annulus in the SG. These trips share four level sensing channels on each SG with the AFW actuation signal.

6, 7. Low Steam Generator Pressure Trip The Low Steam Generator Pressure trip provides protection against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the PCS. This trip provides a mitigation function in the event of an MSLB.

The Low SG Pressure channels are shared with the Low SG Pressure signals which isolate the steam and feedwater lines.

8. High Pressurizer Pressure TriO The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and Main Steam Safety Valves (MSSVs), provides protection against overpressure conditions in the PCS when at operating temperature. The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (e.g., Loss of Load, Main Steam Isolation Valve (MSIV) closure, etc.) or which suddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety grade instrument channels with the TM/LP trip, Anticipated Transient Without Scram (ATWS) and PORV circuits, and the Pressurizer Low Pressure Safety Injection Signal.

Palisades Nuclear Plant B 3.3.1-13 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES APPLICABLE 9. Thermal Margin/Low Pressure (TM/LP) Trip SAFETY ANALYSIS (continued) The TMI/LP trip is provided to prevent reactor operation when the DNBR is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The trip is initiated whenever the PCS pressure signal drops below a minimum value (Pmin) or a computed value (Pvar) as described below, whichever is higher.

The TM/LP trip uses Q Power, ASI, pressurizer pressure, and cold leg temperature (Tc) as inputs.

Q Power is the higher of core THERMAL POWER (AT Power) or nuclear power. The AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range excore channels as inputs. Both the AT and excore power signals have provisions for calibration by calorimetric calculations.

The ASI is calculated from the upper and lower power range excore detector signals, as explained in Section 1.1, Definitions."

The signal is corrected for the difference between the flux at the core periphery and the flux at the detectors.

The Tc value is the higher of the two cold leg signals.

The Low Pressurizer Pressure trip limit (Pva,)is calculated using the equations given in Table 3.3.1-2.

The calculated limit (Pvar) is then compared to a fixed Low Pressurizer Pressure trip limit (Pfi). The auctioneered highest of these signals becomes the trip limit (Ptip). Pp is compared to the measured PCS pressure and a trip signal is generated when the measured pressure for that channel is less than or equal to Pbp. A pre-trip alarm is also generated when P is less than or equal to the pre-trip setting, Ptdp + AP.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS pressure for the existing temperature and power conditions. It is compared to actual PCS pressure in the TM/LP trip unit.

Palisades Nuclear Plant B 3.3.1-14 Revised 01122/2003

RPS Instrumentation B 3.3.1 BASES APPLICABLE 10. Loss of Load Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses a single pressure switch in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

11. Containment Hiah Pressure Trip The Containment High Pressure trip provides a reactor trip in the event of a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The Containment High Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two.

microswitches. One microswitch on each of four sensors provides an input to the RPS.

12. Zero Power Mode Bypass Removal The only RPS bypass considered in the safety analyses is the Zero Power Mode (ZPM) Bypass. The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow or temperature too low for' the RPS Low PCS Flow, Low SG Pressure, or Thermal Margin/Low Pressure trips to be reset. ZPM bypasses are automatically removed if the wide range NI indicated power exceeds I E-4% RTP.

Palisades Nuclear Plant B 3.3.1-15 Revised 01/2212003

RPS Instrumentation B 3.3.1 BASES APPLICABLE 12. Zero Power Mode Bypass Removal (continued)

SAFETY ANALYSIS (continued) The safety analyses take credit for automatic removal of the ZPM Bypass if reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur with the affected trips bypassed and PCS flow, pressure, or temperature below the values at which the RPS could be reset. The ZPM Bypass would effectively be removed when the first wide range NI channel indication reached 1E-4% RTP. With the ZPM Bypass for two RPS channels removed, the RPS would trip on one of the un-bypassed trips.

This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur when PCS flow, steam generator pressure, and PCS pressure (TM/LP) were above their trip setpoints, a trip would terminate the event when power increased to the minimum setting (nominally 30%) of the Variable High Power Trip. In this case, the monitored parameters are at or near their normal operational values, and a trip initiated at 30% RTP provides adequate protection.

The RPS design also includes automatic removal of the Operating Bypasses for the High Startup Rate and Loss of Load trips. The safety analyses do not assume functioning of either these trips or the automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of the trip unit (including its output relays), any required portion of the associated instrument channel, or both, renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. Failure of an automatic ZPM bypass removal channel may also impact the associated instrument channel(s) and reduce the reliability of the affected Functions.

Palisades Nuclear Plant B 3.3.1-16 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES LCO Actions allow Trip Channel Bypass of individual channels, but the (continued) bypassed channel must be considered to be inoperable. The bypass key used to bypass a single channel cannot be simultaneously used to bypass that same parameter in other channels. This interlock prevents operation with more than one channel of the same Function trip channel bypassed. The plant is normally restricted to 7 days in a trip channel bypass, or otherwise inoperable condition before either restoring the Function to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. -The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function.

These uncertainties are addressed as described in plant documents.

Neither Allowable Values nor setpoints are specified for the non-safety related RPS Trip Functions, since no safety analysis assumptions would be violated if they are not set at a particular value.

The following Bases for each trip Function identify the above RPS trip Function criteria items that are applicable to establish the trip Function OPERABILITY.

1. Variable High Power Trio (VHPT)

This LCO requires all four channels of the VHPT Function to be OPERABLE.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary VHPT trips during normal plant operations. The Allowable Value is low enough for the system to function adequately during reactivity addition events.

Palisades Nuclear Plant B 3.3.1-17 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES LCO 1. Variable High Power Trip (VHPT) (continued)

(continued)

The VHPT is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During plant startup, the VHPT trip setpoint is initially at its minimum value, < 30%. Below 30% RTP, the VHPT setpoint is not required to "track" with Q Power, i.e., be adjusted to within 15% RTP. It remains fixed until manually reset, at which point it increases to s 15% above existing Q Power.

The maximum allowable setting of the VHPT is 111% RTP.

Adding to this the possible variation in trip setpoint due to calibration and instrument error, the maximum actual steady state power at which a trip would be actuated is 115%, which is the value assumed in the safety analysis.

2. High Startup Rate Trip This LCO requires four channels of High Startup Rate Trip Function to be OPERABLE in MODES I and 2.

The High Startup Rate trip serves as a backup to the administratively enforced startup rate limit. The Function is not credited in the accident analyses; therefore, no Allowable Value for the trip or operating bypass Functions is derived from analytical limits and none is specified.

The four channels of the High Startup Rate trip are derived from two wide range NI signal processing drawers. Thus, a failure in one wide range channel could render two RPS channels inoperable. It is acceptable to continue operation in this condition because the High Startup Rate trip is not credited in any safety analyses.

The requirement for this trip Function is modified by a footnote, which allows the High Startup Rate trip to be bypassed when the wide range NI indicates below 1OE4% or when THERMAL POWER is above 13% RTP. If a High Startup Rate trip is bypassed when power is between these limits, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-18 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES LCO 3. Low Primary Coolant System Flow Trip (continued)

This LCO requires four channels of Low PCS Flow Trip Function to be OPERABLE.

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insures that the reactor cannot operate when the flow rate is less than 93% of the nominal value considering instrument errors. Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below I E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above I E-4% RTP, it must be considered to be inoperable.

4, 5. Low Steam Generator Level TriD This LCO requires four channels of Low Steam Generator Level Trip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequate water inventory in the steam generators when the reactor is critical and is based upon narrow range instrumentation. The 25.9%

indicated level corresponds to the location of the feed ring.

6, 7. Low Steam Generator Pressure Trip This LCO requires four hannels of Low Steam Generator Pressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand.

Since excessive steam demand causes the PCS to cool down, resulting in positive reactivity addition to the core, a reactor trip is required to offset that effect.

Palisades Nuclear Plant B 3.3.1-19 Revised 01/2212003

RPS Instrumentation B 3.3.1 BASES LCO (continued) 8. High Pressurizer Pressure Trip This LCO requires four channels of High Pressurizer Pressure Trip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressure increases in the PCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated.

9. Thermal Margin/Low Pressure (TM/LP) Trip This LCO requires four channels of TM/LP Trip Function to be OPERABLE.

The TM/LP trip setpoints are derived from the core thermal limits through application of appropriate allowances for measurement uncertainties and processing errors. The allowances specifically account for instrument drift in both power and inlet temperatures, calorimetric power measurement, inlet temperature measurement, and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt, fuel pellet manufacturing tolerances, core flow measurement uncertainty and core bypass flow, inlet temperature measurement time delays, and ASI measurement, are included in the development of the TM/LP trip setpoint used in the accident analysis.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E4% RTP. If a trip channel is bypassed when power is above IE4% RTP, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-20 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES LCO 10. Loss of Load Trip (continued)

The LCO requires four Loss of Load Trip Function channels to be OPERABLE in MODE 1 with THERMAL POWER'2 17% RTP.

The Loss of Load trip may be bypassed or be inoperable with THERMAL POWER < 17% RTP, since it is no longer needed to prevent lifting of the pressurizer safety valves or steam generator safety valves in the event of a Loss of Load. Loss of Load Trip unit must be considered inoperable if it is bypassed when THERMAL POWER is above 17% RTP.

This LCO requires four RPS Loss of Load auxiliary trip units, relays 305L and 305R, and pressure switch 63IAST-2 to be OPERABLE. With those components OPERABLE, a turbine trip will generate a reactor trip. The LCO does not require the various' turbine trips, thernselves, to be OPERABLE.

The Nuclear Steam Supply System and Steam Dump System are capable of accommodating the Loss of Load without requiring the use of the above equipment.

The Loss of Load Trip Function is not credited in the accident analysis; therefore, an Allowable Value for the trip cannot be derived from analytical limits, and is not specified.

11. -Containment High Pressure Trip This LCO requires four channels of Containment High Pressure Trip Function to be OPERABLE.

The Allowable Value is high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) that are not indicative of an abnormal condition.

The setting is low enough to initiate a reactor trip to prevent containment pressure from exceeding design pressure following a DBA and ensures the reactor is shutdown before initiation of safety injection and containment spray.

Palisades Nuclear Plant B 3.3.1-21 Revised 01122/2003

RPS Instrumentation B 3.3.1 BASES LCO (continued) 12. ZPM Bypass The LCO requires that four channels of automatic Zero Power Mode (ZPM) Bypass removal instrumentation be OPERABLE.

Each channel of automatic ZPM Bypass removal includes a shared wide range NI channel, an actuating bistable in the wide range drawer, and a relay in the associated RPS cabinet. Wide Range NI channel 1/3 is shared between ZPM Bypass removal channels A and C; Wide Range NI channel 214, between ZPM Bypass removal channels B and D. An operable bypass removal channel must be capable of automatically removing the capability to bypass the affected RPS trip channels with the ZPM Bypass key switch at the proper setpoint.

APPLICABILITY This LCO requires all safety related trip functions to be OPERABLE in accordance with Table 3.3.1-1.

Those RPS trip Functions which are assumed in the safety analyses (all except High Startup Rate and Loss of Load), are required to be operable in MODES I and 2, and in MODES 3, 4, and 5 with more than one full-length control rod capable of being withdrawn and PCS boron K concentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES. 3, 4, or 5, if PCS boron concentration is at REFUELING BORON CONCENTRATION, or when no more than one full-length control rod is capable of being withdrawn, because the RPS Function is already fulfilled. REFUELING BORON CONCENTRATION provides sufficient negative reactivity to assure the reactor remains subcritical regardless of control rod position, and the safety analyses assume that the highest worth withdrawn full-length control rod will fail to insert on a trip. Therefore, under these conditions, the safety analyses assumptions will be met without the RPS trip Function.

The High Startup Rate Trip Function is required to be OPERABLE in MODES I and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, Nuclear Instrumentation."

Palisades Nuclear Plant B 3.3.1-22 Revised 01122/2003

RPS Instrumentation B 3.3.1 BASES APPLICABILITY (continued) The High Startup Rate Trip Function is required to be OPERABLE in MODES I and 2, but may be bypassed when the associated wide range NI channel indicates below I E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3,4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, Nuclear Instrumentation.'

The Loss of Load trip is required to be OPERABLE with THERMAL POWER at or above 17% RTP. Below 17% RTP, the ADVs are capable of relieving the pressure due to a Loss of Load event without challenging other overpressure protection.

The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESF in providing acceptable consequences during accidents.

ACTIONS The most common causes of channel inoperability are outright failure of loop components or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to the safe" condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is found inoperable, all affected Functions provided by that channel must be declared inoperable, and the plant must enter the Condition for the particular protection Functions affected.

Palisades Nuclear Plant B 3.3.1-23 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES (

ACTIONS (continued) When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

A.1 Condition A applies to the failure of a single channel in any required RPS Function, except High Startup Rate, Loss of Load, or ZPM Bypass Removal. (Condition A is modified by a Note stating that this Condition does not apply to the High Startup Rate, Loss of Load, or ZPM Bypass Removal Functions. The failure of one channel of those Functions is addressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel is (

inoperable, operation is allowed to continue. Since the trip unit and associated instrument channel combine to perform the trip function, this Condition is also appropriate if both the trip unit and the associated instrument channel are inoperable. Though not required, the inoperable channel may be bypassed. The provision of four trip channels allows one channel to be bypassed (removed from service) during operations, placing the RPS in two-out-of-three coincidence logic. The failed channel must be restored to OPERABLE status or placed in trip within 7 days.

Required Action A.1 places the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent trip.

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.1-24 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES ACTIONS .1 (continued)

(continued)

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

B.1 Condition B applies to the failure of a single High Startup Rate trip unit or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to entering MODE 2 from MODE 3. A shutdown provides the appropriate opportunity to repair the trip function and conduct the necessary testing. The Completion Time is based on the fact that the safety analyses take no credit for the functioning of this trip.

C.1 Condition C applies to the failure of a single Loss of Load or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to THERMAL POWER 2 17% RTP following a shutdown. If the plant is shutdown at the time the channel becomes inoperable, then the failed channel must be restored to OPERABLE status prior to THERMAL POWER 2 17% RTP.. For this Completion Time, "following a shutdown' means this Required Action does not have to be completed until prior to THERMAL POWER 2 17% RTP for the first time after the plant has been in MODE 3 following entry into the Condition. The Completion Time trip assures that the plant will not be restarted with an inoperable Loss of Load trip channel.

Palisades Nuclear Plant B 3.3.1-25 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

Condition D applies when one or more automatic ZPM Bypass removal channels are inoperable. If the ZPM Bypass removal channel cannot be restored to OPERABLE status, the affected ZPM Bypasses must be immediately removed, or the bypassed RPS trip Function channels must be immediately declared to be inoperable. Unless additional circuit failures exist, the ZPM Bypass may be removed by placing the associated Zero Power Mode Bypass' key operated switch in the normal position.

A trip channel which is actually bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must immediately be declared to be inoperable.

E.1 and E.2 Condition E applies to the failure of two channels in any RPS Function, except ZPM Bypass Removal Function. (The failure of ZPM Bypass Removal Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does not apply to the ZPM Bypass Removal Function.

The Required Actions are modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel tripped.

MODE changes in this configuration are allowed because two trip channels for the affected function remain OPERABLE. A trip occurring in either or both of those channels would cause a reactor trip.

In this configuration, the protection system is in a one-out-of-two logic, and the probability of a common cause failure affecting both of the OPERABLE channels during the 7 days permitted is remote.

Required Action E.1 provides for placing one inoperable channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Though not required, the other inoperable channel may be (trip channel) bypassed.

Palisades Nuclear Plant 8 3.3.1-26 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES ACTIONS E.1 and E.2 (continued)

(continued)

This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed or inoperable in an untripped condition, the RPS is in a two-out-of-three logic for that function; but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, one of the inoperable channels is placed in trip. This'places the RPS in a one-out-of-two for that function logic. If any of the other unbypassed channels for that function receives a trip signal, the reactor will trip.

Action E.2 is modified by a Note stating that this'Action does not apply to (is not required for) the High Startup Rate and Loss of Load

. Functions.

One channel is required to be restored to OPERABLE status within 7 days for reasons similar to those stated under'Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action E.2 must be placed in trip if more than 7 days have elapsed since the initial channel failure.

F.1 The power range excore channels are used to generate the internal ASI signal used as an input to the TMILP trip. They also provide input to the Thermal Margin Monitors for determination of the Q Power input for the TM/LP trip and the VHPT.. If two power range excore channels cannot be restored to OPERABLE status, power is restricted or reduced during subsequent operations because of increased uncertainty associated with inoperable power range excore 'channels which provide input to those trips. ' '

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is adequate to reduce power in an orderly manner without challenging plant systems.

Palisades Nuclear Plant 8 3.3.1-27 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES ACTIONS G.1. G.2.1, and G.2.2 (continued)

Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, E, or F are not met, or if the control room ambient air temperature exceeds 90 0F.

If the control room ambient air temperature exceeds 901F, all Thermal Margin Monitor channels are rendered inoperable because their operating temperature limit is exceeded. In this condition, or if the Required Actions and associated Completion Times are not met, the reactor must be placed in a condition in which the LCO does not apply.

To accomplish this, the plant must be placed in MODE 3, with no more than one full-length control rod capable of being withdrawn or with the PCS boron concentration at REFUELING BORON CONCENTRATION in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The Completion Time is reasonable, based on operating experience, for placing the plant in MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The Completion Time is also reasonable to ensure that no more than one full-length control rod is capable of being withdrawn or that the PCS boron concentration is at REFUELING BORON CONCENTRATION.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column of REQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3. 1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Under most conditions, a CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Palisades Nuclear Plant B 3.3.1-28 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS (continued) Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

The Containment High Pressure and Loss of Load channels are pressure switch actuated. As such, they have no associated control room indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.1.2 This SR verifies that the control room ambient air temperature is within the environmental qualification temperature limits for the most restrictive RPS components, which are the Thermal Margin Monitors. These monitors provide input to both the VHPT Function and the TM/LP Trip Function. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on engineering judgement and plant operating experience.

SR 3.3.1.3 A daily calibration (heat balance) is performed when THERMAL POWER is 2 15%. The daily calibration consists of adjusting the "nuclear power calibrate" potentiometers to agree with the calorimetric calculation if the absolute difference is 2 1.5%. Nuclear power is adjusted via a potentiometer, or THERMAL POWER is adjusted via a Thermal Margin Monitor bias number, as necessary, in accordance with the daily calibration (heat balance) procedure. Performance of the daily calibration ensures that the two inputs to the Q power measurement are indicating accurately with respect to the much more accurate secondary calorimetric calculation.

Palisades Nuclear Plant B 3.3.1-29 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS (continued) The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 2 15% RTP.

The secondary calorimetric is inaccurate at lower power levels. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time requirements for plant stabilization, data taking, and instrument calibration.

SR 3.3.1.4 It is necessary to calibrate the power range excore channel upper and lower subchannel amplifiers such that the measured ASI reflects the true core power distribution as determined by the incore detectors. ASI is utilized as an input to the TM/LP trip function where it is used to ensure that the measured axial power profiles are bounded by the axial power profiles used in the development of the Tiniet limitation of LCO 3.4.1. An adjustment of the excore channel is necessary only if reactor power is greater than 25% RTP and individual excore channel ASI differs from AXIAL OFFSET, as measured by the incores, outside the bounds of the following table:

Allowed Group 4 Group 4 Reactor Rods 128" withdrawn Rods <128" withdrawn Power

100% -0.020 * (AO-ASI) 5 0.020 -0.040 5 (AO-ASI) 5 0.040

< 95 -0.033 * (AO-ASI)

0.020 -0.053 (AO-ASI)

0.040

< 90 -0.046 < (AO-ASI) s 0.020 -0.066 s (AO-ASI) 0.040

< 85 -0.060 (AO-ASI)

0.020 -0.080 * (AO-ASI) 5 0.040

< 80 -0.133 < (AO-ASI) 5 0.080 -0.153 < (AO-ASI)

0.100

< 75 -0.146 < (AO-ASI) 5 0.080 -0.153 * (AO-ASI)

0.100

< 70 -0.153 * (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 5 0.100

< 65 -0.153 (AO-ASI)

0.080 -0.153 < (AO-ASI) < 0.100

< 60 -0.153 (AO-ASI) s 0.080 -0.153 < (AO-ASI)

0.100

< 55 -0.153 (AO-ASI) 0.080 -0.153 < (AO-ASI) 5 0.100

< 50 -0.153 * (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 0.100

<45 -0.153 (AO-ASI) 5 0.080 -0.153 s (AO-ASI)

0.100

< 40 -0.153 5 (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) < 0.100

< 35 -0.153 * (AO-ASI) 5 0.080 -0.153 5 (AO-ASI) 5 0.100

< 30 -0.153 5 (AO-ASI)

0.080 -0.153 * (AO-ASI) 5 0.100

< 25 Below 25% RTP any AO/ASI difference is acceptable Table values determined with a conservative Pa, gamma constant of -9420.

Palisades Nuclear Plant B 3.3.1-30 Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS (continued) Below 25% RTP any difference between ASI and AXIAL OFFSET is acceptable. A Note indicates the Surveillance is not required to have been performed until .12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 2 25% RTP.

Uncertainties in the excore and incore measurement process make it impractical to calibrate when THERMAL POWER is < 25% RTP. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time for plant stabilization, data taking, and instrument calibration.

The 31 day Frequency is adequate, based on operating experience of the excore linear amplifiers and the slow burnup of the detectors. The excore readings are a strong function of the power produced in the peripheral fuel bundles and do not represent an integrated reading across the core. Slow changes in neutron flux during the fuel cycle can also be detected at this Frequency.

SR 3.3.1.5 A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, except Loss of Load and High Startup Rate, every 92 days to ensure the entire channel will perform its intended function when needed. For the TM/LP Function, the constants associated with the Thermal Margin Monitors must be verified to be within tolerances.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 5).

Palisades Nuclear Plant B 3.3.1-31 . Revised 01/22/2003

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) A calibration check of the power range excore channels using the internal test circuitry is required every 92 days. This SR uses an internally generated test signal to check that the 0% and 50% levels read within limits for both the upper and lower detector, both on the analog meter and on the TMM screen. This check verifies that neither the zero point nor the amplifier gain adjustment have undergone excessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operating experience, and takes into account indications and alarms available to the operator in the control room.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on the Loss of Load and High Startup Rate channels is performed prior to a reactor startup to ensure the entire channel will perform its intended function.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-1/3 sends a trip signal to RPS channels A and C; N-2/4 to channels B and D. Since each High Startup Rate channel would cause a trip on two RPS channels, the High Startup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring turbine auto stop oil pressure which is not tested when the reactor is critical. Operating experience has shown that Ihese components usually pass the Surveillance when performed at a Frequency of once per 7 days prior to each reactor startup.

Palisades Nuclear Plant B 3.3.1-32 Revised 0112212003

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 REQUIREMENTS (continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (except neutron detectors). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be consistent with the setpoint analysis.

The bistable setpoints must be found to trip within the Allowable Values specified in the LCO and left set consistent with the assumptions of the setpoint analysis. The Variable High Power Trip setpoint shall be verified to reset properly at several indicated power levels during (simulated) power increases and power decreases.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the setpoint analysis.

As part of the CHANNEL CALIBRATION of the wide range Nuclear Instrumentation, automatic removal of the ZPM Bypass for the Low PCS Flow, TM/LP must be verified to assure that these trips are available when required.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

This SR is modified by a Note which states that It is not necessary to calibrate neutron detectors because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in power range excore neutron detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.3) and the monthly calibration using the incore detectors (SR 3.3.1.4). Sudden changes in detector performance would be noted during the required CHANNEL CHECKS (SR 3.3.1.1).

Palisades Nuclear Plant B 3.3.1-33 .- Revise~d 01/2212003

RPS Instrumentation B 3.3.1 I

BASES k REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100

3. IEEE Standard 279-1971, April 5,1972

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989

(

Palisades Nuclear Plant B 3.3.1-34 Revised 01/22/2003

RPS Instrumentation B 3.3.1 Table B 3.3.1-1 (page 1 of 1)

Instruments Affecting Multiple Specifications Required Instrument Channels Affected Specifications Nuclear Instrumentation Source Range NI-1/3, Count Rate Indication @ C-150 Panel 3.3.8 (#1)

Source Range NI-1/3 & 2/4, Count Rate Signal 3.3.9 & 3.9.2 Wide Range NI-1/3 & 2/4, Flux Level 10V Bypass 3.3.1 (#3, 6, 7, 9, & 12)

Wide Range NI-1/3 & 2/4, Startup Rate 3.3.1 (#2)

Wide Range NI-1/3 & 2/4, Flux Level Indication 3.3.7 (#3) & 3.3.9 Power Range NI-5, 6, 7, & 8, Tg 3.2.1 & 3.2.3 Power Range NI-5, 6, 7, & 8, Q Power 3.3.1 (#1 & 9)

Power Range NI-5, 6, 7, & 8,ASI 3.3.1 (#9) & 3.2.1 & 3.2.4 Power Range NI-5, 6, 7, & 8, Loss of Load/High Startup Rate Bypass 3.3.1 (#2 & 10)

PCS T-Cold Instruments TT-0112CA, Temperature Signal (SPI AT Power for PDlL Alarm Circuit) 3.1.6 TT-0112CA & 0122CA, Temperature Signal (C-150) 3.3.8 (#6 & 7)

TT-0122CB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112CA & 0122CB, Temperature Signal (LTOP) 3.4.12.b.1 TT-0112CC & 0122CD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#2)

TT-0112 & 0122 CC & CD, Temperature Signal (SMM) 3.3.7 (#5)

TT-0112 & 0122 CA, CB, CC, & CD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9) & 3.4.1.b PCS T-Hot Instruments - _ __=_X TT-0112HA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112HA & 0122HA, Temperature Signal (C-150) 3.3.8 (#4 & 5)

TT-0122HB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112 & 0122 HC & HD, Temperature Signal (SMM) - 3.3.7 (#5)

TT-0112HC & 0122HD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#1)

TT-0112 & 0122 HA, HB, HC, & HD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9)

Thermal Margin Monitors PY-0102A, B, C, & D 1 3.3.1 (#1 & 9)

Pressurizer Pressure Instruments PT-0102A, B, C, & D, Pressure Signal (RPS & SIS) 3.3.1 (#8 & 9) &

3.3.3 (#1.a & 7a)

PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.1 & 3.4.14 PT-0105A & B, Pressure Signal (WR Indication & LTOP) 3.3.7 (#5) & 3.4.12.b.1 P-0110, Pressure Indication @ C-150 Panel 3.3.8 (#2)

SG Level Instruments LT-0751 & 0752 A, B, C, & D, Level Signal (RPS & AFAS) 3.3.1 (#4 & 5) &

3.3.3 (#4.a & 4.b)

LI-0757 & 0758 A & B,Wide Range Level Indication 3.3.7 (#11 & 12)

LI-0757C & 0758C, Wide Range Level Indication @ C-150 Panel 3.3.8 (#10 & 11)

SG Pressure Instruments PT-0751 & 0752 A, B, C, & D, Pressure Signal (RPS & SG Isolation) 3.3.1 (#6 & 7) &

3.3.3 (#2a, 2b, 7b, 7c)

PIC-0751 & 0752 C & D, Pressure Indication 3.3.7 (#13 & 14)

PI-0751E & 0752E, Pressure Indication @ C-150 Panel 3.3.8 (#8 & 9)

Containment Pressure Instruments PS-1801, 1802, 1803, & 1804, Switch Output (RPS) 3.3.1 (#11)

PS-1 801, 1802A, 1803, & 1804A, Switch Output (ESF) 3.3.3 (#5.a)

PS-1 801A, 1802, 1803A, & 1804, Switch Output (ESF) 3.3.3 #5.b Note: The information provided in this table is intended for use as an aid to distinguish those instrument channels which provide more than one required function and to describe which specifications they affect. The information in this table should not be taken as inclusive for all instruments nor affected specifications.

Palisades Nuclear Plant B 3.3.1-35 Revised 01/22/2003

ESF Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Engineered Safety Features (ESF) Instrumentation BASES BACKGROUND The ESF Instrumentation initiates necessary safety systems, based upon the values of selected plant parameters, to protect against violating core design limits and the Primary Coolant System (PCS) pressure boundary and to mitigate accidents.

The ESF circuitry generates the signals listed below when the monitored variables reach levels that are indicative of conditions requiring protective action. The inputs to each ESF actuation signal are also listed.

1. Safety Injection Signal (SIS).

a. Containment High Pressure (CHP)

b. Pressurizer Low Pressure

2. Steam Generator Low Pressure (SGLP);

a. Steam Generator A Low Pressure

b. Steam Generator B Low Pressure

3. Recirculation Actuation Signal (RAS);

a. Safety Injection Refueling Water Tank (SIRWT) Low Level

4. Auxiliary Feedwater Actuation Signal (AFAS);

a. Steam Generator A Low Level

b. -Steam Generator B Low Level.

5. Containment High Pressure Signal (CHP);

a. Containment High Pressure - Left Train

b. Containment High Pressure - Right Train Palisades Nuclear Plant B 3.3.3-1 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND 6. Containment High Radiation Signal (CHR);

(continued)

a. Containment High Radiation

7. Automatic Bypass Removal

a. Pressurizer Pressure Low Bypass

b. Steam Generator A Low Pressure Bypass

c. Steam Generator B Low Pressure Bypass In the above list of actuation signals, the CHP and RAS are derived from pressure and level switches, respectively.

Equipment actuated by each of the above signals is identified in the FSAR, Chapter 7. (Ref. 1).

The ESF circuitry, with the exception of RAS, employs two-out-of-four logic. Four independent measurement channels are provided for each function used to generate ESF actuation signals. When any two channels of the same function reach their setpoint, actuating relays are energized which, in turn, initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment.

RAS logic consists of output contacts of the relays actuated by the SIRWT level switches arranged in a "one-out-of-two taken twice" logic.

The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS. Loss of a single battery, therefore, cannot either cause or prevent RAS initiation.

The ESF logic circuitry contains the capability to manually block the SIS actuation logic and the SGLP action logic during normal plant shutdowns to avoid undesired actuation of the associated equipment.

In each case, when three of the four associated measurement channels are below the block setpoint, pressing a manual pushbutton will block the actuation signal for that train. If two of the four of the measurement channels increase above the block setpoint, the block will automatically be removed.

Palisades Nuclear Plant B 3.3.3-2 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND 7. Automatic Bypass Removal (continued)

(continued)

The sensor subsystems, including individual channel actuation bistables, is addressed in this LCO. The actuation logic subsystems, manual actuation, and downstream components used to actuate the individual ESF components are addressed in LCO 3.3.4.

Measurement Channels Measurement channels, consisting of pressure switches, field

- transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

Four identical measurement channels are provided for each parameter used in the generation of trip signals. These are designated Channels A through D. Measurement channels provide input to ESF bistables within the same ESF channel. In addition, some measurement channels may also be used as inputs to Reactor Protective System (RPS) bistables, and most provide indication in the control room.

When a channel monitoring a parameter indicates an abnormal condition, the bistable monitoring the parameter in that channel will trip.

In the case of RAS and CHP, the sensors are latching auxiliary relays from level and pressure switches, respectively, which do not develop an analog input to separate bistables. Tripping two or more channels monitoring the same parameter will actuate both channels of Actuation Logic of the associated ESF equipment.

Three of the four measurement and bistable channels are necessary to meet the redundancy and testability of GDC 21 in Appendix A to 10 CFR 50 (Ref. 2); The fourth channel provides additional flexibility by allowing one channel to be removed from service for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation and no protective channel feeds a control channel, this arrangement meets the requirements of IEEE Standard 279 -1971 (Ref. 3).

Palisades Nuclear Plant B 3.3.3-3 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

The ESF Actuation Functions are generated by comparing a single measurement to a fixed bistable setpoint. The ESF Actuation Functions utilize the following input instrumentation:

Safety Injection Signal (SIS)

The Safety Injection Signal can be generated by any of three inputs: Pressurizer Low Pressure, Containment High Pressure, or Manual Actuation. Manual Actuation is addressed by LCO 3.3.4; Containment High Pressure is discussed below. Four instruments (channels A through D), monitor Pressurizer Pressure to develop the SIS actuation. Each of these instrument channels has two individually adjustable ESF bistable trip devices, one for the bypass removal circuit (discussed below) and one for SIS. Each ESF bistable trip device actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LCO 3.3.4. The instrument channels associated with each Pressurizer Low Pressure SIS actuation bistable include the pressure measurement loop, the SIS actuation bistable, and the two auxiliary relays associated with that bistable. The bistables associated with automatic removal of the Pressurizer Low Pressure Bypass are discussed under Function 7.a, below.

Low Steam Generator Pressure Siqnal (SGLP)

There are two separate Low Steam Generator Pressure signals, one for each steam generator. For each steam generator, four instruments (channels A through D) monitor pressure to develop the SGLP actuation. Each of these instrument channels has two individually adjustable ESF bistable trip devices, one for the bypass removal circuit (discussed below) and one for SGLP.

Each Steam SGLP bistable trip device actuates an auxiliary relay.

The output contacts from these auxiliary relays form the SGLP logic circuits addressed in LCO 3.3.4. The instrument channels associated with each Steam Generator Low Pressure Signal bistable include the pressure measurement loop, the SGLP actuation bistable, and the auxiliary relay associated with that bistable. The bistables associated with automatic removal of the SGLP Bypass are discussed under Function 7.a, below.

Palisades Nuclear Plant B 3.3.3-4 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

Recirculation Actuation Signal (RAS)

There are four Safety Injection Refueling Water (SIRW) Tank level instruments used to develop the RAS signal. Each of these instrument channels actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LCO 3.3.4. The SIRW Tank Low Level instrument channels associated with each RAS actuation bistable include the level instrument and the two auxiliary relays associated with that instrument.

Auxiliary Feedwater Actuation Signal (AFAS)

There are two separate AFAS signals (AFAS channels A and B),

each one actuated on low level in either steam generator. For each steam generator, four level instruments (channels A through D) monitor level to develop the AFAS actuation signals. The output contacts from the bistables on these level channels form the AFAS logic circuits addressed in LCO 3.3.4. The instrument channels associated with each Steam Generator Low Level Signal bistable include the level measurement loop and the Low Level AFAS bistable.

Containment High Pressure Actuation (CHP)

The Containment High Pressure signal is actuated by two sets of four pressure switches, one set for each train. The output contacts from these pressure switches form the CHP logic circuits addressed in LCO 3.3.4.

Palisades Nuclear Plant B 3.3.3-5 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

Containment High Radiation Actuation (CHR)

The CHR signal can be generated by either of two inputs: High Radiation or Manual Actuation. Manual Actuation is addressed by LCO 3.3.4. Four radiation monitor instruments (channels A through D), monitor containment area radiation level to develop the CHR signal. Each CHR monitor bistable device actuates one auxiliary relay which has contacts in each CHR logic train addressed in LCO 3.3.4. The instrument channels associated with each CHR actuation bistable include the radiation monitor itself and the associated auxiliary relay.

Automatic Bypass Removal Functions Pressurizer Low Pressure and Steam Generator Low Pressure logic circuits have the capability to be blocked to avoid undesired actuation when pressure is intentionally lowered during plant shutdowns. In each case these bypasses are automatically removed when the measured pressure exceeds the bypass permissive setpoint. The measurement channels which provide (

the bypass removal signal are the same channels which provide the actuation signal. Each of these pressure measurement channels has two bistables, one for actuation and one for the bypass removal Function. The pressurizer pressure channels include an auxiliary relay actuated by the bypass removal bistable.

The logic circuits for Automatic Bypass Removal Functions are addressed by LCO 3.3.4.

Several measurement instrument channels provide more than one required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

Palisades Nuclear Plant B 3.3.3-6 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND Bistable Trip Units (continued)

There are four channels of bistables, designated A through D, for each ESF Function, one for each measurement channel. The bistables for all required Functions, except CHP and RAS, receive an analog input from the measurement device; compare the analog input to trip setpoints, and provide contact output to the Actuation Logic. CHP and RAS are actuated by pressure switches and level switches respectively.

The Allowable Values are specified for each safety related ESF trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument'loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These'uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is not within'its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that Safety Limits of Chapter 2.0, "SAFETY LIMITS (SLs)," are not violated during Anticipated Operational Occurrences (AOOs) and that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed. (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.")

ESF Instrument Channel Bypasses The only ESF instrument channels with built-in bypass capability are the Low SG Level AFAS bistables. Those bypasses are effected by a key operated switch, similar to the RPS Trip Channel Bypasses. A bypassed Low SG Level channel AFAS bistable'cannot perform its specified function and must be considered inoperable.

Palisades Nuclear Plant 8 3.3.3-7 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES BACKGROUND ESF Instrument Channel Bypasses (continued)

(continued)

While there are no other built-in provisions for instrument channel bypasses in the ESF design (bypassing any other channel output requires opening a circuit link, lifting a lead, or using a jumper), this LCO includes requirements for OPERABILITY of the instrument channels and bistables which provide input to the Automatic Bypass Removal Logic channels required by LCO 3.3.4, ESF Logic and Manual Initiation.'

The Actuation Logic channels for Pressurizer Pressure and Steam Generator Low Pressure, however, have the ability to be manually bypassed when the associated pressure is below the range where.

automatic protection is required. These actuation logic channel bypasses may be manually initiated when three-out-of-four bypass permissive bistables indicate below their setpoint. When two-out-of-four of these bistables are above their bypass permissive setpoint, the actuation logic channel bypass is automatically removed. The bypass permissive bistables use the same four measurement channels as the blocked ESF function for their inputs.

(..

APPLICABLE Each of the analyzed accidents can be detected by one or more ESF SAFETY ANALYSES Functions. One of the ESF Functions is the primary actuation signal for that accident. An ESF Function may be the primary actuation signal for more than one type of accident. An ESF Function may also be a secondary, or backup, actuation signal for one or more other accidents.

Functions not specifically credited in the accident analysis, serve as backups and are part of the NRC approved licensing basis for the plant.

Palisades Nuclear Plant B 3.3.3-8 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES

APPLICABLE ESF protective Functions are as follows.

SAFETY ANALY 'SES (continued) 1. Safety Iniection Signal (SIS)

The SIS ensures acceptable consequences during Loss of Coolant Accident (LOCA) events, including steam generator tube rupture, and Main Steam Line Breaks (MSLBs) or Feedwater Line Breaks (FWLBs) (inside containment). To provide the required protection, SIS is actuated by a CHP signal, or by two-out-of-four Pressurizer Low Pressure channels decreasing below the setpoint. SIS initiates the following actions:

a. Start HPSI & LPSI pumps;

b. Start component cooling water and service water pumps;

c. Initiate service water valve operations;

d. Initiate component cooling water valve operations;

e. Start containment cooling fans (when coincident with a loss of offsite power);

f. Enable Containment Spray Pump Start on CHP; and

g. Initiate Safety Injection Valve operations.

Each SIS logic train is also actuated by a contact pair on one of the CHP initiation relays for the associated CHP train.

2. Steam Generator Low Pressure Signal (SGLP)

,The SGLP ensures acceptable consequences during an MSLB or FWLB by isolating the steam generator if it indicates a low steam generator pressure. 'The SGLP concurrent with or following a reactor trip, minimizes the rate of heat extraction and subsequent cooldown of the PCS during these events.

Palisades Nuclear Plant B 3.3.3-9 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES APPLICABLE 2. Steam Generator Low Pressure Signal (SGLP) (continued)

SAFETY ANALYSES (continued) One SGLP circuit is provided for each SG. Each SGLP circuit is actuated by two-out-of-four pressure channels on the associated SG reaching their setpoint. SGLP initiates the following actions:

a. Close the associated Feedwater Regulating valve and its bypass; and

b. Close both Main Steam Isolation Valves.

3. Recirculation Actuation Signal At the end of the injection phase of a LOCA, the SIRWT will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. Switchover from SIRWT to the containment sump must occur before the SIRWT empties to prevent damage to the ECCS pumps and a loss of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sump to support pump suction.

Furthermore, early switchover must not occur to ensure sufficient borated water is injected from the SIRWT to ensure the reactor remains shut down in the recirculation mode. An SIRWT Low Level signal initiates the RAS.

0 RAS initiates the following actions:

a. Trip LPSI pumps (this trip can be manually bypassed);

b. Switch HPSI and containment spray pump suction from SIRWT to Containment Sump by opening sump CVs and closing SIRWT CVs;

c. -Adjust cooling water to component cooling heat exchangers;

d. Open HPSI subcooling valve CV-3071 if the associated HPSI pump is operating;

e. After containment sump valve CV-3030 is opened, open HPSI subcooling valve CV-3070 if the associated HPSI pump is operating;

f. Close containment spray valve CV-3001 if containment sump valve CV-3030 does not open.

Palisades Nuclear Plant B 3.3.3-1 0 Revised 01/22/2003-

ESF Instrumentation B 3.3.3 BASES APPLICABLE 3 Recirculation Actuation Signal (continued)

SAFETY ANALYSES (continued) The RAS signal is actuated by separate sensors from those which provide tank level indication. The allowable range of 21" to 27" above the tank floor corresponds to 1.1% to 3.3% indicated level.

Typically the actual setting is near the midpoint of the allowable range.

4 Auxiliary Feedwater Actuation Signal An AFAS initiates feedwater flow to both steam generators if a low

-level is indicated in either steam generator.

The AFAS maintains a steam generator heat sink during the.

following events:

MSLB;

FWLB;

LOCA; and

Loss of feedwater.

5. Containment High Pressure Signal (CHP)

The CHP signal closes all containment isolation valves not required for.ESF operation and starts containment spray (if SIS enabled), ensuring acceptable consequences during LOCAs, control rod ejection events, MSLBs, or FWLBs (inside containment); :

CHP is actuated by two-out-of-four pressure switches for the.

associated train reaching their setpoints. CHP initiates the following actions:

a. Containment Spray;

b. Safety Injection Signal;

c. Main Feedwater Isolation; Palisades Nuclear Plant B 3.3.3-1 1 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES APPLICABLE 5. 'Containment High Pressure Siqnal (CHP) (continued)

SAFETY ANALYSIS (continued) d. Main'Steam Line Isolation;

e. Control Room HVAC Emergency Mode; and

f. Containment Isolation Valve Closure.

6. Containment High Radiation Signal (CHR)

CHR is actuated by two-out-of-four radiation monitors exceeding their setpoints. CHR initiates the following actions to ensure acceptable consequences following a LOCA or control rod ejection event:

a. Control Room HVAC Emergency Mode;

b. Containment Isolation Valve Closure; and

c. Block automatic starting of ECCS pump room sump pumps.

During refueling operations, separate switch-selectable radiation monitors initiate CHR, as addressed by' LCO 3.3.6. C

7. Automatic Bvass Removal Functions The logic circuitry provides automatic removal of the Pressurizer Pressure Low and Steam Generator Pressure Low actuation signal bypasses. There are no assumptions in the safety analyses which assume operation of these automatic bypass removal circuits, and no analyzed events result in conditions where the automatic removal would be required to mitigate the event. The automatic removal circuits are required to assure that logic circuit bypasses will not be overlooked during a plant startup.

The ESF Instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.3.3-12 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES LCO The LCO requires all channel components necessary to provide an ESF actuation to be OPERABLE.

The Bases for the LCO on ESF Functions are addressed below.

1. Safety Injection Signal (SIS)

This LCO requires four channels of SIS Pressurizer Low Pressure to be OPERABLE in MODES 1, 2, and 3.

The setpoint was chosen so as to be low enough to avoid actuation during plant operating transients, but to be high enough to be quickly actuated by a LOCA or MSLB. The settings include an uncertainty allowance which is consistent with the settings assumed in the MSLB analysis (which bounds the settings assumed in the LOCA analysis).

2. Steam Generator Low Pressure Signal (SGLP)

This LCO requires four channels of Steam Generator Low Pressure Instrumentation for each SG to be OPERABLE in MODES 1, 2, and 3. However, as indicated in Table 3.3.3-1, Note (a), the SGLP Function is not required to be OPERABLE in MODES 2 or 3 if all Main Steam Isolation Valves (MSIVs) are closed and deactivated and all Main Feedwater Regulating Valves (MFRVs) and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves.

The setpoint was chosen to be low enough to avoid actuation during plant operation, but be close enough to full power operating pressure to be actuated quickly in the event of a MSLB. The.

setting includes an uncertainty allowance which is consistent with the setting used in the Reference 4 analysis.

Each SGLP logic is made up of output contacts from four pressure bistables from the associated SG. When the logic circuit is satisfied, two relays are energized to actuate steam and feedwater line isolation.

Palisades Nuclear Plant B 3.3.3-13 Revised 01/22/2003 -

ESF Instrumentation B 3.3.3 BASES LCO 2. Steam Generator Low Pressure Signal (SGLP) (continued)

(continued)

This LCO applies to failures in the four sensor subsystems, including sensors, bistables, and associated equipment. Failures in the actuation subsystems are considered Actuation Logic failures and are addressed in LCO 3.3.4.

3. Recirculation Actuation Siqnal (RAS)

This LCO requires four channels of SIRWT Low Level to be OPERABLE in MODES 1, 2, and 3.

The setpoint was chosen to provide adequate water in the containment sump for HPSI pump net positive suction head following an accident, but prevent the pumps from running dry during the switchover.

The upper limit on the Allowable Value for this trip is set low enough to ensure RAS does not initiate before sufficient water is transferred to the containment sump. Premature recirculation could impair the reactivity control Function of safety injection by limiting the amount of boron injection. Premature recirculation could also damage or disable the recirculation system if recirculation begins before the sump has enough water.

( j The lower limit on the SIRWT Low Level trip Allowable Value is high enough to transfer suction to the containment sump prior to emptying the SIRWT.

4. Auxiliaru Feedwater Actuation Signal (AFAS)

The AFAS logic actuates AFW to each SG on a SG Low Level in either SG.

The Allowable Value was chosen to assure that AFW flow would be initiated while the SG could still act as a heat sink and steam source, and to assure that a reactor trip would not occur on low level without the actuation of AFW.

. A..~~~~

Palisades Nuclear Plant B 3.3.3-14 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES LCO 4. Auxiliary Feedwater Actuation Signal (AFAS) (continued)

(continued)

This LCO requires four channels for each steam generator of Steam Generator Low Level to be OPERABLE in MODES 1, 2, and 3.

5. Containment High.Pressure Signal (CHP)

'This LCO requires four channels of CHP to be OPERABLE for each of the associated ESF trains (left and right) in MODES 1, 2, 3 and 4.

The setpoint was chosen so as to be high enough to avoid actuation by containment temperature or atmospheric pressure changes, but low enough to be quickly actuated by a LOCA or a MSLB in the containment.

6. Containment High Radiation Sigqnal (CHR)

This LCO requires four channels of CHR to be OPERABLE in MODES 1, 2, 3, and 4.

The setpoint is based on the maximum primary coolant leakage to the containment atmosphere allowed by LCO 3.4.13 and the maximum activity allowed by LCO 3.4.16. N concentration reaches equilibrium in containment atmosphere due to its short half-life, but other activity was assumed to build up. At the end of a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months leakage period the dose rate is approximately 20 R/h as seen by the area monitors. A large leak could cause the area dose rate to quickly exceed the 20 R/h setting and initiate CHR.

7. Automatic Bypass Removal The automatic bypass removal logic removes the bypasses which are used during plant shutdown periods, for Pressurizer Low Pressure and Steam Generator Low Pressure actuation signals.

The setpoints were chosen to be above the setpoint for the associated actuation signal, but well below the normal operating pressures. -

Palisades Nuclear Plant B 3.3.3-15 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES LCO 7. Automatic Bypass Removal (continued)

(continued)

This LCO requires four channels of Pressurizer Low Pressure bypass removal and four channels for each steam generator of Steam Generator Low Pressure bypass removal, to be OPERABLE in MODES , 2, and 3.

APPLICABILITY All ESF Functions are required to be OPERABLE in MODES 1, 2, and 3. In addition, Containment High Pressure and Containment High Radiation are required to be operable in MODE 4. C-';

(.

In MODES 1, 2, and 3 there is sufficient energy in the primary and secondary systems to warrant automatic ESF System responses to:

& Close the main steam isolation valves to preclude a positive reactivity addition and containment overpressure;

Actuate AFW to preclude the loss of the steam generators as a heat sink (in the event the normal feedwater system is not available);

Actuate ESF systems to prevent or limit the release of fission product radioactivity to the environment by isolating containment and limiting the containment pressure from exceeding the containment design pressure during a design basis LOCA or MSLB; and a Actuate ESF systems to ensure sufficient borated inventory to permit adequate core cooling and reactivity control during a design basis LOCA or MSLB accident.

The CHP and CHR Functions are required to be OPERABLE in MODE 4 to limit leakage of radioactive material from containment and limit operator exposure during and following a DBA.

The SGLP Function is not required to be OPERABLE in MODES 2 and 3, if all MSIVs are closed and deactivated and all MFRVs 'and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves, since the SGLP Function is not required to perform any safety functions under these conditions.

Palisades Nuclear Plant B 3.3.3-16 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES APPLICABILITY In lower MODES, automatic actuation of ESF Functions is not required, (continued) because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating the ESF components.

LCO 3.3.6 addresses automatic Refueling CHR isolation during CORE ALTERATIONS or during movement of irradiated fuel.

In MODES 5 and 6, ESFAS initiated systems are either reconfigured or disabled for shutdown' cooling operation. Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components.

ACTIONS The most common causes of channel inoperability are outright failure of loop components or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to the safe' condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

Typically, the drift is small and results in a delay of actuation rather than a total loss of function. Determination of setpoint drift is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the actual trip setpoint is not within the Allowable Value in Table 3.3.3-1, the channel is inoperable and the appropriate Condition(s) are entered.

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value in Table 3.3.3-1, or the sensor, instrument loop, signal processing electronics, or ESF bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the plant must enter the Condition statement for the particular protection Function affected.

Palisades Nuclear Plant B 3.3.3-17 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES ACTIONS When the number of inoperable channels in a trip Function exceeds (continued) those specified in any related Condition associated with the same trip Function, then the plant is outside the'safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A Note has been added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function in Table 3.3.3-1. Completion Times for the inoperable channel of a Function will be tracked separately.

A.1 Condition A applies to the failure of a single bistable or associated instrumentation channel of one or more input parameters in each ESF Function except the RAS Function. Since the bistable and associated instrument channel combine to perform the actuation function, the Condition is also appropriate if both the bistable and associated instrument channel are inoperable.

ESF coincidence logic is normally two-out-of-four. If one ESF channel is inoperable, startup or power operation is allowed to continue as long as action is taken to restore the design level of redundancy.

If one ESF channel is inoperable, startup or power operation is allowed to continue, providing the inoperable channel'actuation bistable is placed in trip within 7 days. The provision of four trip channels allows one channel to be inoperable in a non-trip condition up to the 7 day Completion Time allotted to place the channel in trip. Operating with' one ailed channel in a non-trip condition during operations, places the ESF Actuation Logic in a two-out-of-three coincidence logic.

If the failed channel cannot be restored to OPERABLE status in 7 days, the associated bistable is placed in a tripped condition. This places the function in a one-out-of-three configuration.

Palisades Nuclear Plant B 3.3.3-18 Revised 01/&2003

ESF Instrumentation B 3.3.3 BASES ACTIONS Al (continued)

(continued)

In this configuration, common cause failure of the dependent channel cannot prevent ESF actuation. The 7 day Completion Time is based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Condition A is modified by a Note which indicates it is not applicable to the SIRWT Low Level Function.

B.1 and B.2 Condition B applies to the failure of two channels in any of the ESF Functions except the RAS Function.

With two inoperable channels, one channel actuation device must be placed in trip within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. Eight hours is allowed for this action since it must be accomplished by a circuit modification, or by removing power from a circuit component. With one channel of protective instrumentation inoperable, the ESF Actuation Logic Function is in two-out-of-three logic, but with another channel inoperable the ESF may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in trip. This places the ESF in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, ESF actuation will occur.

One of the failed channels must be restored to OPERABLE status within 7 days, and the provisions of Condition A still applied to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action B.2 must be placed in trip if more than 7 days has elapsed since the channel's initial failure.

Palisades Nuclear Plant B 3.3.3-1 9 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES (

ACTIONS B.1 and B.2 (continued)

(continued)

Condition B is modified by a Note which indicates that it is not applicable to the SIRWT Low Level Function. The Required Action is also modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel tripped. MODE changes in this configuration are allowed, to permit maintenance and testing on one of the inoperable channels. In this configuration, the protection system is in a one-out-of-two logic, and the probability of a common cause failure affecting both of the OPERABLE channels during the 7 days permitted is remote.

C.1 and C.2 Condition C applies to one RAS SIRWT Low Level channel inoperable.

The' SIRWT low level circuitry is arranged in a "1-out-of-2 taken twice" logic rather than the more frequently used 2-out-of-4 logic. Therefore, Required Action C.1 differs from other ESF functions. With a bypassed SIRWT low level channel, an additional failure might disable automatic RAS, but would not initiate a premature RAS. With a tripped channel, an additional failure could cause a premature RAS, but would not disable the automatic RAS. .7 Since considerable time is available after initiation of SIS until RAS must be initiated, and since a premature RAS could damage the ESF.

pumps, it is preferable to bypass an inoperable channel and risk loss of automatic RAS than to trip a channel and risk a premature RAS.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months allowed is reasonable because the Required Action involves a circuit modification.

Required Action C.2 requires that the inoperable channel be restored to OPERABLE status within 7 days. The Completion Time is reasonable based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.3-20 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES ACTIONS D.1 and D.2 (continued)

If the Required Actions and associated Completion Times of Condition A, B, or C are not met for Functions 1, 2, 3, 4, or 7, the plant must be brought to'a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 and E.2 If the Required Actions and associated Completion Times of Condition A, B, or C are not met for Functions 5 or 6, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and.

to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular ESF Function are found in the SRs column REQUIREMENTS of Table 3.3.3-1 for that Function. Most functions are subject to

- CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3.3.1

- A CHANNEL CHECK is performed once'every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months on each ESF input channel which is~provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. A CHANNEL CHECK is not performed on the CHP and SIRWT Low Level channels because they have no associated control room indicator.

Palisades Nuclear Plant 8 3.3.3-21 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.1 (continued)

REQUIREMENTS (continued) Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more sericus. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when Surveillance is required, the CHANNEL CHECK will only verify that they are off scale in the same direction.

Offscale low current loop channels are verified to be reading at the bottom of the range and not failed downscale.

C..),

The Frequency of about once every shift is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of CHANNEL OPERABILITY during normal operational use of displays associated with the LCO required channels.

(

Palisades Nuclear Plant B 3.3.3-22 Revised 01/2212003

ESF Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed every 92 days to ensure the entire channel will perform its intended function when needed. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical' Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

This test is required to be performed each 92 days on ESF input channels provided with on-line testing capability. It is not required for the SIRWT Low Level channels since they have no built in test capability. The CHANNEL FUNCTIONAL TEST for SIRWT Low Level channels is performed each 18 months as part of the required CHANNEL CALIBRATION.

The CHANNEL FUNCTIONAL TEST tests the individual channels using an analog test input to each bistable.

Any setpoint adjustment shall be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Reference 5).

SR 3.3.3.3 CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the setpoint analysis.

Palisades Nuclear Plant B 3.3.3-23 Revised 01/22/2003

ESF Instrumentation B 3.3.3 BASES SURVEILLANCE SR 3.3.3.3 (continued)

REQUIREMENTS (continued) -The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the extension analysis. The requirements for this review are outlined in Reference 5.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis.

REFERENCES 1. FSAR, Chapter 7

2. 10 CFR 50, Appendix A

3. IEEE Standard 279-1971

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 1'

(-. .

Palisades Nuclear Plant B 3.3.3-24 Revised 01/22/2003

ESF Logic and Manual Initiation B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Engineered Safety Features (ESF) Logic and Manual Initiation BASES BACKGROUND The ESF Instrumentation initiates necessary safety systems, based upon the values of selected plant parameters, to protect against violating core design limits and the Primary Coolant System (PCS) pressure boundary and to mitigate accidents.

The ESF circuitry generates the following signals listed below when the monitored variables reach levels that are indicative of conditions requiring protective action. The inputs to each ESF Actuation Signal are also listed.

1. Safety Injection Signal (SIS);

a. Containment High Pressure (CHP)

I

b. Pressurizer Low Pressure

2. Steam Generator Low Pressure Signal (SGLP)

a. Steam Generator A Low Pressure

b. Steam Generator B Low Pressure

3. Recirculation Actuation Signal (RAS);

a. Safety Injection Refueling Water Tank (SIRWT) Low Level

4. Auxiliary Feedwater Actuation Signal (AFAS)

a. SteamGeneratorA Low Level

b. Steam Generator B Low Level Palisades Nuclear Plant B 3.3.4-1 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES BACKGROUND 5. Containment High Pressure Signal (CHP);

(continued)

a. Containment High Pressure - Left Train

b. Containment High Pressure - Right Train

6. Containment High Radiation Signal (CHR)

a. Containment High Radiation In the above list of actuation signals, the CHP and RAS are derived from pressure and level switches, respectively.

Equipment actuated by each of the above signals is identified in the FSAR, Chapter 7 (Ref. 1).

The ESF circuitry, with the exception of RAS, employs two-out-of-four logic. Four independent measurement channels are provided for each function used to generate ESF actuation signals. When any two channels of the same function reach their setpoint, actuating relays initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment. The actuation relays are considered part of the actuation logic addressed by this LCO.

RAS logic consists of output contacts of the relays actuated by the SIRWT Low Level switches arranged in a "one-out-of-two taken twice" logic. The contacts are arranged so that at least one low level signal powered from each station battery is required to initiate RAS. Loss of a single battery, therefore, cannot either cause or prevent RAS initiation.

The sensor subsystem, including individual channel bistables, is addressed in LCO 3.3.3, Engineered Safety Features (ESF)

Instrumentation." This LCO addresses the actuation subsystem manual actuation, and downstream components used to actuate the individual ESF functions, as defined in the following section.

Palisades Nuclear Plant B 3.3.4-2 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES BACKGROUND ESF Logic (continued) \

Each of the six ESF actuation signals in Table 3.3.4-1 operates two trains of actuating relays. Each train is capable of initiating the ESF equipment to meet the minimum requirements to provide all functions necessary to operate the system associated with the plant's capability to cope with abnormal events.

The SGLP logic circuitry includes provisions such that the SGLP automatic actuation Function may be bypassed if three-out-of-four Steam Generator (SG) pressure channels are below a bypass permissive setpoint. Similarly, the SIS automatic actuation on Pressurizer Low Pressure may be bypassed when three-out-of-four channels are below a permissive setpoint. This actuation bypassing is performed when the ESF Functions are no longer required for protection. These actuation bypasses are enabled manually when the permissive conditions are satisfied.

All actuation bypasses are automatically removed when enabling conditions are no longer satisfied. If an SIS or SGLP automatic actuation channel is bypassed, other than as allowed by Table 3.3.4-1, the channel cannot perform its required safety function and must be considered to be inoperable.

Testing of a major portion of the ESF circuits is accomplished while the plant is at power. More extensive sequencer and load testing may be done with the reactor shut down. The test circuits are designed to test the redundant circuits separately such that the correct operation of each circuit may be verified by either equipment operation or by sequence lights.

Manual Initiation Manual ESF initiation capability is provided to permit the operator to manually actuate an ESF System when necessary.

Two control room mounted manual actuation switches are provided for SIS actuation, one for each train. Each SIS manual actuation switch affects one actuation channel, which actuates one train of SIS equipment.

There are no single manual controls provided to actuate CHP, however, CHP may be manually initiated using individual component controls.

Palisades Nuclear Plant B 3.3.4-3 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES BACKGROUND Manual Initiation (continued)

(continued)

Two control room mounted manual actuation switches are provided for CHR actuation, each switch affects both actuation channels, which actuates both CHR trains.

There are no single manual controls provided to actuate SGLP, however, SGLP may be manually initiated using individual component controls.

RAS is actuated by manually actuating the circuit "Test" switch, however, RAS may also be manually initiated using individual component controls.

Manual actuation of AFW may be accomplished through pushbutton actuation of each AFAS channel or by use of individual pump and valve controls. Each automatic AFAS actuation channel starts the AFW pumps in their starting sequence (if P-8A fails to start, a P-8C start signal is generated, and. if P-8C also fails to start, a P-8B start signal is generated) and opens the associated flow control valves.

APPLICABLE Each of the analyzed accidents can be detected by one or more ESF SAFETY ANALYSES Functions. One of the ESF Functions is the primary actuation signal for that accident. An ESF Function may be the primary actuation signal for more than one type of accident. - An ESF Function may also be a secondary, or backup, actuation signal for one or more other accidents.

Functions such as Manual Initiation, not specifically credited in the accident analysis, serve as backups to Functions and are part of the NRC staff approved licensing basis for the plant.

The manual initiation is not required by the accident analysis. The ESF logic must function in all situations where the ESF function is required (as discussed in the Bases for LCO 3.3.3).

Each ESF Function and its associated safety analyses are discussed in the Applicable Safety Analyses section of the Bases for LCO 3.3.3, ESF Instrumentation.

The ESF satisfies Criterion 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.3.4-4 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES LCO The LCO requires that all components necessary to provide an ESF actuation be OPERABLE.

The Bases for the LCO on ESF automatic actuation Functions are addressed in LCO 3.3.3. Those associated with the Manual Initiation or Actuation Logic are addressed below.

ESF Logic and Manual Initiation Functions are required to be OPERABLE in MODES 1, 2, and 3, or in MODES 1, 2, 3, and 4, as appropriate, when the associated automatic initiation channels addressed by LCO 3.3.3 are required.

1. Safety Iniection Sicnal (SIS)

SIS is actuated by manual initiation, by a CHP signal, or by two-out-of-four Pressurizer Low Pressure channels decreasing below the setpoint. Each Manual Initiation channel consists of one pushbutton which directly starts the SIS actuation logic for the associated train. Each SIS logic train is also actuated by a contact pair on one of the CHP initiation relays for the associated CHP train.

a. Manual Initiation This LCO requires two channels of SIS Manual Initiation to be OPERABLE.

b. Actuation Logic This LCO requires two channels of SIS Actuation Logic to be OPERABLE. Faifures in the actuation subsystems are addressed in this LCO.;

c. CHPLoaicTrains The CHP initiation relay (5P-x) input to the SIS logic is considered part of the SIS logic. Two channels, one per SIS train, must be OPERABLE.

Palisades Nuclear Plant B 3.3.4-5 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES LCO 1. Safety Iniection Signal (SIS) (continued)

(continued)

d. Automatic Bypass Removal This LCO requires two channels of the automatic bypass removal logic for SIS Pressurizer Low Pressure to be OPERABLE. If an SIS automatic actuation channel is bypassed, other than as allowed by Table 3.3.4-1, the channel cannot perform its required safety function and must be considered to be inoperable.

As indicated by footnote (a), the Pressurizer Low Pressure logic train for each SIS train can be bypassed when three-out-of-four channels indicate below 1700 psia. This bypass prevents undesired actuation of SIS during a normal plant cooldown. The bypass signal is automatically removed when two-out-of-four channels exceed the setpoint, in accordance with the philosophy of removing bypasses when the enabling conditions are no longer satisfied.

The bypass permissive is set low enough so as not to be enabled during normal plant operation, but high enough to allow bypassing prior to reaching the trip setpoint.

2. Steam Generator Low Pressure Signal (SGLP)

a. Manual Initiation This LCO requires two channels of SGLP Manual Initiation to be OPERABLE. As indicated by footnote (c), there is no manual control which actuates the SGLP logic circuits. The actuated components must be individually actuated using control room manual controls.

b. Actuation Logic This LCO requires two channels of SGLP Actuation Logic to be OPERABLE, one for each SG.

Palisades Nuclear Plant B 3.3.4-6 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES LCO 2. Steam Generator Low Pressure Signal (SGLP) (continued)

(continued)

c. Automatic Bypass Removal

-This LCO requires two channels, one for each SG, of the SGLP automatic bypass removal logic to be OPERABLE. If an SGLP automatic actuation channel is bypassed, other than l as allowed by Table 3.3.4-1, the channel cannot perform its required safety function and must be considered to be inoperable.

As indicated by footnote (b), the SGLP from each SG may be bypassed when three-out-of-four channels indicate below 565 psia. This bypass prevents undesired actuation during a normal plant cooldown. The bypass signal is automatically removed when two-out-of-four channels exceed the setpoint, in accordance with the philosophy of removing bypasses when the enabling conditions are no longer satisfied.

The bypass permissive is set low enough so as not to be enabled during normal plant operation, but high enough to allow bypassing prior to reaching the trip setpoint.

3. Recirculation Actuation Signal RAS)

a. Manual Initiation This LCO requires two channels of RAS Manual Initiation to be OPERABLE. RAS is actuated by manually actuating the circuit "Test' switches.

b. Actuation Logic This LCO requires two channels of RAS Actuation Logic to be OPERABLE.

Palisades Nuclear Plant B 3.3.4-7 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES LCO 4. Auxiliary Feedwater Actuation Signal (AFAS)

(continued)

a. Manual Initiation This LCO requires two channels of AFAS Manual Initiation to be OPERABLE. Each train of AFAS may be manually initiated with either of two sets of controls. Only one set of manual controls is required to be OPERABLE for each AFW train. One set of controls are the pushbuttons provided to actuate each train on the C-1 I panel; the other set of controls are those manual controls provided on C-01 for each AFW pump and flow control valve.

b. Actuation Logic This LCO requires two channels of AFAS Actuation Logic to be OPERABLE.

5. Containment High Pressure Signal (CHP)

a. Manual Initiation As indicated by footnote (c), this LCO requires the manual controls necessary to actuate those valves and components actuated by an automatic CHP to be OPERABLE.

b. Actuation Logic This LCO requires two channels of CHP Actuation Logic to be OPERABLE.

6. Containment High Radiation Signal (CHR)

a. Manual Initiation This LCO requires two channels of CHR Manual Initiation to be OPERABLE. Pushbuttons are available for manual actuation of each CHR logic train.

Palisades Nuclear Plant B 3.3.4-8 Revised 09109/2003

ESF Logic and Manual Initiation B 3.3.4 BASES LCO 6. Containment High Radiation Signal (CHR) (continued)

(continued)

b. Actuation Logic This LCO requires two channels of CHR Actuation Logic to be OPERABLE.

APPLICABILITY ESF Functions are required to be OPERABLE in MODES 1,'2, and 3 or MODES 1, 2, 3, and 4 as specified in Table 3.3.4-1. In MODES 1, 2, and 3, there is sufficient energy in the primary and secondary systems to warrant automatic ESF System responses to:

Close the MSIVs to preclude a positive reactivity addition and containment overpressure;

Actuate AFW to preclude the loss of the steam generators as a heat sink (in the event the normal feedwater system is not available);

Actuate ESF systems to prevent or limit the release of fission product radioactivity to the environment by isolating containment and limiting the containment pressure from exceeding the containment design pressure during a design basis LOCA or MSLB; and

Actuate ESF systems to ensure sufficient borated inventory to permit adequate core cooling and reactivity control during a design basis LOCA or MSLB accident.

The CHP and CHR Functions are also required to be OPERABLE in MODE 4 to limit leakage of radioactive material from containment and limit operator exposure during and following a DBA.

The SGLP Function is not required to be OPERABLE in MODES 2 and 3, if all MSIVs are closed and deactivated and all MFRVs and MFRV bypass valves are either~closed and deactivated or isolated by closed manual valves, since the SGLP Function is not required to perform any safety function under these conditions.

Palisades Nuclear Plant B 3.3.4-9 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES APPLICABILITY In MODES 5 and 6, automatic actuation of ESF Functions is not (continued) required, because adequate time is-available for plant operators to evaluate plant conditions and respond by manually operating the ESF components if required. In these MODES, ESF initiated systems are either reconfigured or disabled for shutdown cooling operation.

Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components.

ACTIONS When the number of inoperable channels in a trip Function exceeds those specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered, if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function in Table 3.3.4-1 in the LCO.

Completion Times for the inoperable channel of a Function will be tracked separately.

A.1 Condition A applies to one Manual Initiation, Bypass Removal, or Actuation Logic channel inoperable. The channel must be restored to OPERABLE status to restore redundancy of the ESF Function. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time is commensurate with the importance of avoiding the vulnerability of a single failure in the only remaining OPERABLE channel.

B.1 and .2 If two Manual Initiation, Bypass Removal, or Actuation Logic channels are inoperable for Functions 1, 2, 3, or 4, or if the Required Action and associated Completion Time of Condition A cannot be met for Function 1, 2, 3, or 4, the reactor must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.3.4-1 0 Revised 09/09/2003

ESF Logic and Manual Initiation B 3.3.4 BASES ACTIONS C.1 and C.2 (continued)

Condition C is entered when one or more Functions have two Manual Initiation or Actuation Logic channels inoperable for Functions 5 or 6, or when the Required Action and associated Completion Time of Condition A are not met for Functions 5 or 6. If Required Action A.1 cannot be met within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions In an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS A functional test of each SIS actuation channel must be performed each I 92 days. This test is to be performed using the installed control room test switches and test circuits for both "with standby power' and without standby power". When testing the "with standby power" circuits, proper operation of the SIS-X" relays must be verified; when testing the "without standby power" circuits, proper operation of the UDBA sequencer" and the associated logic circuit must be verified. The test circuits are designed to block those SIS functions, such as injection of concentrated boric acid, which would interfere with plant operation.

The Frequency of 92 days is based on plant operating experience.

SR 3.3.4.2 A CHANNEL FUNCTIONAL TEST of each AFAS Actuation Logic Channel is performed every 92 days to ensure'the channel will perform its intended function when needed. A successful test of the required contact(s) of a channel relay may b6 performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This'is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Palisades Nuclear Plant B 3.3.4-1 1 Revised 09/0912003'

ESF Logic and Manual Initiation B 3.3.4 BASES (

SURVEILLANCE SR 3.3.4.2 (continued)

REQUIREMENTS (continued) Instrumentation channel tests are addressed in LCO 3.3.3.

SR 3.3.4.2 addresses Actuation Logic tests of the AFAS using the installed test circuits.

The Frequency of 92 days for SR 3.3.4.2 is in agreement with the conclusions of the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation' (Ref. 2).

SR 3.3.4.3 A CHANNEL FUNCTIONAL TEST is performed on the manual ESF initiation channels, Actuation Logic channels, and bypass removal channels for specified ESF Functions. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single.contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. (

This Surveillance verifies that the required channels will perform their intended functions when needed.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance when performed at a Frequency of once every 18 months.

REFERENCES 1. FSAR, Chapter 7

2. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant B 3.3.4-12 Revised 09/09/2003 Q.

PCS Loops - MODE 5, Loops Filled B 3.4.7 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.7 PCS Loops - MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the PCS loops filled, the primary function of the primary coolant is the removal of decay heat and transfer this heat either to the Steam Generator (SG) secondary side coolant via natural circulation (Ref.

1) or the Shutdown Cooling (SDC) heat exchangers. While the principal means for decay heat removal is via the SDC System, the SGs via natural circulation are specified as a backup means for redundancy.

Even though the SGs cannot produce steam in this MODE, they are capable of boeing a heat sink due to their large contained volume of secondary side water. If heatup'of the PCS were to continue, the contained inventory of the SGs would be available to remove decay heat by producing steam. As long as the SG secondary side water is at a lower temperature than the primary coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference.

The secondary function"of the primary coolant is to act as a carrier for soluble neutron poison, boric acid.

In MODE 5 with PCS loops filled, the SDC trains are the principal means for decay heat removal. The number of trains in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one SDC train for decay heat removal and transport.

The flow provided by one SDC train is adequate for decay heat removal.

The other intent of this LCo is to require that a second path be available to provide redundancy for decay heat removal.

The LCO provides for redundant paths of decay heat removal capability.

The first path can be an SDC train that must be OPERABLE and in operation.' The second path can be another OPERABLE SDC train, or through the SGs,'via' natural circulation each having an adequate water level. Loops filled" means'the PCS loops are not blocked by dams and I totally filled with coolant.

Palisades Nuclear Plant B 3.4.7-1 ' Revised 12102/2002

PCS Loops - MODE 5, Loops Filled B 3.4.7 BASES APPLICABLE The boron concentration must be uniform throughout the PCS SAFETY ANALYSES volume to prevent stratification of primary coolant at lower boron concentrations which could result in a reactivity insertion. Sufficient mixing of the primary coolant is assured if one SDC pump is in operation.

PCS circulation is considered in the determination of the time available for mitigation of the inadvertent boron dilution event. By imposing a minimum flow through the reactor core of 2810 gpm, sufficient time is provided for the operator to terminate a boron dilution under asymmetric flow conditions.

PCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2).

LCO The purpose of this LCO is to require one SDC train be OPERABLE and in operation with either an additional SDC train OPERABLE or the secondary side water level'of each SG Ž -84%. SDC in operation with a flow through the reactor core 2 2810 gpm, provides enough flow to remove the decay heat from the core with forced circulation and provide sufficient mixing of the soluble boric acid. The second SDC train is normally maintained OPERABLE as a backup to the operating SDC train to provide redundant paths for decay heat removal. However, if the standby SDC train is not OPERABLE, a sufficient alternate method to provide redundant paths for decay heat removal is two SGs with their secondary side water levels Ž -84%. Should the operating SDC train fail, the SGs could be used to remove the decay heat via natural circulation.

A SDC train may be considered OPERABLE (but not necessarily in operation) during re-alignment to, and when it is re-aligned for, LPSI service or for testing, if it is capable of being (locally or remotely) realigned to the SDC mode of operation and is not otherwise inoperable.

Since SDC is a manually initiated system, it need not be considered inoperable solely because some additional manual valve realignments must be made in addition to the normal initiation actions. Because of the dual functions of the components that comprise the LPSI and shutdown cooling systems, the LPSI alignment may be preferred.

Note I permits all SDC pumps to not be in operation 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The Note prohibits boron dilution when forced flow is stopped because an even concentration distribution cannot be ensured. Core outlet temperature is to be maintained at least Palisades Nuclear Plant B 3.4.7-2 Revised 12/02/2002

PCS Loops - MODE 5, Loops Filled B 3.4.7 BASES LCO 10F below saturation temperature so that no vapor bubble may form (continued) and possibly cause a natural circulation flow obstruction. The response of the PCS without the SDC pumps depends on the core decay heat load and the length of time that the pumps are stopped.

As decay heat diminishes, the effects on PCS temperature and pressure diminish. Without cooling by forced flow, higher heat loads will cause the primary coolant temperature and pressure to increase at a rate proportional to the decay heat load. Because pressure can Increase, the applicable system pressure limits (Pressure and Temperature (PIT) limits or Low Temperature Overpressure Protection (LTOP) limits) must be observed and forced SDC flow or heat removal via the SGs must be re-established prior to reaching the pressure limit.

In MODE 5 with loops filled, it is sometimes necessary to stop all SDC forced circulation. This is permitted to change operation from one SDC train to the other, perform surveillance or startup testing, perform the transition to and from the SDC, or to avoid operation below the PCP minimum net positive suction head limit. The time period is acceptable because natural circulation is acceptable for decay heat removal, the primary coolant temperature can be maintained subcooled, and boron stratification affecting reactivity control is not expected.

Note 2 allows both SDC trains to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months provided that one SDC train Is in operation providing the required flow, the core outlet temperature is at least 100F below the corresponding saturation temperature, and each SG secondary water level Is 2 84%. This permits periodic surveillance tests or maintenance to be performed on the inoperable trains during the only time when such evolutions are safe and possible.

Note 3 requires that one of the following conditions be satisfied before forced circulation (starting the first PCP) may be started:

a. SG secondary temperature is equal to or less than the reactor inlet temperature (Ta);

b. SG secondary temperature is < I 000F above Tc, and shutdown cooling is Isolated from the PCS, and PCS heatup/cooldown rate is

10°F/hour; or

c. SG secondary temperature is < 1000F above Tc, and shutdown cooling is isolated from the PCS, and pressurizer level is

57%.

Palisades Nuclear Plant B 3.4.7-3 Revised 12/02/2002'

PCS Loops - MODE 5.Loops Filled B 3.4.7 BASES LCO Satisfying any of the above conditions will preclude a large pressure (continued) surge in the PCS when the PCP is started. Energy additions from the steam generators could occur if a PCP was started when the steam generator secondary temperature is significantly above the PCS temperature. The maximum pressurizer level at which credit is taken for having a bubble (57%, which provides'about 700 cubic feet of steam space) is based on engineering judgement and verified by LTOP analysis.

This level provides the same steam volume to dampen pressure transients as would be available at full power.

Note 4 specifies a limitation on the simultaneous operation of primary coolant pumps P-50A and P-50B which allows the pressure limits in LCO 3.4.3, PCS Pressure and Temperature Limits," and LCO 3.4.12,

'Low Temperature Overpressure Protection System," to be higher than they would be without this limit.

Note 5 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting SDC trains to not be in operation when at least one PCP is in operation. This Note provides for the transition to MODE 4 where a PCP is permitted to be in operation and replaces the PCS circulation function provided by the SDC trains.

An OPERABLE SDC train is composed of an OPERABLE SDC pump and an OPERABLE SDC heat exchanger. SDC pumps are OPERABLE if they are capable of being powered and are able to provide forced flow through the reactor core.

An SG can perform as a heat sink via natural circulation when:

a. SG has the minimum water level specified in SR 3.4.7.2.

b. SG is OPERABLE in accordance with the SG Tube Surveillance Program.

c. SG has available method of feedwater addition and a controllable path for steam release.

(

d. Ability to pressurize and control pressure in the PCS.

If both SGs do not meet the above provisions, then LCO 3.4.7 item b (i.e.

the secondary side water level of each SG shall be Ž -84%) is not met.

Palisades Nuclear Plant B 3.4.7-4 Revised 12/02/2002

PCS Loops - MODE 5, Loops Filled B 3.4.7 BASES APPLICABI LITY In MODE 5 with PCS loops filled, this LCO requires forced circulation to remove decay heat from the core and to provide proper boron mixing.

One SDC train provides sufficient circulation for these purposes.

Operation in other MODES is covered by:

LCO 3.4.4, "PCS Loops-MODES 1 and 2";

LCO 3.4.5, "PCS Loops-MODE 3";

- LCO 3.4.6, "PCS Loops-MODE 4";

LCO 3.4.8, "PCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

Palisades Nuclear Plant B 3.4.7-5 Revised 12/02/2002

PCS Loops - MODE 5, Loops Filled B 3.4.7 BASES ACTIONS A.1 and A.2 If one SDC train is inoperable and any SG has a secondary side water level -84% (refer to LCO Bases section), redundancy for heat removal is lost. Action must be initiated immediately to restore a second SDC train to OPERABLE status or to restore the water level in the required SGs. Either Required Action A.1 or Required Action A.2 will restore redundant decay heat removal paths. The immediate Completion Times reflect the importance of maintaining the availability of two paths for decay heat removal.

B.1 and B.2 If no SDC trains are OPERABLE or SDC flow through the reactor core is

< 2810 gpm, except as permitted in Note 1, all operations involving the reduction of PCS boron concentration must be suspended. Action to restore one SDC train to OPERABLE status and operation shall be initiated immediately and continue until one train is restored to operation and flow through the reactor core is restored to 22810 gpm. Boron dilution requires forced circulation for proper mixing and the margin to criticality must not be reduced in this type of operation. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one SDC train is in operation. Verification of the required flow rate ensures forced flow is providing heat removal and mixing of the soluble boric acid. The 12-hour l Frequency has been shown by operating practice to be sufficient to regularly assess SDC train status. In addition, control room indication and alarms will normally indicate train status.

Palisades Nuclear Plant B 3.4.7-6 Revised 12/02/2002

PCS Loops - MODE 5, Loops Filled B 3.4.7 BASES SURVEILLANCE SR 3.4.7.2 REQUIREMENTS (continued) This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of secondary side water level in the required SGs z -84% using the wide range level instrumentation.

An adequate SG water level is required in order to have a heat sink for removal of the core decay heat from the primary coolant. The Surveillance is required to be performed when the LCO requirement is being met by use of the SGs. If both SDC trains are OPERABLE, this SR is not needed. The 12-hour Frequency has been shown by operating I practice to be sufficient to regularly assess degradation and verify SG status.

SR 3.4.7.3 Verification that the second SDC train is OPERABLE ensures that redundant paths for decay heat removal are available. The requirement also ensures that the additional train can be placed in operation, if needed, to maintain decay heat removal and primary coolant circulation.

Verification is performed by verifying proper breaker alignment and power available to the required pump that is not in operation such that the SDC pump is capable of being started and providing forced PCS flow if needed. Proper breaker alignment and power availability means the breaker for the required SDC pump is racked-in and electrical power is available to energize the SDC pump motor. The Surveillance is required to be performed when the LCO requirement is being met by one of two SDC trains, e.g., both SGs have < -84% water level. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES 1. NRC Information Notice 95-35, "Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation' Palisades Nuclear Plant B 3.4.7-7 Revised 12/02/2002

PCS Specific Activity B 3.4.16 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.16 PCS Specific Activity BASES BACKGROUND 10 CFR 100.11 specifies the maximum dose to the whole body and the thyroid an individual at the site boundary can receive for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident. The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 guideline limits during analyzed transients and accidents.

The PCS specific activity LCO limits the allowable concentration level of radionuclides in the primary coolant. The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a Steam Generator Tube Rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LCO are standardized based on parametric evaluations of offsite radioactivity dose consequences for typical site locations.

The parametric evaluations showed the potential offsite dose levels for an SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors.

APPLICABLE The LCO limits on the specific activity of the primary coolant ensure SAFETY ANALYSES that the resulting 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following an SGTR accident. The SGTR safety analysis (Ref. 1) assumes the specific activity of the primary coolant at the LCO limits and an existing primary coolant Steam Generator (SG) tube leakage rate of 0.3 gpm. The analysis also assumes a reactor trip and a turbine trip at the same time as the SGTR event.

The analysis for the SGTR accident establishes the acceptance limits for PCS specific activity. Reference to this analysis is used to assess changes to the facility that could affect PCS specific activity as they relate to the acceptance limits.

Revised 07/16/2003 Palisades Nuclear Plant Plant B 3.4.16-1 B 3.4.16-1 Revised 07/16/2003

PCS Specific Activity B 3.4.16 BASES APPLICABLE The rise in pressure in the ruptured SG causes radioactive SAFETY ANALYSES contaminated steam to discharge to the atmosphere through the (continued) atmospheric dump valves or the main steam safety valves. The atmospheric discharge stops when the affected SG is isolated below approximately 525 0F. The unaffected SG removes core decay heat by venting steam until Shutdown Cooling conditions are reached.

The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the 10 CFR 100 dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit Is permissible, if the activity levels do not exceed the limit of 40 pCi/gm for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

This is acceptable because of the low probability of an SGTR accident occurring during the established 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time limit. The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.

PCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO The specific iodine activity is limited to 1.0 LCVgm DOSE EQUIVALENT 1-131, and the gross specific activity in the primary coolant is limited to the number of pICi/gm equal to 100 divided by E (average disintegration energy). The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. The limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

The SGTR accident analysis (Ref. 1) shows that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months site boundary dose levels are within acceptable limits., Violation of the LCO may result in primary coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.

Revised 07/16/2003 Nuclear Plant Palisades Nuclear Plant B 3.4.16-2 B 3.4.16-2 Revised 07/16/2003

PCS Specific Activity B 3.4.16 BASES APPLICABILITY In MODES 1 and 2, and in MODE 3 with PCS average temperature 2 5000F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity is necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.

For operation in MODE 3 with PCS average temperature < 5000F, and in MODES 4 and 5, the release of radioactivity in the event of an SGTR is unlikely since the saturation pressure corresponding to the primary coolant temperature is below the lift settings of the atmospheric dump valves and main steam safety valves.

ACTIONS A.1 and A.2 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at Intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate the limit 40 pCigm Is not exceeded. The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Is required to obtain and analyze a sample.

As stated In SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time Is stated as once per. .

." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per.. ." basis. The 25% extension applies to each performance of the Required Action after the Initial performance. Therefore, while Required Action 3.4.16 A.1 must be Initially performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

Sampling must continue for trending. The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Is required If the limit violation resulted from normal iodine spiking.

A Note to the Required Actions of Condition A excludes the MODE change restriction of LCO 3.0.4. This exception allows entry into the applicable MODE(S) while relying on the ACTIONS even though the ACTIONS may eventually require plant shutdown. This exception is acceptable due to the significant conservatism incorporated Into the specific activity limit, the low probability of an event which is limiting due to exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.

B 3.4.16-3 Revised 07/16/2003 Nuclear Plant Palisades Nuclear Plant -B 3.4.16-3 Revised 07112003

PCS Specific Activity B 3.4.16 BASES ACTIONS B.1 (continued)

If a Required Action and associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is 40 pCi/gm or above, or with the gross specific activity in excess of the allowed limit, the plant must be placed in a MODE in which the requirement does not apply.

The change within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to MODE 3 with PCS average temperature

< 5000 F lowers the saturation pressure of the primary coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is required to reach MODE 3 below 5001F from full power conditions and without challenging plant systems.

SURVEILLANCE SR 3.4.16.1 REQUIREMENTS The Surveillance requires performing a gamma isotopic analysis as a measure of the gross specific activity of the primary coolant at least once per 7 days. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes, excluding iodines, this measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES I and 2, and in MODE 3 with PCS average temperature at least 500 0F. The 7 day Frequency considers the unlikelihood of a gross fuel failure during the time.

Palisade Nucea Pln 4 Reisd--6/00 Palisades Nuclear Plant B 3.4.16-4 Revised 07/16/2003

PCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.2 REQUIREMENTS (continued) This Surveillance is performed to ensure iodine remains within limits during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level considering gross activity is monitored every 7 days. The Frequency, between 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after any i power change of 2 15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results. If any (may be more than one) power change 15% RTP occurs within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, then more than one sample may be required to ensure that an iodine peak sample is obtained between the 2 and 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Frequency requirement. This SR is modified by a Note which states that the SR is only required to be performed in MODE 1. Entrance into a lower MODE does not preclude completion of this surveillance.

SR 3.4.16.3 A radiochemical analysis for E determination is required every 184 days (6 months) with the plant operating in MODE 1 equilibrium conditions.

The E determination directly relates to the LCO and is required to verify plant operation within the specified gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 15 minutes, excluding iodines. The Frequency of 184 days recognizes Edoes not change rapidly.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. FSAR, Section 14.15 Palisades Nuclear Plant B 3.4.16-5 Revised 07/16/2003

Containment B 3.6.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment BASES BACKGROUND The containment consists of a concrete structure lined with steel plate, and the penetrations through this structure. The structure is designed' to contain fission products that may be released from the reactor core following a design basis Loss of Coolant Accident (LOCA). Additionally, this structure provides shielding from the fission products that may be present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, a flat foundation mat, and a shallow dome roof. The foundation slab is reinforced with conventional mild-steel reinforcing. The internal pressure loads on the base slab are resisted by both the external soil pressure and the strength of the reinforced concrete slab. The cylinder wall is prestressed with a post tensioning system in the vertical and horizontal directions. The dome roof is prestressed utilizing a three-way post tensioning system. The inside surface of the containment is lined with a carbon steel liner to ensure a high degree of leak tightness during operating and accident conditions.

The concrete structure is required for structural integrity of the containment under Design Basis Accident (DBA) conditions. The steel liner and its penetrations establish the leakage limiting boundary of the -

containment. Maintaining the containment OPERABLE limits the leakage of fission product radioactivity from the containment to the environment. SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B (Ref. 4) as modified by approved exemptions.

The isolation devices for containment penetrations are a part of the containment leak tight boundary. To maintain this leak tight boundary:

a. All penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic containment isolation system, or

2. closed by manual valves, blind flanges, or de-activated automatic valves secured in their closed positions, except as provided in LCO 3.6.3, "Containment Isolation Valves";

Palisades Nuclear Plant B 3.6.1 . Revised 12/10/2002

Containment B 3.6.1 BASES BACKGROUND b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, (continued) "Containment Air Locks";

c. The equipment hatch is properly closed and sealed.

APPLICABLE The safety design basis for the containment is that the containment SAFETY ANALYSES must withstand the pressures and temperatures of the limiting DBA without exceeding the design leakage rate.

A Loss of Coolant Accident (LOCA) and a control rod ejection accident are the two DBAs that are analyzed for release of fission products within containment (Ref. 1). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0. 10% of containment air weight per day at a design pressure of 55 psig and a design temperature of 2830 F (Ref. 3). I Satisfactory leakage rate test results are a requirement for the establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2).

(C.1i LCO Containment OPERABILITY is maintained by limiting leakage to

1.0 L., except prior to the first startup after performing a required Containment Leak Rate Testing Program leakage test. At this time, the applicable leakage limits must be met.

Technical Specification ADMIN 5.5.14 defines La as the maximum allowable leakage rate at pressure Pa. The Pa value of 53 psig represents the analytical value for a large break LOCA found in Reference 1, rounded up to the next whole number.

Compliance with this LCO will ensure a containment configuration, including the equipment hatch, that is structurally sound and that will limit leakage to those leakage rates assumed in the safety analysis.

Palisades Nuclear Plant B 3.6.1-2 Revised 1210/2002

Containment B 3.6.1 BASES LCO Individual leakage rates that may be specified for the containment air .1 (continued) lock (LCO 3.6.2) and purge valves which have resilient seals -

(LCO 3.6.3) are not specifically part of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage rates exceeding these individual limits only result in the containment being inoperable when the leakage results in exceeding the overall acceptance criteria of 1.0 L,.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission products into containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, containment is not required to be OPERABLE in MODE 5 to prevent leakage of fission products from containment. The requirements for containment during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

ACTIONS A.1 In the event containment is inoperable, containment must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining containment OPERABILITY during MODES 1, 2, 3, and 4. This time period also ensures that the probability of an accident (requiring containment OPERABILITY) occurring, during periods when containment is inoperable, is minimal.

B.1 and B.2 If containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.6.1-3 - Revised 12/10/2002

Containment B 3.6.1 BASES SURVEILLANCE SR 3.6.1.1 REQUIREMENTS Maintaining the containment OPERABLE requires compliance with the visual examinations and leakage rate test requirements of the Containment Leak Rate Testing Program. Failure to meet individual air lock and containment isolation valve "local leak rate" leakage limits does not invalidate the acceptability of the overall leakage determination unless their contribution to overall Type A, B, or C leakage causes that leakage to exceed limits. As left leakage prior to the first startup after performing a required Containment Leak Rate Testing Program leakage test is required to be < 0.6 La for combined B and C leakage, and

0.75 La for overall Type A leakage. At all other times between required leakage rate tests, the acceptance criteria is based on an overall Type A leakage limit of 1.0 L. At

1.0 La the offsite dose consequences are bounded by the assumptions of the safety analysis.

SR Frequencies are as required by the Containment Leak Rate Testing Program. These periodic testing requirements verify that the containment leakage rate does not exceed the leakage rate assumed in the safety analysis.

SR 3.6.1.2 This SR ensures that the structural integrity of the containment will be maintained in accordance with the provisions of the Containment Structural Integrity Surveillance Program.

REFERENCES 1. FSAR, Chapter 14

2. FSAR, Section 14.18

3. FSAR, Section 5.8

4. 10 CFR 50, Appendix J, Option B Palisades Nuclear Plant B 3.6.1-4 Revised 12/10/2002

Containment Air Locks B 3.6.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.2 Containment Air Locks BASES BACKGROUND Containment air locks form part of the containment pressure boundary and provide a means for personnel access during all MODES of

'operation.

Two air locks provide access into the containment. Each air lock is nominally a right circular cylinder, with a door at each end. The personnel air lock doors are 3 foot, 6 inches by 6 foot, 8 inches. The emergency escape air lock doors are 30 inches in diameter. The doors are interlocked to prevent simultaneous opening.- During periods when containment is not required to be OPERABLE, the door interlock mechanism may be disabled, allowing both doors of an air lock to remain open for extended periods when frequent containment entry is necessary.

Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA) in containment. As such, closure of a single door supports containment OPERABILITY. Each of the doors contains double gasketed seals and local testing capability to ensure pressure integrity. To effect a leak tight seal, the air lock design uses pressure seated doors (i.e., an increase in containment internal pressure results in increased sealing force on each door).

Air lock integrity and leak tightness are essential for maintaining the containment leakage rate within limit in the event of a DBA. Not

-maintaining air lock integrity or leak tightness may result in a leakage rate in excess of that assumed in the plant safety analysis.

Palisades Nuclear Plant B 3.6.2-1 Revised 08/12/2003

Containment Air Locks B 3.6.2 BASES APPLICABLE A Loss of Coolant Accident (LOCA) and a control rod ejection accident SAFETY ANALYSES are the two DBAs that are analyzed for release of fission products within containment (Ref. 1). In the analysis of each of these accidents, it is assumed that containment is OPERABLE such that release of fission products to the environment is controlled by the rate of containment leakage. The containment was designed with an allowable leakage rate of 0.10% of containment air weight per day at a design pressure of 55 psig and a design temperature of 2830 F (Ref. 2). This allowable leakage rate forms the basis for the acceptance criteria imposed on the SRs associated with the air lock.

The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to limiting the containment leakage rate to

1.0 La. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Technical Specification ADMIN 5.5.14 defines La as the maximum allowable leakage rate at pressure Pa. The P. value of 53 psig represents the analytical value for a large break LOCA found in Reference 1, rounded up to the next whole number.

Each air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type B air lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of containment does not exist when containment is required to be OPERABLE. Closure of a single OPERABLE door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into or exit from containment. Air lock test connection isolation valves are considered to be part of the associated air lock outer door. I C

Palisades Nuclear Plant B 3.6.2-2 Revised 08/12/2003

Containment Air Locks B 3.6.2 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission products to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.' Therefore, the containment air locks are not required in MODE 5 to prevent leakage of fission products from containment. The requirements for the containment air locks during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

ACTIONS The ACTIONS are modified by three notes. The first note allows entry and exit to pbrform repairs on the affected air lock component. If the outer door is inoperable,'then it may be'easily accessed for most repairs.

It is preferred that the air lock be accessed from inside containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door then It is permissible to enter the air lock through the OPERABLE door, even if this door has been locked to comply with ACTIONS. This means there is a short time during which the containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the containment boundary Is temporarily not intact, is acceptable because of the low probability of an event that could pressurize the containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed. If ALARA conditions permit, entry and exit should be via an OPERABLE air lock.

A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each air lock. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable air lock. Complying with the Required Actions may'allow for continued operation, and a subsequent inoperable air lock is govemed by subsequent Condition entry and application of associated Required Actions. A third Note has been included that requires entry into the applicable'Conditions and Required Actions of LCO 3.6.1, "Contain ment," when leakage results in exceeding the overall containment leakage-limit. -

Palisades Nuclear Plant B 3.6.2-3 . Revised 08/12/2003

Containment Air Locks B 3.6.2 BASES ACTIONS A.1, A.2, and A.3 (continued)

With one air lock door inoperable in one or more containment air locks, the OPERABLE door must be verified closed (Required Action A.1) in each affected containment air lock. This ensures that a leak tight containment barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the affected air lock penetration must be isolated by locking closed an OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is considered reasonable for locking the OPERABLE air lock door, considering the OPERABLE door of the affected air lock is being maintained closed.

Required Action A.3 verifies that an air lock with an inoperable door has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable containment leakage barrier is maintained. Required Action A.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since (

access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls. As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whoseCompletion Time is stated as once per. . ." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.6.2 A.3 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

Palisades Nuclear Plant B 3.6.2-4 Revised 08/1 2/2003

Containment Air Locks B 3.6.2 BASES ACTIONS A.1, A.2, and A.3 (continued)

The Required Actions have been modified by two Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.

With both doors in the same air lock inoperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. The exception provided by Note 1 does not affect tracking the Completion Time from the initial entry into Condition A; only the requirement to comply with the Required Actions.

Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls if both air locks have an inoperable door. This 7 day restriction begins when the second air lock is discovered inoperable. Containm6nt entry may be required to-perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside containment that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the containment was entered, using the inoperable air lock, to perform an allowed activity listed above. This allowance is acceptable due to the low probability of an event that could pressurize the containment during the short time that the OPERABLE door is expected to be open.

B.1. B.2, and B.3 With an air lock interlock mechanism inoperable in one or more air locks, the Required Acti6ns and associated Completion Times are consistent with those specified in Condition A.

The Required Actions have been modified by to'Notes. Note 1 ensures that only the Required Actions and associated Completion Times of Condition C are required if both doors in the same air lock are inoperable.

With both doors in the samn air lock noperable, an OPERABLE door is not available to be closed. Required Actions C.1 and C.2 are the appropriate remedial actions. Note 2 allows entry into and exit from containment under the control of a 'dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the nterlock).

Palisades Nuclear Plant B 36.2-5 Revised 08112/2003

Containment Air Locks B 3.6.2 BASES ACTIONS B.1, B.2, and B.3 (continued)

Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas and allows these doors to be verified locked closed by use of administrative means. Allowing verification by administrative means is'considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

C.1, C.2. and C.3 With one or more air locks inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be initiated immediately to evaluate previous combined leakage rates using current air lock test results. If the overall containment leakage rate exceeds the limits of LCO 3.6.1, the conditions of that LCO must be entered in accordance with' Actions Note 3. An evaluation is acceptable since it is overly conservative to immediately declare the containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (per LCO 3.6.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.

Palisades Nuclear Plant B 3.6.2-6 Revised 08112/2003

9 Containment Air Locks B 3.6.2 BASES ACTIONS D.1 and D.2 (continue If the inoperable containment air lock cannot be restored to OPERABLE

--status within the required Completion Time, the plant must be brought to a MODE inwhich the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leak Rate Testing Program.

This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria, were established during initial air lock and containment Operability testing.

Subsequent amendments to the Technical Specifications revised the acceptance criteria for overall Type B and C leakage limits and provided new acceptance criteria for the personnel air lock doors and the emergency air lock doors (Ref. 2). The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leak Rate Testing Program.

The SR has been modified by two Notes. Note I states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria of SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type B and C containment leakage rate.

Palisades Nuclear Plant B 3.6.2-7 Revised 08/12/2003

Containment Air Locks B 3.6.2 BASES SURVEILLANCE SR 3.6.2.2 REQUIREMENTS (continued) The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure, closure of either door will support containment OPERABILITY. Thus, the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit into and out of containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. Due to the purely mechanical nature of this interlock, and given that the interlock mechanism is not normally challenged when the airlock is used for entry and exit (procedures require strict adherence to single door opening), this test is only required to be performed every 24 months.

The 24 month Frequency for the interlock is justified based on generic operating experience. The Frequency is based on engineering judgment and is considered adequate given that the interlock is not normally challenged during use of the airlock.

REFERENCES 1. FSAR, Chapter 14 C.

2. FSAR, Section 5.8

3. 10 CFR 50, Appendix J, Option B

(.

Palisades Nuclear Plant B 3.6.2-8 Revised 08/12/2003

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES - -

BACKGROUND The containment isolation valves-and devices form part of the containment pressure boundary and provide a means for isolating penetration flow paths. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured) and blind flanges are considered passive devices. Check I valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that'exceeds limits assumed in the safety analysis.

One of these barriers may be a closed system.

The Containment Isolation System is designed to provide isolation capability following a Design Basis Accident (DBA) for fluid lines that penetrate containment. Major nonessential lines (i.e., fluid systems that do not perform an immediate accident mitigation function) that penetrate containment, except for the main steam lines and instrument air line, are either automatically isolated following an accident or are normally maintained closed in MODES 1, 2, 3, and 4. Containment isolation occurs upon receipt of a Containment High Pressure (CHP) signal or a Containment High' Radiation (CHR) signal. However, not all containment isolation valves are actuated by both signals. The signals close automatic containment isolation valves in fluid penetrations that are required to be isolated during accident conditions in order to minimize release of fission products from the Primary Coolant System (PCS) to the environment. Other penetrations that are required to be isolated during accident conditions are isolated by the use of valves or check valves in the closed position, or blind flanges. As a result, the containm6nt'-

isolation devices help ensure that the containment atmosphere will be isolated in the event of a release of fission products to the containment atmosphere from the PCS following a DBA.

Palisades Nuclear Plant B 3.6.3-1 .Revised 121 02002

Containment Isolation Valves B 3.6.3 BASES BACKGROUND The plant safety analyses (Ref. 5) assume containment isolation for the (continued) mitigation of a Loss of Coolant Accident (LOCA) and a control rod ejection accident. The Main Steam Line Break (MSLB) and Steam Generator Tube Rupture (SGTR) accident analyses assume that the mass of steam from the Steam Generator is released directly to the environment, and no credit is taken for containment isolation to mitigate the radiological consequences of those accidents. Therefore, valves in fluid lines connected directly to the secondary side of the steam generators are not included in this Technical Specification.

The OPERABILITY requirements for containment isolation valves and devices help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY I requirements provide assurance that the containment leakage limits assumed in the accident analyses will not be exceeded in a DBA. I The 8 inch purge exhaust valves are designed for purging the containment atmosphere to the stack while introducing filtered makeup, through the 12 inch air room supply valves from the outside, when the plant is shut down during refueling operations and maintenance. The purge exhaust valves and air room supply valves are air operated isolation valves located outside the containment. These valves are operated manually from the control room. These valves will close automatically upon receipt of a CHP or CHR signal. The air operated valves fail closed upon a loss of air. These valves are not qualified for automatic closure from their open position under DBA conditions.

Therefore, these valves are locked closed in MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained.

Open purge exhaust or air room supply valves, following an accident that releases contamination to the containment atmosphere, would cause a significant increase in the containment leakage rate.

APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY ANALYSES related to minimizing the release of fission products from the primary coolant system to the environment, and establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve (device) OPERABILITY supports leak I tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO.

(

Palisades Nuclear Plant B 3.6.3-2 Revised 1211012002

Containment Isolation Valves B 3.6.3 BASES APPLICABLE A'Loss of Coolant Accident (LOCA) and a control rod ejection accident SAFETY ANALYSES are the two DBAs that require isolation of containment to minimize (continued) release of fission products to the environment (Ref. 5). In the analysis for each of these accidents, it is assumed that containment isolation devices that are required to be closed during accident conditions are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation devices (including containment purge valves) are I minimized. The safety analysis assumes that the purge exhaust and air room supply valves are closed at event initiation.

The DBA analysis assumes that, within 25 seconds after receiving a CHP or CHR signal each automatic power operated valve is closed and containment leakage terminated except for the design leakage rate. I The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the design of the containment purge valves. Two valves in series on each line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. Both isolation valves on the 8 inch and 12 inch lines are pneumatically operated spring-closed valves.

The 8 inch purge exhaust and 12 inch air room supply valves may be unable to close in the environment following a LOCA. Therefore, each of the purge valves is required to remain locked closed during MODES 1, 2, 3, and 4. In this case, the single failure criterion remains applicable to the containment purge valves due to the potential for failure in the control circuit associated with each valve. Again, the purge system valve design precludes a single failure from compromising the containment boundary as long as the system is operated in accordance with the subject LCO.

The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Containment isolation valves form a part of the containment boundary.

Compliance with this LCO will ensure a containment configuration that will limit leakage to those leakage rates assumed in the safety analyses.

Containment penetrations for fluid systems that perform an accident mitigation function are not required to be isolated.

Palisades Nuclear Plant B 3.6.3-3 Revised 12/10/2002

Containment Isolation Valves B 3.6.3 BASES LCO Containment isolation valves (devices) consist of isolation valves (manual (continued) valves, check valves, air operated valves, and motor operated valves),

and blind flanges. There are two major categories of containment isolation devices that are used depending on the type of penetration and the function of the associated piping system:

a.' Active - automatic containment isolation devices that, following an accident, either receive a containment isolation signal to close, or close as a result of differential pressure;

b. Passive - normally closed containment isolation devices that are maintained closed in MODES 1, 2, 3, and 4 since they do not receive a containment isolation signal to close and the penetration is not used for normal power operation.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate upon receipt of a CHP or CHR signal as appropriate. Check valves are verified to be OPERABLE through the valve Inservice Testing Pfogram. The purge exhaust and air room supply valves must be locked closed.

The normally closed isolation devices are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in thefr'closed position, check valves are closed with flow secured through the pipe, or blind flanges are in place.

The devices covered by this LCO are listed in the FSAR (Ref. 2).

The purge exhaust and air room supply valves with resilient seals must meet the same leakage rate testing requirements as other Type C tested containment isolation valves addressed by LCO 3.6.1, "Containment."

This LCO provides assurance that the containment isolation devices will perform'their designed safety functions to minimize the release of fission products from the primary coolant system to the environment and establish the containment boundary during accidents.

Palisades Nuclear Plant B 3.6.3-4 Revised 1210/2002

Containment Isolation Valves B 3.6.3 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission products to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations

- of these MODES. Therefore, the containment isolation valves are not

- required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

ACTIONS The ACTIONS are modified by four notes. Note I 'allows isolated penetration flow paths; except for 8 inch exhaust and 12 inch air room supply purge valve penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a'dedicated operator at the device controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the fact that the 8 inch purge exhaust valves and the 12 inch air room supply valves may be unable to close in the environment following a LOCA and the fact that those penetrations exhaust directly from the containment atmosphere'to the environment, these valves may not be opened under administrative controls.

Note 2 provides clarification that, for this LCO,'separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation device. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation devices are governed by subsequent Condition entry and application of associated Required Actions.

Note 3 ensures that appropriate remedial actions are taken, if necessary, I if the affected systems are rendered inoperable by an inoperable containment isolation device. I

-Note 4 requires entry into the apPlicable Conditions and Required Actions of LCO 3.6.1 when leakage results In exceeding the overall containment leakage limit. - ; '.

A.1 and A.2

-Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment

-isolation valve and a'closed system, Condition C provides appropriate

-;actions. (: 'x :

Palisades Nuclear Plant B 3.6.3-5 IRevised 12/10/2002

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

In the event one containment isolation valve in one or more penetration flow paths is inoperable (except for purge exhaust or air room supply valves), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation.

Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low.

For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

Palisades Nuclear Plant B 3.6.3-6 Revised 12/10/2002

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

The Completion Time of once per 31 days for verifying each affected penetration flow path outside the containment is isolated is appropriate considering that the penetration can be isolated by the remaining isolable device. As stated in SR 3.02, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. . .",basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, for devices outside the containment, while Required Action 3.6.3 A.2 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

B.1 With two containment isolation valves in one or more penetration flow paths inoperable (except for purge exhaust valve or air room supply valve not locked closed), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.

In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated.

The Completion Time of once per 31 days for verifying each affected penetration flow path, is isolated is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves.

Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

Palisades Nuclear Plant B 3.6.3-7 Revised.12/10/2002

Containment Isolation Valves B 3.6.3 BASES Q ACTIONS C.1 and C.2 (continued)

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 2. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. The specified time period is reasonable,' considering the relative' stability of the closed system (hence, reliability) to act as a penetration isolation barrier and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to C-assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position.

The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate considering the devices are operated under administrative controls and the probability of their misalignment is low. As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as "once per. . ." however, the 25% extension does not apply to the initial performance on a "once per .. " basis. The 25% extension applies to each performance of the Required Action after the initial performance.

Therefore, while Required Action 3.6.3 C.2 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25%'SR 3.0.2 extension.

Palisades Nuclear Plant B 3.6.3-8 Revised 12/10/2002

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

Required Action C.2 is modified by a Note that applies to isolation devices I located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, I is small.

D.1 -

The purge exhaust and air room supply isolation valves have not been qualified to close following a LOCA and are required to be locked closed.

If one or more of these valves is found not locked closed, the potential exists for the valves to be inadvertently opened. One hour is provided to lock closed the affected valves. The 1-hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining these valves closed.

E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.1 REQUIREMENTS -.

This SR ensures that the 8-inch purge exhaust and 12 inch air room supply valves are locked closed as required. If a valve is open, or closed but not locked, in violation of this SR, the valve is considered inoperable.

Valves may be locked closed electrically,'mechanically, or by other physical means. These valves may be unable to close in the environment following a LOCA. Therefore, each of the valves is required to remain closed during MODES 1, 2, 3, and 4. The 31-day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.2.

Palisades Nuclear Plant B 3.6.3-9 Revised 12/10/2002

Containment Isolation Valves B 3.6.3 Cn, BASES SURVEILLANCE SR 3.6.3.2 REQUIREMENTS (continued) This SR'requires verification that each manual containment isolation valve and blind flange located outside containment, and not locked, sealed, or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. This SR does not require any testing or device I manipulation. Rather, it involves verification, through a system walkdown, that those containment isolation devices outside containment and capable I of being mispositioned are in the correct position. Since verification of device position for containment isolation devices outside containment is I relatively easy, the 31-day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions.

Containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to devices that are.locked, sealed, or otherwise I secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation devices, once I they have been verified to be in the proper position, is small.

SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. For containment isolation devices inside containment, the I Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these containment isolation devices are operated under administrative'controls and the I probability of their misalignment is low. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time that they are open. This SR does not apply to devices I that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Palisades Nuclear Plant B 3.6.3-1 0 Revised 12/1012002

Containment Isolation Valves B 3.6.3 BASES SURVEILLAN, CE SR 3.6.3.3 (continued)

REQUIREME1 KI-,E*

The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2; and 3 for ALARA reasons. Therefore, the probability of misalignment of these containment

- isolation devices, once they have been verified to be in their proper I position, is small.

SR 3.6.3.4 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.5 For containment 8 inch purge exhaust and 12 inch air room supply valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B (Ref. 3), is required to ensure the valves are physically closed (SR 3.6.3.1 verifies the valves are locked closed). Operating experience has demonstrated that this type of.

seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of 184 days was established as part of the NRC resolution of Generic Issue B-20, "Containment Leakage Due to Seal Deterioration" (Ref. 4) as specified in the Safety Evaluation for Amendment No. 90 to the Facility Operating License.

Palisades Nuclear Plant B 3.6.3-1 1 ; Revised 12/10/2002

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.6 REQUIREMENTS (continued) Automatic containment isolation valves close on a containment isolation signal to minimize leakage of fission products from containment following I a DBA. This SR ensures each automatic containment isolation valve will actuate to its isolation position on an actual or simulated actuation signal, i.e., CHP or CHR. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency was developed considering it is prudent that this SR be performed only during a plant outage, since isolation of penetrations would eliminate cooling water flow and disrupt normal operation of many critical components. Operating experience has shown that these components usually pass this SR when performed on the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 5.8

2. FSAR, Section 6.7.2 and Table 6-14 I

3. 10 CFR 50, Appendix J, Option B

4. Generic Issue B-20

5. FSAR, Chapter 14 I (s

Palisades Nuclear Plant B 3.6.3-12 Revised 12/10/2002

Containment Air Temperature B 3.6.5 B 3.6 CONTAINMENT SYSTEMS B 3.6.5 Containment Air Temperature BASES BACKGROUND The containment structure serves to contain radioactive material that may be released from the reactor core following a Design Basis Accident (DBA). The containment average air temperature is limited during normal operation to preserve the initial conditions assumed in the accident analyses for a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB).

Containment air temperature is a process variable that is monitored and controlled. The containment average air temperature limit is derived from the input conditions used in the containment accident analyses. This LCO ensures that initial conditions assumed in the analysis of containment response to a DBA are not violated during plant operations.

The total amount of energy to be removed from containment by the Containment Spray and Cooling systems during post accident conditions l

is dependent on the energy released to the containment due to the event, as well as the iitial containment temperature and pressure. The higher the initial temperature, the more energy that must be removed, resulting in a higher peak containment pressure and temperature. Exceeding containment design pressure may result in leakage greater than that assumed in the accident analysis (Ref.' 1). Operation with containment average air temperature in excess of the LCO limit violates an initial condition assumed in the accident analysis.

APPLICABLE Containment average air temperature Is an initial condition used in the SAFETY ANALYSES DBA analyses that establishes the containment environmental qualification operating envelope for both pressure and temperature. The limit for containment average air temperature ensures that operation is maintained within the assumptions used in'the DBA analysis for containment. The accident analyses and evaluations considered both LOCAs and MSLBs for determining the maximum peak containment pressures and temperatures. The worst case MSLB generates larger mass and energy releases than the worst case LOCA. Thus, the MSLB event bounds the LOCA event from the containment peak pressure and temperature standpoint.

The initial pre-accident temperature inside containment was assumed to be 1400 F (Ref. 2).

Palisades Nuclear Plant B 3.6.5-1 Revised 09/0912003

Containment Air Temperature B 3.6.5 BASES APPLICABLE The initial containment average air temperature condition of 1401F SAFETY ANALYSES resulted in a maximum vapor temperature in containment of 401"F.

(continued) This value represents the analytical value presented in Reference 3, rounded up to the next highest number. This exceeds the containment building design temperature of 283 0F. The effect on the containment structure is negligible due to the short period of time the temperature exceeds the design value.

Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO During a DBA, with an initial containment average air temperature less than or equal to the LCO temperature limit, the resultant peak accident pressure is maintained below the containment design pressure. As a result, the ability of containment to perform its function is ensured.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive material to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.

(..

ACTIONS A.1 When containment average air temperature is not within the limit of the LCO, it must be restored to within limit within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This Required Action is necessary to return operation to within the bounds of the containment analysis. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficient time to correct minor problems.

Palisades Nuclear Plant B 3.6.5-2 Revised 09/09/2003

Containment Air Temperature B 3.6.5 BASES ACTIONS B.1 and B.2 (continued)

Ifthe containment average air temperature cannot be restored to within its limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.1 REQUIREMENTS Verifying that containment average air temperature is within the LCO limit ensures that containment operation remains within the limit assumed for the containment analyses. The 1400F limit is the actual limit assumed for the accident analyses and does not account for instrument naccuracies.

Instrument uncertainties are accounted for in the surveillance procedure.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this SR is considered acceptable based on the observed slow rates of temperature increase within containment as a result of environmental heat sources (due to the large volume of containment).

REFERENCES 1. FSAR, Section 5.8

2. FSAR, Section 14.18

3. FSAR, Table 14.18.2-3 Palisades Nuclear Plant B 3.6.5-3 Revised 09/09/2003

Containment Cooling Systems B 3.6.6, B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Containment Cooling Systems BASES BACKGROUND The Containment Spray and Containment Air Cooler systems provide containment atmosphere'cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure reduces the release of fission product radioactivity from containment'to the environment, in the evet f a Main Steam Line Break (MSLB) or a large break Loss of Coolant Accident (LOCA). The Containment Spray and Containment Air Cooler systems are designed to the requirements of the Palisades Nuclear Plant design criteria (Ref. 1).

The Containment Air Cooler System and Containment Spray System are Engineered Safety Feature (ESF) systems. They'are designed to ensure that the heat removal capability required during the post accident period can be attained. The systems are arranged with two'spray pumps and one air cooler fan powered from one diesel generator, and with one spray pump and three air cooler fans powered from the other diesel generator.

The Containment Spray System was originally designed to be redundant

'to the C6ntainment Air Coolers (CACs) and fans. These systems were

'originally designed such that either two containment spray pumps or three CACs could limit containment pressure to less than design. However, the current safety analyses take credit for one containment spray pump when evaluating cases with three CACs, and for one air cooler fan in cases with two spray pumps and both Main Steam Isolation Valve (MSIV) bypass valves closed. If an MSIV bypass valve is open, 2 service water pumps and 2 CACs are also required to be OPERABLE in addition to the 2 spray

'pumps for containment heat removal' To address this dependency between the Containment Spray System and

'the Containment Air Cooler System'the title'of this Specification is "Containment Cooling Systems," and includes' both systems. The LCO is written in terms of trains of containment cooling. One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header, and Air Cooler Fan V-4A. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray Pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A,'and V-3A.

Palisades Nuclear Plant B 3.6.6-1 Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES BACKGROUND If reliance'is placed solely on one spray pump and three CACs, at least (continued) two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs. Additional details of the required equipment and its operation is discussed with the containment cooling system with which it is associated.

Containment Spray System The Containment Spray System consists of three half-capacity (50%)

motor driven pumps, two shutdown cooling heat exchangers, two spray headers, two full sets of full capacity (100%) nozzles, valves, and piping, two full capacity (100%). pump suction lines from the Safety Injection and Refueling Water Tank (SIRWT) and the containment sump with the associated piping, valves, power sources, instruments, and controls. The heat exchangers are shared with the Shutdown Cooling System. SIRWT supplies borateoJ water to the containment spray during the injection phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the SIRWT to the containment sump.

Normally, both Shutdown Cooling Heat Exchangers must be available to provide cooling of the containment spray flow in the event of a Loss of Coolant Accident. If the Containment Spray side (tube side) of one SDC Heat Exchanger is out of service, 100% of the required post accident cooling capability can be provided, if other equipment outages are limited (refer to Bases for Required Action C.1).

The Containment Spray System provides a spray of cold borated water into the upper regions of containment to reduce the containment pressure and temperature during a MSLB or large break LOCA event. In addition, the Containment Spray System in conjunction with the use of trisodium phosphate (LCO 3.5.5, Trisodium Phosphate,") serve to remove iodine which may be released following an accident. The SIRWT solution temperature is an important factor in determining the heat removal capability of the Containment Spray System during the injection phase.

Palisades Nuclear Plant B 3.6.6-2 Revised 04104/2003

Containment Cooling Systems B 3.6.6 BASES BACKGROUND Containnent Spray System (continued)

In the recirculation mode of operation, heat is removed from the containment sump water by the shutdown cooling heat exchangers.

The Containment Spray System is actuated either automatically.by a Containment High Pressure (CHP) signal or manually. An automatic actuation opens the containment spray header isolation valves, starts the three containment spray pumps; and begins the injection phase.

Individual component controls may be used to manually initiate Containment Spray. The injection phase continues until an SIRWT Level Low signal is received. .The Low Level signal for the SIRWT generates a' Recirculation Actuation Signal (RAS) that aligns valves from the containment spray pump suction to the containment sump. RAS opens the HPSI subcooling valve CV-3071, if the associated HPSI pump is operating. After the containment sump valve CV-3030 opens from RAS, HPSI subcooling valve CV-3070 will open, if the associated HPSI pump is operating. RAS will close containment spray valve CV-3001, if containment sump valve CV-3030 does not open. The Containment Spray System in recirculation mode maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water.

Operation of the Containment Spray System in the recirculation mode is controlled by the operator in accordance with the emergency operating procedures.

The containment spray pumps also provide a required support function for the High Pressure Safety Injection pumps as described in the Bases for specification 3.5.2.. The High Pressure Safety Injection pumps alone may not have adequate NPSH after a postulated accident and the realignment of their suctions from the SIRWT to the containment sump.

Flow is automatically provided from the discharge of the containment spray pumps to the suction of the High Pressure Safety Injection (HPSI) pumps after the change to recirculation mode has'occurred, if the HPSI pump is operating. The additional suction pressure ensures that' adequate NPSH is available for the High Pressure Safety Injection pumps.

a~~

Palisades Nuclear Plant B 3.6.6-3 Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES r BACKGROUND Containment Air Cooler System (continued)

The Containment Air Cooler System includes four air handling and cooling units, referred to as the Containment Air Coolers (CACs), which are located entirely within the containment building. Three of the CACs (VHX-1, VHX-2, and VHX-3) are safety related coolers and are cooled by the critical service water. The fourth CAC (VHX-4) is not taken credit for in maintaining containment temperature within limit (the service water inlet valve for VHX-4 is closed by an SIS signal to conserve service water flow), but is used during normal operation along with the three CACs to maintain containment temperature below the design limits. The fan associated with VHX-4, V-4A, is assumed in the safety analysis as assisting in the containment atmosphere mixing function.

The DG which powers the fans associated with VHX-1, VHX-2, and VHX-3 (V-1A, V-2A and V-3A) also powers two service water pumps.

This is necessary because if reliance is placed solely on the train with one spray pump and three CACs, af least two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs.

Each CAC has two vaneaxial fans with direct connected motors which draw air through the cooling coils. Both of-these fans are normally in operation, but only one fan and motor for each CAC is rated for post accident conditions. The post accident rated safety related' fan units, Q

V-1A, V-2A, V-3A, and V-4A, serve not only to provide forced flow for the associated cooler, but also provide mixing of the containment atmosphere. A single operating safety related fan unit will provide enough air flow to assure that there is adequate mixing of unsprayed containment areas to assure the assumed iodine removal by the containment spray. The fan units also support the functioning of the hydrogen recombiners, as discussed in the Bases for LCO 3.6.7,

'Hydrogen' Recombiners." In post accident operation following a SIS, all four Containment air coolers are designed to change automatically to the emergency mode.

The CACs are automatically changed to the emergency mode by a Safety Injection Signal (SIS). This signal will trip the normal rated fan motor in each unit, open the high-capacity service water discharge valve from VHX-1, VHX-2, and VHX-3, and close the high-capacity service water supply valve to VHX-4. The test to verify the service water valves actuate to their correct position upon receipt of an SIS signal is included in the surveillance test performed as part of Specification 3.7.8, Service Water System. The safety related fans are normally in operation and only receive an actuation signal through the DBA sequencers following an SIS in conjunction with a loss of offsite power. This actuation is tested by the surveillance which verifies the energizing of loads from the DBA sequencers in Specification 3.8.1, "AC Sources-Operating." (

Palisades Nuclear Plant B 3.6.64 Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES APPLICABLE The Containment Spray System and Containment Air Cooler -

SAFETY ANALYSES System limit the temperature and pressure that could be experienced following either a Loss of Coolant Accident (LOCA) or a Main Steam Line Break (MSLB). The large break LOCA and MSLB are analyzed using' computer codes designed to predict the resultant containment pressure and temperature transients.

The Containment Cooling Systems have been analyzed for three accident cases (Ref. 2).' All accidents analyses account for the most limiting single

. active failure.

1. A Large Break LOCA,

2. An MSLB occurring at various power levels with both MSIV bypass valves closed, and

3. An MSLB occurring at 0% RTP with both MSIV bypass valves open.

The postulated large break LOCA is analyzed, in regard to containment ESF systems, assuming the loss of offsite power and the loss of one ESF

bus, which is the worst case single active failure, resulting in one train'of Containment Cooling' being rendered inoperable (Ref. 6).

The postulated MSLB is analyzed, in regard to containment ESF systems, assuming the worst case single active failure.

The MSLB event is analyzed at various power levels with both MSIV bypass valves closed, and at 0%RTP with both MSIV bypass valves open. Having any MSIV bypass valve open allows additional blowdown from the intact steam generator.

'The analysis and evaluation show that under the worst-case scenario, the highest peak containment pressure and the peak containment vapor temperature are within the intent of the design basis. (See the Bases for Specifications 3.6.4, "Containment Pressure," and 3.6.5, "Containment Air Temperature," for a detailed discussion.) The analyses and evaluations consid red'a range of power levels and equipment configurations as described in Reference 2. The peak containment p'ressure case is the 0%power MSLB with initial (pre-accident) cniditions of 140 0F and 16.2 psia. The peak temperature case is the 102% power MSLB with initial (pre-accident) conditions of 140OF and 15.7 psia. The analyses also assume a response time delayed initiation in order to provide conservative peak calculated containment pressure and temperature responses.

Palisades Nuclear Plant B 3.6.6-5 Revised 04/04/2003

Containment Cooling Systems B 3.6.q BASES APPLICABLE The external design pressure of the containment' shell is 3 psig. This SAFETY ANALYSES value is approximately 0.5 psig greater than the maximum external (continued) pressure that could be developed if the containment were sealed during a period of low barometric pressure and high temperature and, subsequently, the containment atmosphere was cooled with a concurrent major rise in barometric pressure.

The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the Containment High Pressure setpoint to achieve full flow through the CACs and containment spray nozzles. The spray lines within containment are maintained filled to the 735 ft elevation to provide for rapid spray initiation. The Containment Cooling System total response time of < 60 seconds includes diesel generator startup (for loss of offsite power), loading of equipment, CAC and containment spray pump startup, and spray line filling.

The performance of the Containment Spray System for post accident conditions is given in Reference 3. The performance of the Containment Air Coolers is given in Reference 4.

The Containment Spray System and the Containment Cooling System satisfy Criterion 3 of 10 CFR 50.36(c)(2). (

LCO During an MSLB or large break LOCA event, a minimum of one containment cooling train is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header, and air cooler fan V-4A. This train must be supplemented with 2 service water pumps and 2 containment air coolers if an MSIV bypass valve is open. The other train of containment cooling is associated with Diesel Generator 1-2'and includes Containment Spray Pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A, and V-3A. To ensure that these requirements are met, two trains of containment cooling must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.

Palisades Nuclear Plant B 3.6.6-6 Revised 04/0412003

Containment Cooling Systems B 3.6.Q BASES LCO The Containment Spray System portion of the containment cooling trains (continued) includes three spray pumps, two spray headers, nozzles, valves, piping' instruments,'and controls to ensure an OPERABLE flow path capable of taking suction from the SIRWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

The Containment Air Cooler System portion of the containment cooling train which must be OPERABLE includes the three safety related air coolers which each consist of four cooling coil banks, the safety related fan which must be in operation to be OPERABLE, gravity-operated fan discharge dampers, instruments, and controls to ensure an OPERABLE flow path.

CAC fans V-1A, V-2A, V-3A, and V-4A must be in operation to be considered OPERABLE.: These fans only receive a start signal from the DBA sequencer; they are assumed to be in operation, and are not started by either a CHP or an SIS signal.,

APPLICABILITY In MODES 1, 2, and 3, a large break LOCA event could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the containment spray trains and containment cooling trains.

In MODES 4, 5 and 6, the probability and consequences of-these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray and Containment Cooling systems are not required to be OPERABLE in MODES 4, 5 and 6.

ACTIONS A.1 Condition A is applicable whenever one or more containment cooling trains is inoperable. Action A.1 requires restoration of both trains to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72-hour Completion Time for Condition A is based on the assumption that at least 100% of the required post accident containment cooling'capability (that assumed in the safety analyses) is available.' If less than 100% of the required post containment accident cooling is available, ConditionC must also be entered.

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time under' conditions when a required system can perform its required safety function,' but may not be able to do so assuming an additional failure.

When operating in accordance with the Required Actions of an LCO Condition, it is not necessary to be able to cope with an additional single failure.

Palisades Nuclear Plant B 3.6.6-7 . Revised 04/04/2003:

Containment Cooling Systems B 3.6.6 BASES ,

ACTIONS A.1 (continued)

The Containment Cooling systems can provide one hundred percent of the required post accident cooling capability following the occurrence of.

any single active failure. Therefore, the containment cooling function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under that condition, however, the ability to provide the function after the occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

B.1 and B.2 Condition B is applicable when the Required Actions of Condition A cannot be completed within the required Completion Time. Condition A is applicable whenever one or more trains is inoperable. Therefore, when Condition B is applicable, Condition A is also applicable. (If less than 100% of the post accident containment cooling capability is available, Condition C must be entered as well.) Being in Conditions A and B concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition B while the plant is still within the applicable conditions of the LCO.

If the inoperable containment cooling trains cannot be restored to OPERABLE status within the required Completion Time of Condition A, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least'MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 Condition C is applicable with one or more trains inoperable when there is less than 100% of the required post accident containment cooling capability available. Condition A is applicable whenever one or more trains is inoperable. Therefore, when this Condition is applicable, Condition A is also applicable. Being in Conditions A and C concurrently maintains both Completion Time clocks for instances where equipment repair restores 100% of the required post accident containment cooling capability while the LCO is still applicable, allowing exit from Condition C (and LCO 3.0.3).

Palisades Nuclear Plant B 3.6.6-8 Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES ACTIONS C.1 (continued)

Several specific cases have been analyzed in the safety analysis to provide operating flexibility for equipment outages and testing. These analyses show that action A.1 can be entered under certain circumstances, because 100% of the post accident cooling capability is maintained. These specific cases are discussed below.

One hundred percent of the required post accident cooling capability can be provided with both MSIV bypass valves closed if either;

1. Two containment spray pumps, two spray headers, and one CAC fan are OPERABLE, or

2. One containment spray pump, two spray headers, and three safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon).

One hundred percent of the required post accident cooling capability can be provided for operation .with a MSIV bypass valve open or closed if either;

1. Two containment spray pumps, two spray headers, and two safety related CACs, are OPERABLE (at least tw6 service water pumps must be OPERABLE if CACs are to be relied upon), or

2. One containment spray pump, one spray header, and three safety related CACs are OPERABLE (at least three service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs):

If the Containment Spray side (tube side) of SDC Heat Exchanger E-60B is out of service, 100% of the required post accident cooling capability

,- can be provided, if other equipment outages are limited. One hundred percent of the post accident cooling can be provided with the Containment Spray side of SDC Heat Exchanger E-60B out of service if the following equipment is OPERABLE: three safety related Containment Air Coolers, two Containrent Spray Pumps, two spray headers, CCW

- pumps P-52A and P-52B, two SWS pumps, and both CCW Heat Exchangers, and if

1. One CCW Containment Isolation Valve, CV-0910, CV-0911, or CV-0940, is OPERABLE, and

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE.

Palisades Nuclear Plant B 3.6.6-9 .. Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES ACTIONS C.1 (continued)

C With less than 100% of the required post accident containment cooling capability available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation. This SR also does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct positions prior to being secured.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned, are in the correct position.

SR 3.6.6.2 Operating each safety related Containment Air Cooler fan unit for 2 15 minutes ensures that all trains are OPERABLE and are functioning properly. The 31-day Frequency was developed considering the known reliability of the fan units, the two train redundancy available, and the low probability of a significant degradation of the containment cooling train occurring between surveillances.

SR 3.6.6.3 Verifying the containment spray header is full of water to the 735 ft elevation minimizes the time required to fill the header. This ensures that spray flow will be admitted to the containment atmosphere within the time frame assumed in the containment analysis. The 31-day Frequency is based on the static nature of the fill header and the low probability of a significant degradation of the water level in the piping occurring between surveillances.

SR 3.6.6.4 Verifying a total service water flow rate of > 4800 gpm to CACs VHX-1, VHX-2, and VHX-3, when aligned for accident conditions, provides assurance the design flow rate assumed in the safety analyses will be achieved (Ref. 8). Also considered in selecting this Frequency were the Palisades Nuclear Plant B 3.6.6-1 0 Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 (continued)

REQUIREMENTS known reliability of the cooling water system, the two train redundancy, and the low probability of a significant degradation of flow occurring between surveillances.

SR 3.6.6.5 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by Section Xl of the ASME Code (Ref. 5).

Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.6 and SR 3.6.6.7 SR 3.6.6.6 verifies each automatic containment spray valve.actuates to' its correct position upon receipt of an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

SR 3.6.6.7 verifies each containment spray pump starts automatically on an actual or simulated actuation signal. The 18-month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillances when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

Where the surveillance of containment sump isolation valves is also required by SR 3.5.2.5, a single surveillance may be used to satisfy both requirements.

SR 3.6.6.8 This SR verifies each containment cooling fan actuates upon receipt of an actual or simulated actuation signal. The 18-month Frequency is Palisades Nuclear Plant B 3.6.6-11 :. Revised 04/04/2003

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.8 (continued)

REQUIREMENTS I based on engineering judgement and has been shown to be acceptable through operating experience. See SR 3.6.6.6 and SR 3.6.6.7, above, for further discussion of the basis for the 18 month Frequency.

SR 3.6.6.9 With the containment spray inlet valves closed and the spray header drained of any solution, an inspection of spray nozzles, or a test that blows low-pressure air or smoke through test connections can be completed. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Verification following maintenance which could result in nozzle blockage is appropriate because this is the only activity that could lead to nozzle blockage.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.18

3. FSAR, Sections 6.2

4. FSAR, Section 6.3

5. ASME, Boiler and Pressure Vessel Code, Section Xl,

6. FSAR, Table 14.18.1-3

7. FSAR, Table 14.18.2-1

8. FSAR, Table 9-1

9. EA-MSLB-2001-01 Rev. 1, Containment Response to a MSLB Using CONTEMPT-LT/28, January 2002.

10. EA-LOCA-2001-01 Rev. 1, Containment Response to a LOCA Using CONTEMPT-LT/28, January 2002.

. . .~~~~~~~~~~~~~Q Palisades Nuclear Plant B 3.6.6-12 Revised 04/0412003

MSIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs)

BASES BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam generators following a High Energy Line Break (HELB) downstream of the MSIV. MSIV closure terminates flow from the unaffected (intact) steam generator for breaks upstream of the other MSIV.

One MSIV is located in each main steam line outside, but close to, containment. The MSIVs are downstream from the Main Steam Safety Valves (MSSVs), atmospheric dump valves, and auxiliary feedwater pump turbine steam supplies to prevent their being isolated from the steam generators by MSIV closure; Closing the MSIVs isolates each steam generator from the other, and isolates the turbine, turbine bypass valve, and other auxiliary steamsupplies from the steam generators, assuming the normally closed MSIV bypass valves are closed. The MSIV bypass valves do not receive an isolation signal and might be open during zero power conditions.

The MSIVs close on solation signals generated by either Steam Generator Low Pressure or.Containment High Pressure. The MSIVs fail closed on loss of air. The isolation signal also actuates the Main Feedwater Regulating Valves (MFRVs) and MFRV bypass valves to close. The MSIVs may also be actuated manually.

A description of the MSIVs is found in the FSAR, Section 10.2 (Ref. 1).

APPLICABLE The design basis of the MSIVs is established by the containment SAFETY ANALYSES analysis for the Main Steam Line Break (MSLB) inside containment, as discussed Inthe FSAR, SectIon 14.18 (Ref. 2). It Is also influenced by the accident analysis of the MSLB events presented in the FSAR, Section 14.14 (Ref. 3). The MSIVs are swing disc check valves. The inherent characteristic of this type of valve allows for reverse flow through the valve on a differential pressure even if the valve is closed. In the event of an MSLB, if the MSIV associated with the unaffected steam generator fails to close, both steam generators may blowdown. This failure was not analyzed as part of the original licensing basis of the plant. As such, a Probabilistic Risk Assessment and cost benefit analysis were performed to determine if a facility modification was needed.

B.3.7.2- Reie 12/02/2002 .. _.

Nuclear Pln Palisades Nucea Paiae Plant B 37.2-1 Revised 12/02/2002

MSIVs B 3.7.2 BASES APPLICABLE The results of the analysis as described in an NRC Safety Evaluation SAFETY ANALYSES dated February 28, 1986 concluded that a double steam generator (continued) blowdown event, although more severe than the MSLB used in the original licensing basis of the plant, is not expected to result in unacceptable consequences. Furthermore, the NRC evaluation demonstrated that the potential offsite dose consequences are low and that modifications would not provide a cost beneficial improvement to plant safety.

There are three different limiting MSLB cases that have been evaluated, one for fuel integrity and two for containment analysis (one for containment temperature and one for containment pressure). The limiting case for containment temperature is the hot full power MSLB inside containment following a turbine trip. At hot full power, the stored energy in the primary coolant is maximized.

The limiting case for the containment analysis for containment pressure and fuel integrity is the hot zero power MSLB inside containment. At zero power, the steam generator inventory and temperature are at their maximum, maximizing the analyzed mass and energy release to the containment. Reverse flow due to the open MSIV bypass valves, contributes to the total release of the additional mass and energy. With (

the most reactive control rod assumed stuck in the fully withdrawn position, there is an increased possibility that the core will return to power.

The core is ultimately shut down by a combination of doppler feedback, steam generator dryout, and borated water injection delivered by the Emergency Core Cooling System.

The accident analysis compares several different MSLB events against different acceptance criteria. The MSLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability. The MSLB inside containment at hot full power is the limiting case for a post trip return to power. The analysis includes scenarios with offsite power available and with a loss of offsite power following a turbine trip.

With offsite power available, the primary coolant pumps continue to circulate coolant through the steam generators, maximizing the Primary Coolant System (PCS) cooldown. With a loss of offsite power, the response of mitigating systems, such as the High Pressure Safety Injection (HPSI) pumps, is delayed.

3.7.2-2 Revised 12/02/2002 Plant Nuclear Plant Palisades Nuclear BB 3.7.2-2 Revised 12/02/2002

MSIVs B 3.7.2 BASES . .

APPLICABLE 'The MSIVs serve only a safety function and remain open during power SAFETY ANALYSES operation. These valves operate under the following situations:

(continued)

a. An MSLB inside containment. For this accident scenario, steam is discharged into containment from both steam generators until closure of the MSIV in the intact steam generator occurs. After MSIV closure, steam is discharged into containment only from the affected steam generator.

b. A break outside of containment and upstream from the MSIVs.

This scenario is not a containment pressurization concern. The uncontrolled blowdown of more' than one steam generator must be prevented to limit the potential for uncontrolled PCS cooldown and positive reactivity addition. Closure of the MSIVs limits the blowdown to a single steam generator.

c. A break downstream of the MSIVs. This type of break will be isolated by the closure of the MSIVs. Events such as increased steam flow through the turbine or the turbine bypass valve will also terminate on closure of the MSIVs.

d. A steam generator tube rupture. For this scenario, closure of the MSIVs isolates the affected steam generator from the intact steam generator and minimizes radiological releases.

The MSIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO This LCO requires that the' MSIV in each of the two steam lines be OPERABLE. The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation signal.

This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100.11 (Ref. 4) limits or the NRC staff approved licensing basis.

APPLICABILITY The MSIVs must be OPERABLE in MODE 1, and in MODES 2 and 3 except when both MSIVs are closed and deactivated when there is significant mass and energy in the PCS and steam generators. When the MSIVs are closed, they are already performing their safety function.

Deactivation can be accomplished by the removal of the motive force (e.g., air) to the valve to prevent valve opening.

Palisades Nuclear Plant B 3.7.2-3 Revised 12/02/2002

MSIVs B 3.7.2 BASES APPLICABILITY In MODE 4, the steam generator energy is low; therefore, the MSIVs (continued) are not required to be OPERABLE.

In MODES 5 and 6, the steam generators do not contain much energy because their temperature is below the boiling point of water, therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

ACTIONS A.1 With one MSIV inoperable in MODE 1, time is allowed to restore the component to OPERABLE status. Some repairs can be made to the MSIV with the plant hot. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable, considering the probability of an accident occurring during the time period that would require closure of the MSIVs.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is greater than that normally allowed for containment isolation valves because the MSIVs are valves that isolate a closed system penetrating containment.

B.1 If the MSIV cannot be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition C would be entered. The Completion Time is reasonable, based on operating experience, to reach MODE 2 in an orderly manner and without challenging plant systems.

C.1 and C.2 Condition C is modified by a Note indicating that separate Condition entry is allowed for each MSIV.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed.

When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is consistent with that allowed in Condition A.

Revised I 2/02/2002 Palisades Nuclear Plant Palisades Nuclear Plant B 3.7.24 B 3.7.2-4 Revised 2/02/2002

MSIVs B 3.7.2 BASES ACTIONS C.1 and C.2 (continued)

Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid.

The once per 7 days Completion Time is reasonable, based on engineering judgment, MSIV status indications available in the control room, and other administrative controls, to ensure these valves are in the closed position. As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated'as once per... ." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per . .. " basis. The 25%

extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.7.2 C.2 must be initially performed within 7 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

D.1 and D.2 If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from MODE 2 in an orderly manner and without challenging plant systems.

Revised 12102/2002 Plant Nuclear Plant Palisades Nuclear B 3.7.2-5 B 3.7.2-5 1. Revised 12/02/2002

MSIVs B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is

5.0 seconds on an actual or simulated actuation signal from each train under no flow conditions. Specific signals (e.g., Containment High Pressure, Steam Generator Low Pressure, handswitch) are tested under Section 3.3, uInstnrmentation.0 The MSIV closure time is assumed in the MSLB and containment analyses. This SR is normally performed during a refueling outage. The MSIVs are not tested at power since even a part stroke exercise increases the risk of a valve closure with the plant generating power. As the MSIVs are not tested at power, they are exempt from the ASME Code, Section Xl (Ref. 5) requirements during operation in MODES I and 2.

The Freque ncy for this SR is every 18 months. This 18 month Frequency demonstrates the valve closure time at least once per refueling cycle.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 10.2

2. FSAR, Section 14.18

3. FSAR, Section 14.14

4. 10 CFR 100.11

5. ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400 Palisades Nuclear Plant B 3.7.2-6 Revised 12/02/2002

MFRVs and MFRV Bypass Valves B 3.7.3 B 3.7 PLANT SYSTEMS B 3.7.3 Main Feedwater Regulating Valves (MFRVs) and MFRV Bypass Valves BASES BACKGF OUND The MFRVs and MFRV bypass valves in conjunction with feed pump speed, control Main Feedwater (MFW) flow to the steam generators for level control during nornal plant operation. The valves also isolate MFW

'flow to the secondary side of the steam generators following a High

-Energy Line Break (HELB). -Closure of the MFRVs'and MFRV bypass valves terminates flow to both steam generators. Closure of the MFRV and MFRV bypass valve effectively terminates the addition of feedwater

-to an affected steam generator, limiting the mass and energy release for Main SteamLine Breaks (MSLBs) inside containment, and reducing the cooldown effects.

The MFRVs and MFRV bypass valves isolate MFW in the event of a secondary side pipe rupture inside containment to limit the quantity of high energy fluid that enters containment through the break. Controlled addition of Auxiliary Feedwater (AFW) is provided by a separate piping system."

One MFRV and one MFRV bypass valve are located on each MFW line outside containment. The piping volume from the valves to the steam generator must be accounted for in calculating mass and energy releases following an MSLB.

The MFRVs and MFRV bypass valves close on receipt of an isolation signal generated by either, steam generator low pressure from its respective steam generator, or containment high pressure. These isolation signals also actuate'the Main Steam Isolation Valves (MSIVs) to close. The MFRVs and MFRV bypass valves may also be actuated manually. The MFRVs and MFRV Bypass valves are non-safety grade valves located on non-safety grade piping that fail as-is" on a loss of air.

If required, MFW isolation can be accomplished using manually operated valves upstream or downstream of the MFRVs and MFRV Bypass valves.

In addition, each MRFV is equipped with a handwheel that can be used to isolate this MFW flowpath.

A description of the MFRVs and MFRV bypass valves is found in the FSAR, Section 10.2.3 (Ref. 1).

Reie 12.02_12002 Nuclear Pln B 3..-

Palisades Nucea Paiae Plant B 3.7.3-1 Revised 12/02/2002

MFRVs and MFRV Bypass Valves B 3.7.3 BASES APPLICABLE Closure of the MFRVs is an assumption in the MSLB containment SAFETY ANALYSES response analysis. Closure of the MFRVs and MFRV bypass valves is arso assumed in the MSLB core response (DNB) analysis.

Failure of an MFRV or MFRV bypass valve to close following an MSLB can result in additional mass and energy to the steam generators contributing to cooldown. This failure also results in additional mass and energy, releases following an MSLB event. However, this failure was not analyzed as part of the original licensing basis of the plant. As such, a Probabilistic Risk Assessment and cost benefit analysis were performed to determine if a facility modification was needed. The results of the analysis as described in an NRC Safety Evaluation dated February 28, 1986 concluded that a single steam generator blowdown event with continued feedwater, although more severe than the MSLB used in the original licensing basis of the plant, is not expected to result in unacceptable consequences. Furthermore, the NRC evaluation demonstrated that the potential offsite dose consequences are low and that modifications would not provide a cost beneficial improvement to plant safety.

The MFRVs and MFRV bypass valves satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO This LCO ensures that the MFRVs and MFRV bypass valves will isolate MFW flow to the steam generators following an MSLB. This LCO requires that both MFRVs and both MFRV bypass valves be OPERABLE.

The MFRVs and MFRV bypass valves are considered OPERABLE when the isolation times are within limits, and are closed on an isolation signal.

Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an MSLB inside containment.

Revised I 2102/2002 Nuclear Plant Palisades Nuclear Plant B 3.7.3-2 B 3.7.3-2 Revised 12/02/2002

MFRVs and MFRV Bypass Valves B 3.7.3 BASES APPLICABILITY All MFRVs and MFRV bypass valves must be OPERABLE, or either closed and deactivated, or isolated by closed manually actuated valves, whenever there is significant mass and energy in the Primary Coolant System and steam generators.

In MODES 1, 2, and 3, the MFRVs or MFRV bypass valves are required to be OPERABLE, except when both MFRVs and both MFRV bypass valves are either closed and deactivated, or isolated by closed manually actuated valves, in order to limit the'amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are either closed and deactivated, or isolated by closed manually actUated valves, they are already performing their safety function.

Once the valves are closed, deactivation can be accomplished by the

-removal of the motive force (e.g., electrical power, air) to the valve to prevent valve opening. Closing another manual valve in the flow path either remotely (i.e., control room hand switch) or locally by manual operation satisfies isolation requirements.

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the' MFRVs and MFRV bypass valves are not required to be OPERABLE.

ACTIONS - The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each valve.

A.1 and A.2 With one or more MFRV or MFRV bypass valve inoperable, action must be taken to close or isolate the inoperable valve(s) within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . When these valve(s) are closed or isolated, they are' performing their required safety function (e.g., to isolate the line).

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable to close'the MFRV or MFRV bypass valve, which includes performing a controlled plant shutdown to a condition that supports isolation of the affected valve(s). As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as "once per. . .'

however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance.

Palisades Nuclear Plant B 3.7.3-3 ;Revised 12/02/2002

MFRVs and MFRV Bypass Valves B 3.7.3 BASES ACTIONS A.1 and A.2 (continued)

(continued)

Therefore, while Required Action 3.7.3 A.2 must be initially performed within 7 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

B.1 and B.2 If the MFRVs or MFRV bypass valves cannot be restored to OPERABLE status, closed, or isolated in the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies the closure time for each MFRV and MFRV bypass valve is

22.0 seconds on an actual or simulated actuation signal. Specific W signals (e.g., steam generator low pressure and containment high pressure) are tested under Section 3.3, Instrumentation." The MFRV and MFRV bypass valves closure times are bounding values assumed in the MSLB containment response and core response (DNB) analyses (Refs. 3 and 4). This SR is normally performed during a refueling outage. The MFRVs and MFRV bypass valves should not be tested at power since even a part stroke exercise increases the risk of a valve closure with the plant generating power. As these valves are not stroke tested at power, they are exempt from the ASME Code, Section Xl (Ref. 2) requirements during operation in MODES 1 and 2.

The Frequency is 18 months. The 18 month Frequency for valve closure time is based on the refueling cycle. Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency.

Plant 3.7.3-4 B3.7.3-4 Revised 12/02/2002 Palisades Nuclear Plant B Revised 12/02/2002

MFRVs and MFRV Bypass Valves B 3.7.3 BASES REFERENCES 1. FSAR, Section 10.2.3 2: ASME, Boiler and Pressure Vessel Code, Section Xl, Inservice Inspection, Article IWV-3400

3. FSAR, Section 14.18.2

4. FSAR, Section 14.14 Palisades Nuclear Plant B 3.7.3-5 Revised 12/02/2002

Fuel Handling Area Ventilation System B 3.7.12 B 3.7 PLANT SYSTEMS B 3.7.12 Fuel Handling Area Ventilation System BASES BACKGROUND The Fuel Handling Area Ventilation System filters'airbome radioactive particulates from the area of the spent fuel pool following a fuel handling accident or a fuel cask drop accident. The fuel handling area is served by two separate subsystems one being part of the original plant design, and the other being added as part of the Auxiliary Building Addition.

The original plant design consists of a supply plenum and an exhaust plenum including associated ductwork, dampers, and instrumentation.

The supply plenum contains one prefilter, two heating coils, and one supply fan. The exhaust plenum contains two filter banks (normal and emergency) configured in a parallel flow arrangement, and two independent exhaust fans which draw air from a common duct. The

'normal filter bank" contains a prefilter and a High Efficiency Particulate Air (HEPA) filter. The emergency filter bank" contains a prefilter, HEPA filter, and an activated charcoal filter.

The Auxiliary Building Addition, which was added to serve the spaces at the north end of the spent fuel pool, also consist of a supply plenum and

-:- -exhaust plenum. The supply plenum is configured similar to the supply plenum'provided in the original plant design and includes one prefilter, two heating coils, and one supply fan. The exhaust plenum is different from the original plant design in that It only contains one filter bank consisting of a prefilter and HEPA filter, and two common exhaust fans.

During normal plant operations, the Fuel Handling Area Ventilation System supplies filtered and heated (as needed) outside air to the fuel handling area. The exhaust fans draw air from the fuel handling area through the normally aligned prefilters and HEPA filters and discharge it to the unit stack by way of the main ventilation exhaust plenum.

Palisades Nuclear Plant B 3.7.12 Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 BASES BACKGROUND During plant evolutions when the possibility for a fuel handling accident (continued) or fuel cask drop accident exist, the Fuel Handling Area Ventilation System is configured such that all fans are stopped except one exhaust fan in the original plant subsystem aligned to the emergency filter bank."

The "normal filter bank" in the original plant design is isolated by closing its associated inlet damper. Thus, in the event of a fuel handling accident, the fuel handling area atmosphere will be filtered for the removal of airborne fission products prior to being discharged to the outside environment.

The Fuel Handling Area Ventilation System is discussed in the FSAR, Sections 9.8, 14.11 and 14.19 (Refs. 1, 2, and 3) because it may be used for normal, as well as post-accident, atmospheric cleanup functions.

APPLICABLE The Fuel Handling Area Ventilation System is designed to mitigate the SAFETY ANALYSES consequences of a fuel handling accident or fuel cask drop accident by limiting the amount of airborne radioactive material discharged to the outside atmosphere.

The results and major assumptions used in the analysis of the fuel handling accident are presented in FSAR Section 14.19. For the purpose of defining the upper limit of the radiological consequences of a fuel handling accident, it is assumed that a fuel bundle is dropped during fuel handling activities and all the fuel rods in the equivalent of an entire assembly (216) fail. The bounding fuel handling accident is assumed to occur in containment two days after shutdown. No containment isolation is assumed to occur. As such, the released fission products escape to the environment with no credit for filtration. The results of this analysis have shown that the offsite doses resulting from this event are within the guideline of 10 CFR 100. In the event a fuel handling accident were to occur in the fuel handling area, the radioactive release would pass through the emergency filter bank" significantly reducing the amount of radioactive material released to the environment. Thus, the consequences of a fuel handling accident in the fuel handling area are deemed acceptable with or without the emergency filter bank" in operation since they are no more severe than the consequences of a fuel handling accident in containment.

Palisades Nuclear Plant B 3.7.12-2 Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 C BASES APPLICABLE The results and major assumptions used in the analysis of the fuel cask SAFETY ANALYSES drop accident are presented in FSAR Section 14.11. For the purpose (continued) of defining the upper limit of the radiological consequences of a fuel cask drop accident, it is assumed that all 73 fuel assemblies in a 7 x 11 Westinghouse spent fuel pool rack with a minimum decay of 30 days are damaged and release their fuel rod gap inventories. Three fuel cask drop scenarios were analyzed to encompass all fuel cask drop events. They are:

1. A fuel cask drop onto 30 day decayed fuel with the Fuel Handling Area Ventilation System aligned for emergency filtration with a conservative amount of unfiltered leakage. All isolatable unfiltered leak path are assumed to be isolated prior to event initiation.

2. A fuel cask drop onto ,30 day decayed fuel with the Fuel Handling Area Ventilation System aligned for emergency filtration with a conservative amount of unfiltered leakage. This scenario- --

determined the maximum amount of non-isolatable unfiltered leakage that can exist and still meet 6ffsite dose limits. This scenario also assumes isolation of isolable leak paths prior to event initiation.

3. A fuel cask drop onto 90 day decayed fuel without the Fuel

_____________________________________Handling Area Ventilation System aligned for emergency filtration.

- This-scenario-needs-no-assumptions-as-to-unfiltered-leakage-or--

post-accident unfiltered leak path isolation times since all radiation is assumed to be released unfiltered from the fuel handling area.

The results of the analysis show that the radiological consequences of a fuel cask drop in the spent fuel pool meet the acceptance criteria of Regulatory Guide 1.25 (Ref. 4) and NUREG-0800 Section 15.7.5 (Ref. 5)

-, ,; for all scenarios. In addition, the dose from all scenarios are less than

' 25% of the dose guidelines in 10 CFR 100.

. ' ' ' .- I Palisades Nuclear Plant B 3.7.12-3 - Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 BASES APPLICABLE Filtration of the fuel handling area atmosphere following a fuel handling SAFETY ANALYSES accident is not necessary to maintain the offsite doses within the (continued) guidelines of 10 CFR 100. Thus, a total system failure would not impact the margin of safety as described in the safety analysis. However, analysis has shown that post-accident filtration by the Fuel Handling Area Ventilation System provides significant reduction in offsite doses by limiting the release of airborne radioactivity. Therefore, for the fuel handling accident, the Fuel Handling Area Ventilation System satisfies Criterion 4 of 10 CFR 50.36(c)(2).

Filtration of the fuel handling area atmosphere following a fuel cask drop on irradiated fuel assemblies with < 90 days decay is required to maintain the offsite doses within the guidelines of 10 CFR 100. Therefore, for the fuel cask drop accident, the Fuel Handling Area Ventilation System satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO for the Fuel Handling Area Ventilation System ensures filtration of the fuel handling area atmosphere is immediately available in the event of a fuel handling accident, or a fuel cask drop accident. As such, the LCO requires the Fuel Handling Area Ventilation System to be OPERABLE with one fuel handling area exhaust fan aligned to the "emergency filter bank" and in operation.

The Fuel Handling Area Ventilation System is considered OPERABLE when the individual components necessary to control exposure in the fuel handling building are OPERABLE. The Fuel Handling Area Ventilation System is considered OPERABLE when:

a. One exhaust fan is aligned to the 'emergency filter bank" and in operation to ensure the air discharged to the main ventilation exhaust plenum has been filtered. Operation of only one fuel handling area exhaust fan ensures the design flow rate of the

'emergency filter bank" is not exceeded.

b. HEPA filter and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration functions; and

c. Ductwork and dampers are OPERABLE, and air circulation can be maintained. Inclusive to the requirement to align the emergency filter bank' is that the normal filter bank" is isolated by its associated inlet damper to prevent the release of unfiltered air.

(',

Palisades Nuclear Plant B 3.7.12-4 Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 BASES APPLICABILITY The Fuel Handling Area Ventilation System must be OPERABLE, -aligned, and in operation whenever the potential exists for an accident that results in the release of radioactive material to the fuel handling area atmosphere that could exceed previously approved offsite dose limits if released unfiltered to the outside atmosphere. As such, the Fuel Handling Area Ventilation System is required; during movement of irradiated fuel assemblies in the fuel handling building when irradiated fuel assemblies with < 30 days decay time are in the fuel handling building; during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in containment when irradiated fuel assemblies with < 30 days decay time are in the containment with the equipment hatch open, and during movement of a fuel cask in or over the spent fuel pool when irradiated fuel assemblies with < 90 days decay time fuel handling building.

The requirement for the Fuel Handling Area Ventilation System does not apply during movement of irradiated fuel assemblies or CORE ALTERATIONS when all irradiated fuel assemblies in the fuel handling building, or all irradiated fuel assemblies in the containment with the equipment hatch open, have decayed for 30 days or greater since the dose consequences from a fuel handling accident would be of the same magnitude without the filters operating as the dose consequences would be with the filters operating and two days decay. In addition, the requirement for the Fuel Handling Area Ventilation System does not apply during fuel cask movement when all irradiated fuel assemblies in the fuel handling building have decayed 90 days or greater since the dose consequences remain less than 25% of the guidelines of 10 CFR 100.

ACTIONS A.1, A.2, and A.3 If the Fuel Handling Area Ventilation System is not aligned to the "emergency filter bank", or one exhaust fan is not in operation, or the system is inoperable for any reason, action must be taken to place the unit in a condition In which the LCO does not apply. Therefore, activities involving the movement of irradiated fuel assemblies, CORE ALTERATIONS, and movement of a fuel cask in or over the spent fuel pool, must be suspended immediately to minimize the potential for a fuel handling accident.

The suspension of fuel movement, CORE ALTERATIONS, and fuel cask movement shall not preclude the completion of placing a fuel assembly, core component, or fuel cask in a safe position.

Palisades Nuclear Plant B 3.7.12-5 Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 BASES SURVEILLANCE SR 3.7.12.1.

REQUIREMENTS This SR verifies the performance of Fuel Handling Area Ventilation System filter testing in accordance with the Ventilation Filter Testing Program. The Fuel Handling Area Ventilation System filter tests are in accordance with the Regulatory Guide 1.52 (Ref. 6) as described in Ventilation Filter Testing Program. The Ventilation Filter Testing Program includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the Ventilation Filter Testing Program.

SR 3.7.12.2 This SR verifies the Fuel Handling Area Ventilation System has not degraded and is operating as assumed in the safety analysis. The flow rate is periodically tested to verify proper function of the Fuel Handling Ventilation System. When aligned to the emergency filter bank", the Fuel Handling Area Ventilation System is designed to reduce the amount of unfiltered leakage from the' fuel handling building which, in the event of a fuel handling accident,' lowers the dose at the site boundary to well within the guidelines of 10 CFR 100. The Fuel Handling Area Ventilation System is designed to lower the dose to these levels at a flow rate of 2 5840 cfm and

8760 cfm. The Frequency of 18 months is consistent with the test for filter performance and other filtration SRs.

(..

Palisades Nuclear Plant B 3.7.12-6 Revised 07/16/2003

Fuel Handling Area Ventilation System B 3.7.12 BASES REFERENCES 1. FSAR, Section 9.8

2. FSAR, Section 14.11

3. FSAR, Section 14.19

4. Regulatory Guide 1.25, Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Reactors.

5. NUREG-0800 Section 15.7.5, Spent Fuel Cask Drop Accidents.

6. Regulatory Guide 1.52, Design, Testing, and Maintenance Criteria for Post-Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Adsorbtion Units of Light-Water-Cooled Nuclear Power Plants.

Palisades Nuclear Plant B 3.7.12-7 Revised 07/16/2003

SFP Water Level I B 3.7.14 B 3.7 PLANT SYSTEMS B 3.7.14 Spent Fuel Pool (SFP) Water Level BASES BACKGROUND The minimum water level in the SFP meets the assumptions of iodine decontamination factors following a fuel handling or cask drop accident.

The specified water level shields and minimizes the general area dose when the storage racks are filled to their maximum capacity. The water also provides shielding during the movement of spent fuel.

A general description of the SFP design is-given in the FSAR, Section 9.11 (Ref. 1), and the Spent Fuel Pool Cooling and Cleanup System is given in the FSAR, Section 9.4 (Ref. 2). The assumptions of fuel handling and fuel cask drop accidents are given in the FSAR, Section 14.19 and 14.11 (Refs. 3 and 4), respectively.

I APPLICABLE The minimum water level in the SFP meets the assumptions of fuel SAFETY ANALYSES handling or fuel cask drop accident analyses described in References 3 and 4 and are consistent with the assumptions of Regulatory Guide 1.25 (Ref. 5). The resultant 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to a person at the exclusion area boundary is well within the 10 CFR 100 (Ref. 6) limits.

Reference 5 assumes there is 23 ft of water between the top of the damaged fuel assembly and the fuel pool surface for a fuel handling or fuel cask drop accident. This LCO preserves this assumption for the bulk of the fuel in the storage racks. In the case of a single assembly, dropped and lying horizontally on top of the spent fuel racks, there may be < 23 ft of water above the top of the assembly and the surface, by the width of the assembly. To offset this small nonconservatism, the analysis assumes that all fuel rods fail, although analysis shows that only the first few rods fail from a hypothetical maximum drop.

The SFP water level satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.7.14-1 Revised 09/09/2003

SFP Water Level B 3.7.14 BASES -

LCO The specified water level preserves the assumptions of the fuel handling or fuel cask drop accident analyses. As such, it is the minimum required for movement of fuel assemblies or movement of a fuel cask in or over the SFP.

The LCO is modified by a Note which allows SFP level to be below the 647 ft elevation to support movement of a fuel cask in or over the SFP.

This is necessary due to the water displaced by the fuel cask as it is lowered or dropped into the SFP. If the SFP level is normal prior to the fuel cask entering the SFP, the SFP could overflow.

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the SFP or movement of a fuel cask in or over the SFP since the potential for a release of fission products exists.

ACTIONS The Actions are modified by a Note indicating that LCO 3.0.3 does not apply.

If moving irradiated fuel assemblies or fuel cask in or over the SFP while in MODE 5 or 6, LCO 3.0.3 would not specify any action. If moving irradiated fuel assemblies or fuel cask in or over the SFP while in MODES 1, 2, 3, and 4, the movement of fuel or movement of a fuel cask is independent of reactor operations. Therefore, in either case, inability to suspend movement of irradiated fuel assemblies or fuel cask in or over the SFP is not sufficient reason to require a reactor shutdown.

A.1 and A.2 When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. When the SFP water level is lower than the required level, the movement of irradiated fuel assemblies in the SFP or movement of a fuel cask in or over the SFP are immediately suspended. This effectively precludes a spent fuel handling or fuel cask drop accident from occurring. This does not preclude moving a fuel assembly or fuel cask to a safe position.

(1 Palisades Nuclear Plant B 3.7.14-2 Revised 09/09/2003

SFP Water Level B 3.7.14 BASES SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies sufficient SFP water is available in the event of a fuel handling or fuel cask drop accident. The water level in the SFP must be checked periodically. The 7 day Frequency is appropriate because the volume in the pool is normally stable. Water level changes are controlled by plant procedures and are acceptable, based on operating experience.

During refueling operations, the level in the SFP is at equilibrium with that of the refueling cavity, and the level in the refueling cavity is checked daily in accordance with LCO 3.9.6, 'Refueling Cavity Water Level."

REFERENCES 1. FSAR, Section 9.11

2. FSAR, Section 9.4

3. FSAR, Section 14.19

4. FSAR, Section 14.11

5. Regulatory Guide 1.25

6. 10 CFR 100.11 Palisades Nuclear Plant B 3.7.14-3 Revised 09/09/2003

AC Sources - Operating B 3.8.1 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating BASES BACKGROUND The plant Class 1E Electrical Power Distribution System AC sources consist of the offsite power sources, and the onsite standby power sources, Diesel Generators 1-1 and 1-2 (DGs). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The AC power system at Palisades consists of a 345 kV switchyard, three circuits connecting the plant with off-site power (station power, startup, and safeguards transformers), the on-site distribution system, and two DGs. The on-site distribution system is divided into safety related (Class 1-E) and non-safety related portions.

The switchyard interconnects six transmission lines from the off-site transmission system and the output line from the Palisades main generator. These lines are connected In a "breaker and a half scheme between the Front (F) and Rear (R) buses such that any single off-site line may supply the Palisades station loads when the plant is shutdown.

Two circuits supplying Palisades 2400 V buses from off-site are fed directly from a switchyard bus through the startup and safeguards transformers. They are available both during operation and during shutdown. The third circuit supplies the plant loads by "back feeding" through the main generator output circuit and station power transformers after the generator has been disconnected by a motor operated disconnect.

The station power transformers are connected into the main generator output circuit. Station power transformers 1-1 and 1-2 connect to the generator 22 kV output bus. Station power transformer 1-3 connects to the generator output line on the high voltage side of the main transformer. Station power transformers 1-1 and 1-3 supply non-safety related 4160 V loads during plant power operation and during backfeeding operations. Station power transformer 1-2 can supply both safety related and non-safety related 2400 V loads during plant power operation or backfeeding operation.

Revised 07/16/2003 Palisades Nuclear Palisades Plant Nuclear Plant B 3.8.1-1 B 3.8.1-1 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES BACKGROUND The three startup transformers are connected to a common 345 kV (continued) overhead line from the switchyard R bus. Startup transformers 1-1 and 1-3 supply 4160 V non-safety related station loads; Startup Transformer 1-2 can supply both safety related and non-safety related 2400 V loads.

The startup transformers are available during operation and shutdown.

Safeguards Transformer 1-1 is connected to the switchyard F bus. It feeds station 2400 V loads through an underground line. It is available to supply these loads during operation and shutdown.

The onsite distribution system consists of seven main distribution buses (4160 V buses 1A,1 B,1 F, and I G, and 2400 V buses I C, D, and 1E) and supported lower voltage buses, Motor Control Centers (MCCs), and lighting panels. The 4160 V buses and 2400 V bus 1E are not safety related. Buses 1C and 1D and their supported buses and MCCs form two independent, redundant, safety related distribution trains. Each distribution train supplies one train of engineered safety features equipment.

In the event of a generator trip, all loads supplied by the station power transformers are automatically transferred to the startup transformers.

Loads supplied by the safeguards transformer are unaffected by a plant trip. If power is lost to the safeguards transformer, the 2400 V loads will automatically transfer to startup transformer 1-2. If the startup transformers are not energized when these transfers occur, their output breakers will be blocked from closing and the 2400 V safety related buses will be energized by the DGs.

The two DGs each supply one 2400 V bus. They provide backup power in the event of loss of off-site power, or loss of power to the associated 2400 V bus. The continuous rating of the DGs is 2500 kW, with 110 percent overload permissible for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period.

The required fuel in the Fuel Oil Storage Tank and DG Day Tank will supply one DG for a minimum period of 7 days assuming accident loading conditions and fuel conservation practices.

If either 2400 V bus,1 C or 1D, experiences a sustained undervoltage, the associated DG is started, the affected bus is separated from its offsite power sources, major loads are stripped from that bus and its supported buses, the DGs are connected to the bus, and ECCS or shutdown loads are started by an automatic load sequencer.

Revised 07/16/2003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.8.1-2 B 3.8.1-2 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES BACKGROUND The DGs share a common fuel oil storage and transfer system. A (continued) single buried Fuel Oil Storage Tank is used, along with an individual day tank for each DG, to maintain the required fuel oil inventory. Two fuel

transfer pumps are provided. The fuel transfer pumps are necessary for long term operation of the DGs. Testing has shown that each DG consumes about 2.6 gallons of fuel oil per minute at 2400 kW. Each day tank is required to contain at least 2500 gallons. Therefore, each fuel oil day tank contains sufficient fuel for more than 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months of full load (2500 kW) operation. Beyond that time, a fuel transfer pump is required for continued DG operation.

Either fuel transfer pump is capable of supplying either DG. However, each fuel transfer pump is not capable, with normally available switching, of being powered from either DG. DG 1-1 can power either fuel transfer pump, but DG 1-2 can only power'P-18A. The fuel oil pumps share a common fuel oil storage tank, and common piping.

Fuel transfer pump P- 8A is powered from MCC-8, which is normally connected to Bus 1D (DG 1-2) through Station Power Transformer 12 and Load Center 12. In an emergency, P-18A can be powered from Bus IC (DG 1-1) by cross connecting Load Centers 11 and 12.

Fuel transfer pump P-1 8B is powered from MCC-1, which is normally connected to Bus 1C (DG 1-1) through Station Power Transformer 19 and Load Center 19. P-18B cannot be powered, using installed equipment, from Bus 1D (DG 1-2).

APPLICABLE The safety analyses do not explicitly address AC electrical power. They SAFETY ANALYSES do, however, assume that the Engineered Safety Features (ESF) are available. The OPERABILITY of the ESF functions is supported by the AC Power Sources.

The design requirements are for each assumed safety function to be available under the following conditions:

a. The occurrence of an accident or transient,

b. The resultant consequential failures,

c. A worst case single active failure,

d. Loss of all offsite or all onsite AC power, and

e. The most reactive control rod fails to insert.

B 3.8.1-3 Revised 07/16/2003 Nuclear.Plant Palisades Nuclear. Plant B 3.8.1-3 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES APPLICABLE One proposed mechanism for the loss of off-site power is a perturbation SAFETY ANALYSES of the transmission grid because of the loss of the plant's generating (continued) capacity. A loss of off-site power as 'aresult of a generator trip can only occur during MODE 1 with the generator connected to the grid.

However, it is also assumed in analysis for some events in MODE 2, such as a control rod ejection. No'specific mechanism for initiating a loss of off-site power when the plant is not on the line is discussed in the FSAR.

In most cases, it is conservative to assume that off-site power is lost concurrent with the accident and that the single failure is that of a DG.

That would leave only one train of safeguards equipment to cope with the accident, the other being disabled by the loss of AC power. Those analyses which assume that a loss of'off-site power and failure of a single DG accompany the accident assume 11 seconds from the loss of power until the bus Is re-energized. This time includes time for all portions of the circuitry necessary for detecting the undervoltage (relays and auxiliary relays) and starting the DG. Included in the 11 seconds, the analyses also assume 10 seconds for the DG to start and connect to the bus, and additional time for the sequencer to start each safeguards load.

The same assumptions are not conservative for all accident analyses.

Wh'3n analyzing the effects of a steam or feed line break, the loss of the condensate and feedwater pumps would reduce the steam generator inventory, so a loss of off-site power is not assumed.

In MODE 5 and MODE 6, loss of off-site power can be considered as an initiating event for a loss of shutdown cooling event.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Two qualified circuits between the offsite transmission network and the onsite Class I E Electrical Power Distribution System and an independent DG for each safeguards train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence or a postulated DBA.

Revised 07116/2003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.8.1-4 B 3.8.1-4 Revised 07116/2003

AC Sources - Operating B 3.8.1 BASES LCO General Design Criterijon 17 (Ref. 1) requires, in part, that: "Electric (continued) power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions."

The qualified offsite circuits available are Safeguards Transformer 1-1 and Startup Transformer 1-2. Station Power Transformer 1-2 is not qualified as a required source for LCO 3.8.1 since it is not independent of the other two offsite circuits. This LCO does not prohibit use of Station Power Transformer to power the 2400 V safety related buses, but the two qualified sources must be OPERABLE.

Each offsite circuit must be capable of maintaining acceptable frequency and voltage, and accepting required loads during an accident, while supplying the 2400 V safety related buses.

Following a loss of offsite power, each DG must be capable of starting and connecting to its respective 2400 V bus. This will be accomplished within 10 seconds after receipt of a DG start signal. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the 2400 V safety related buses.

Proper sequencing of loads and tripping of nonessential loads are required functions for DG OPERABILITY.

APPLICABILITY The AC sources are required to be OPERABLE above MODE 5 to ensure that redundant sources of off-site and on-site AC power are available to support engineered safeguards equipment in the event of an accident or transient. The AC sources also support the equipment necessary for power operation, plant heatups and cooldowns, and shutdown operation.

The AC source requirements for MODES 5 and 6, and during movement of irradiated fuel assemblies are addressed in LCO 3.8.2, "AC Sources - Shutdown."

Palisades Nuclear Plant B 3.8.1-5 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS A.1 To ensure a highly reliable power source remains with the one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies perform," a failure of SR 3.8.1.1 acceptance criteria does not result in failure to meet this Required Action. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as "once per. . ." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per.'. ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.8.1 A.1 must be initially performed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without any SR 3.0.2 extension, subsequent performances at the "Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months " interval may utilize the 25% SR 3.0.2 extension.

A.2 According to the recommendations of Regulatory Guide (RG) 1.93 (

(Ref. 2), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class IE Distribution System.

B 3.8.1-6 Revised 07116/2003 Nuclear Plant Palisades Nuclear Palisades Plant B 3.8.1-6 Revised 07116/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single continuous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This could lead to a total of 10 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 7 days (for a total of 17 days) allowed prior to complete restoration of the LCO. The 10 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND' connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

The Completion Time allows for an exception to the normal time zero' for beginning the Completion Time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition A was entered.

B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

Revised 07/16/2003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.8.1-7 B 3.8.1-7 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS B.2 (continued)

In accordance with LCO 3.0.6, the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO for that required equipment.

Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with' redundant safety related trains. Redundant required

' feature failures consist of inoperable features within a train redundant to the train that has an inoperable DG. If the train that has an inoperable DG contains multiple features redundant to the inoperable feature in the other train, all those' multiple features must be declared inoperable. For example, if DG 1-1 and Containment Spray Pump P-54A are inoperable concurrently; Containment Spray Pumps P-54B and P-54C must both be declared inoperable. In this example, if off-site power were lost, neither P-54B nor P-54C would be available.

The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilitles.

This Completion Time also allows for an exception to the normal "time zero" for beginning the Completion rime "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on the other train is inoperable.

If at any time during the existence of this Condition (one DG inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required supporting or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for Required Action B.2. Four hours from the discovery of these events existing concurrently, is acceptable because it minimizes risk while allowing time for restoration before subjecting the plant to transients associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost.

Revised 07/16/2003 Palisades Nuclear Palisades Plant Nuclear Plant B 3.8.1-8 B 3.8.1-8 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS B.2 (continued)

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature.

Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3 provides an allowance to avoid unnecessary testing of the OPERABLE DG. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 (test starting of the OPERABLE DG) does not have to be performed. If the cause of inoperability exists on other DGs, the other DGs would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered.. Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed to not exist on the remaining DG, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior to completing Required Action B.3.1 or B.3.2 the corrective action system would normally continue to evaluate the common cause possibility.

This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B. According to Generic Letter 84-15 (Ref. 3), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable to confirm that the OPERABLE DG is not affected by the same problem as the noperable DG.

Palisades Nuclear Plant B 3.8.1-9 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS B.4 (continued)

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System for a limited period. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This could lead to a total of 10 days, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 13 days) allowed prior to complete restoration of the LCO. The 10 day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 7 day and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

C As in Required Action B.2, the Completion Time allows for an exception to the normal time zero" for beginning the allowed time "clock." This will result in establishing the time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

Palisades Nuclear Plant B 3.8.1-10 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS C.1 (continued)

In accordance with LCO 3.0.6 the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO for that required equipment.

Required Action C.1, which applies when two required offsite circuits are inoperable, is Intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that RG 1.93 (Ref. 2) recommends a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the Completion Time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature Is inoperable.

- If at any time during the existence of Condition C (two offsite circuits inoperable), a required feature becomes inoperable, this Completion Time begins to be tracked.

Palisades Nuclear Plant B 3.5.1-11

Revised 07/16/2003 Palisades Nuclear Plant B 3.8.1 -1 1 ; Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTIONS C.2 (continued)

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

This level of degradation means that the offsite electrical power system does not have the capability to accomplish a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the plant in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were Inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide the requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

- 3.-1 eisd-71--0 Palisades Nuclear Pln Palisades Nucea Plant B 3.8.1-12 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES ACTION' E.1 (continu ed)

With both DGs inoperable, there are no remaining standby AC sources.

Thus, with an assumed loss of offsite electrical power, no AC source would be available to power the minimum required ESF functions.

Since the offsite electrical power system Is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since an inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to the recommendations of RG 1.93 (Ref. 2), with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 If the inoperable AC power sources cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to an operating condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

Plant Nuclear Plant Palisades Nuclear 3.8.1-13

'BB13.8.1-13 Revised 0711612003 Palisades Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE The AC sources are designed to permit inspection and testing of all K REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 4).

Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of RG 1.9 (Ref. 5) and RG 1.137 (Ref. 6).

Where the SRs discussed herein specify voltage and frequency tolerances for the DGs operated in the "Unit" mode, the following is applicable. The minimum steady state output voltage of 2280 V is 95%

of the nominal 2400 V generator rating. This value is above the setting of the primary undervoltage relays (127-1 and 127-2) and above the minimum analyzed acceptable bus voltage. It also allows for voltage drops to motors and other equipment down through the 120 V level.

The specified maximum steady state output voltage of 2520 V is 105%

of the nominal generator rating of 2400 V. It is below the maximum voltage rating of the safeguards motors, 2530 V. The specified minimum and maximum frequencies of the DG are 59.5 Hz and 61.2 Hz, respectively. The minimum value assures that ESF pumps provide sufficient flow to meet the accident analyses. The maximum value is equal to 102% of the 60 Hz nominal frequency and is derived from the recommendations given in RG 1.9 (Ref. 5).

Higher maximum tolerances are specified for final steady state voltage and frequency following a loss of load test, because that test must be performed with the DG controls in the "Parallel" mode. Since "Parallel" mode operation introduces both voltage and speed droop, the DG final conditions will not return to the nominal "Unit" mode settings.

SR 3.8.1.1 This SR assures that the required offsite circuits are OPERABLE. Each offsite circuit must be energized from associated switchyard bus through its disconnect switch to be OPERABLE.

Since each required offsite circuit transformer has only one possible source of power, the associated switchyard bus, and since loss of voltage to either the switchyard bus or the transformer is alarmed in the control room, correct alignment and voltage may be verified by the absence of these alarms.

Revised 07/16/2003 Palisades Nuclear Plant Plant B 3.8.1-14 B 3.8.1-14 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 (continued)

REQUIREMENTS The 7 day Frequency is adequate because disconnect switch positions cannot change without operator action and because their status is displayed in the control room.

SR 3.8.1.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the plant in a safe shutdown condition.

The monthly test starting of the DG provides assurance that the DG would start and be ready for loading in the time period assumed in the safety analyses. The monthly test, however does not, and is not intended to, test all portions of the circuitry necessary for automatic starting and loading. The operation of the bus undervoltage relays and their auxiliary relays which initiate DG starting, the control relay which initiates DG breaker closure, and the'DG breaker closure itself are not verified by this test. Verification of automatic operation of these components requires de-energizing the associated 2400 V bus and cannot be done during plant operation: For this test, the 10 second timing is started when the DG receives a start signal, and ends when the DG voltage sensing relays actuate. For the purposes of SR 3.8.1.2, the DGs are manually started from standby conditions. Standby conditions for a DG mean the diesel engine is not running, its coolant and oil temperatures are being maintained consistent with manufacturer recommendations, and Ž 20 minutes have elapsed since the last DG air roll.

Three relays sense the terminal voltage on each DG. These relays, in conjunction with a load shedding relay actuated by bus undervoltage, initiate automatic closing of the DG breaker. During monthly testing, the actuation of the three voltage sensing relays is used as the timing point to determine when the DG is ready for loading.

The 31 day Frequency for performance of SR 3.8.1.2 agrees with the original licensing basis for the Palisades plant.

Palisades Nuclear Plant B 3.8.1 -15 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (

REQUIREMENTS (continued) This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads for at least 15 minutes. A minimum total run time of 60 minutes is required to stabilize engine temperatures.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The 31 day Frequency for this Surveillance is consistent with the original Palisades licensing basis.

The SR is modified by three Notes. Note 1 states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change In DG load, or a similar event, does not result in a surveillance being unnecessarily repeated. Note 2 Indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 3 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The specified level is adequate for a minimum of 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months of DG operation at full load.

The 31 day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low level alarms are provided and plant operators would be aware of any uses of the DG during this period.

Palisades Nuclear Plant B 3.8.1-16 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 REQUIREMENTS (continued) Each DG is provided with an engine overspeed trip to prevent damage to the engine. The loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. This Surveillance may be accomplished with the DG in the "Parallel" mode.

An acceptable method is to parallel the DG with the grid and load the DG to a load equal to or greater than its single largest post-accident load. The DG breaker is tripped while its voltage and frequency (or speed) are being recorded. The time, voltage, and frequency tolerances specified in this SR are derived from the recommendations of RG 1.9, Revision 3 (Ref. 5).

RG 1.9 (Ref. 5) recommends that the increase in diesel speed during the transient does not exceed 75% of the difference

-between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever Is lower. The Palisades DGs have a synchronous speed of 900 rpm and an overspeed trip setting range of 1060 to 1105 rpm. Therefore, the maximum acceptable transient frequency for this SR Is 68 Hz.

The minimum steady state voltage is specified to provide adequate margin for the switchgear and for both the 2400 and 480 V safeguards motors; the maximum steady state voltage is 2400 +10% V as recommended by RG.1.9 (Ref. 5).

The minimum acceptable frequency is specified to assure that the safeguards pu mps powered from the DG would supply adequate flow to meet the safety analyses. The maximum acceptable steady state frequency is slightly higher than the +2% (61.2 Hz) recommended by RG ,1.9 (Ref. 5) because the test must be performed with the DG controls in the Parallel mode. The increased'frequency allowance of 0.3 Hz is based on the expected speed differential associated with performance of the test while i'the Paiallel" mode.

The 18 month surveillance Frequency is consistent with the recommendation of RG 1.9 (Ref. 5).'

Palisades Nuclear Plant . B 38.1-17 -. ,- Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 REQUIREMENTS (continued) This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping' or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine and generator load response under a complete loss of load.

These acceptance criteria provide DG damage protection. The 4000 V limitation is based on generator rating of 2400/4160V and the ratings of those components (connecting cables and switchgear) which would experience the voltage transient. While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including re-connection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG-design power factor limit of 0.8, testing must be performed using a power factor

0.9. This is consistent with RG 1.9 (Ref. 5).

The 18 month Frequency is consistent with the recommendation of RG 1.9 (Ref. 5) and is intended to be consistent with expected fuel cycle lengths.

I C..,

SR 3.8.1.7 As recommended by RG 1.9 (Ref. 5) this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and re-energizing of the emergency buses and respective loads from the DG.

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those which are not disconnected from the bus by load shedding relays. They are energized when the DG breaker closes. It is not necessary to monitor each permanently connected load.

(i..

Revised 07116/2003 Palisades Nuclear Plant Palisades Nuclear Plant 8 3.8.1-18 6 3.8.1 -18 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.7 (continued)

REQUIREMENTS The DG auto-start and breaker closure time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. For this test, the 10 second timing is started when the DG receives a start signal, and ends when the DG breaker closes.

The safety analyses assume 11 seconds from the loss of power until the bus is re-energized.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads which are actuated by the Normal Shutdown Sequencer. Each load should be started to assure that the

- DG is capable of accelerating these loads at the intervals programmed for the Normal Shutdown Sequence. The sequenced pumps may be operating on recirculation flow.

The requirements to maintain steady state voltage and frequency apply to the "steady state" period after all sequenced loads have been started. This period need only be long enough to achieve and measure steady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes in

-order to demonstrate that all starting transients have decayed and stability has been achieved. -The requirement to supply permanently connected loads for 2 5 minutes, refers to the duration of the DG connection to the associated safeguards bus. It is not intended to require that sequenced loads be operated throughout the 5 minute period. It is not necessary to monitor each permanently connected load.

The requirement to verify the connection and supply of permanently and automatically connected loads is intended to demonstrate the DG loading logic. This testing may be accomplished In any series of sequential, overlapping, or total steps so that the required connection

-and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5).

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

B.3.8.119 Revised 07./_1_6.

Nuclear Plant Palisades Nuclear Palisades Plant B 3.8.1-19 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 REQUIREMENTS (continued) RG 1.9 (Ref. 5) recommends demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , Ž 120 minutes of which is at a load above its analyzed peak accident loading and the remainder of the time at a load equivalent to the continuous duty rating of the DG. SR 3.8.1.8 only requires - 100 minutes at a load above the DG analyzed peak accident loading. The 100 minutes required by the SR satisfies the intent of the recommendations of the RG, but allows some tolerance between the time requirement and the DG rating. Without this tolerance, the load would have to be reduced at precisely 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to satisfy the SR without exceeding the manufacturer's rating of the DG.

The DG starts for this Surveillance can be performed either from standby or hot conditions.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG design power factor limit of 0.8, testing must be performed using a power factor of

0.9.' The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The 18 month Frequency is consistent with the recommendations of RG 1.9 (Ref. 5).

Plan e ----------

Palisades Nuc Paliade ..

Nuclear Plant E3 3.8.1-20 Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLI MNCE SR 3.8.1.9 REQUIREM lENTS (continued As recommended by RG 1.9 (Ref. 5), this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned to ready to load status when offsite power is restored. The test is performed while the DG is supplying its associated 2400 V bus, but not necessarily carrying the sequenced accident loads. The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open, the automatic load sequencer is reset, and the DG controls are returned to Unit.'

During the period when the DG is paralleled to the grid, it must be considered inoperable. -This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5). I This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

Revised 07/16/2003 Palisades Nuclear Plant Palisades Nuclear Plant BB3.8.1-21 3.8.1-21 , Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 REQUIREMENTS (continued) If power is lost to bus 1C or I D, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs by concurrent motor starting currents. The 0.3 second load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and ensures that safety analysis assumptions regarding ESF equipment time delays are met. Logic Drawing E-17 Sheet 4 (Ref. 7) provides a summary of the automatic loading of safety related buses.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5), takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.11 In the event of a DBA coincident with a loss of offsite power, the DGs (j are required to supply the necessary power to ESF systems so that the fuel, PCS, and containment design limits are not exceeded.

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those which are not disconnected from the bus by load shedding relays. They are energized when the DG breaker closes. It is not necessary to monitor each permanently connected load. The DG auto-start and breaker closure time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. For this test, the 10 second timing is started when the DG receives a start signal, and ends when the DG breaker closes. The safety analyses assume 11 seconds from the loss of power until the bus is re-energized.

Q.

Revised 07/16/2003 Palisades Nuclear Plant Palisades Nuclear Plant B 3.8.1-22 B 3.8.1-22 Revised 07116/2003

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads which are actuated by the DBA Sequencer. Each load should be started to assure that the DG is capable of accelerating these loads at the intervals programmed for the DBA Sequence. Since the containment spray pumps do not actuate on SIS generated by Pressure Low Pressure, the test should be performed such that spray pump starting by the sequencer is also verified along with the other SIS loads. The sequenced pumps may be operating on recirculation flow or in other testing modes. The requirements to maintain steady state voltage and frequency apply to the "steady state" period after all sequenced loads have been started. This period need only be long enough to achieve and measure steady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to supply permanently connected loads for : 5 minutes, refers to the duration of the DG connection to the associated 2400 V bus. It is not ntended to require that sequenced loads be operated throughout the 5 minute period. It is not necessary to monitor each permanently connected load.

The Frequency of 18 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

Palisades Nuclear Plant Nuclear Plant B 3.5.1-23 B 3.8.1-23 Revised 0711612003 Palisades Revised 07/16/2003

AC Sources - Operating B 3.8.1 BASES REFERENCES 1. 10 CFR 50, AppendixA, GDC 17 C

2. Regulatory Guide 1.93, December 1974

3. Generic Letter 84-15, July 2, 1984

4. 10 CFR 50, Appendix A, GDC 18

5. Regulatory Guide 1.9, Rev. 3, July 1993

6. Regulatory Guide 1.137, Rev. 1, October 1979

7. Palisades Logic Drawing E-17, Sheet 4 Palisades Nuclear Plant 8 3.8.1-24 Revised 07/16/2003

ML033000111

Text

Navigation menu

Search