ML042590445

Report of Changes to Technical Specifications Bases

ML042590445
Person / Time
Site:	Palisades
Issue date:	09/02/2004
From:	Domonique Malone Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML042590445 (132)

Text

Committed to NMC NulearExee

<Palisades Nuclear Plant Operated by Nuclear Management Company, LLC September 2, 2004 Technical Specification 5.5.12.d U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Palisades Nuclear Plant Docket 50-255 License No. DPR-20 Report of Changes to Technical Specifications Bases This report is submitted in accordance with Palisades Technical Specification 5.5.12.d, which requires that changes to the Technical Specifications Bases, implemented without prior Nuclear Regulatory Commission (NRC) approval, be provided to the NRC on a frequency consistent with 10 CFR 50.71 (e). Enclosure 1 provides a listing of all bases changes since issuance of the previous report, dated October 17, 2003, and identifies the affected sections and nature of the changes. Enclosure 2 provides page change instructions and a copy of the current Technical Specifications Bases List of Effective Pages, Title Page, and the revised Technical Specification Bases sections listed in Enclosure 1.

Summary of Commitments This letter contains no new commitments and no revisions to existing commitments.

Daniel J. Malone Site Vice-President, Palisades Nuclear Plant Nuclear Management Company, LLC Enclosures (2)

CC Administrator, Region Ill, USNRC Project Manager, Palisades, USNRC Resident Inspector, Palisades, USNRC 27780 Blue Star Memorial Highway . Covert, Michigan 49043-9530 Telephone: 269.764.2000

ENCLOSURE 1 TECHNICAL SPECIFICATION BASES CHANGE CHRONOLOGY AFFECTED-DATE- -SECTION(S) -CHANGE(S)- ~ -:----

1/26/04 B 3.4.1 Clarified Bases uncertainty statement to avoid confusion after measurement uncertainty recapture power uprate.

1/26/04 B 3.3.5 Clarified 18-month interval Bases for surveillance B 3.8.1 requirement (SR) 3.3.5.2. Revised limiting condition for operation (LCO) 3.8.1 Bases to reflect addition of Covert Generating Station.

1/26/04 B 3.3.1 Make Bases consistent with Nuclear Regulatory Commission (NRC) approved amendment 214 (thermal margin/low pressure trip).

03/02/04 B 3.6.3 Incorporates NRC approved changes from Technical B 3.6.6 Specification Task Force (TSTF) TSTF-440.

07/02/04 B 3.1.5 Makes Bases consistent with SR 3.1.4.3 for control rod exercising.

07/02/04 B 3.8.1 Clarifies Bases for diesel generator continuous load rating.

07/02/04 B 3.4.13 Aligns LCO 3.4.13 Bases with LCO 3.4.15 Bases concerning Regulatory Guide and General Design Criteria.

08/06/04 B 3.2.1 Makes Bases consistent with NRC approved B 3.3.1 amendment 216 (measurement uncertainty recapture B 3.4.4 power uprate).

B 3.7.1 08/24/04 B 3.4.1 Makes Bases consistent with NRC approved amendment 217 (relocation of departure from nucleate boiling limits to the Core Operating Limits Report).

Page 1 of 1

ENCLOSURE 2 REVISED TECHNICAL SPECIFICATIONS BASES Page Change Instructions List of Effective Pages Title Page B 3.1.5, B 3.2.1, B 3.3.1, B 3.3.5, B 3.4.1, B 3.4.4, B 3.4.13, B 3.6.3, B 3.6.6, B 3.7.1, B 3.8.1 (List of Effective Pages and Bases section, pages are double-sided) 67 Pages Follow

TECHNICAL SPECIFICATIONS BASES CHANGES: September 2004 FACILITY OPERATING LICENSE DPR-20 DOCKET NO. 50-255 Page Change Instructions Revise your copy of the Palisades Technical Specifications Bases with the attached revised pages. The revised pages are identified by amendment number or revision date at the bottom of the pages and contain vertical lines in the margin indicating the areas of change.

REMOVE INSERT List of Effective Pages List of Effective Pages Title Page Title Page Section B 3.1.5 Section B 3.1.5 Section B 3.2.1 Section B 3.2.1 Section B 3.3.1 Section B 3.3.1 Section B 3.3.5 Section B 3.3.5 Section B 3.4.1 Section B 3.4.1 Section B 3.4.4 Section B 3.4.4 Section B 3.4.13 Section B 3.4.13 Section B 3.6.3 Section B 3.6.3 Section B 3.6.6 Section B 3.6.6 Section B 3.7.1 Section B 3.7.1 Section B 3.8.1 Section B 3.8.1

PALISADES TECHNICAL SPECIFICATIONS BASES 1 LIST OF EFFECTIVE PAGES COVERSHEET Title Page - 217 - Revised 08/24/04 I TABLE OF CONTENTS:

Pagei .205 Page ii ' ' 189 TECHNICAL SPECIFICATIONS BASES Bases 2.0 Pages B 2.1.1-1 -B 2.1.1-4 Revised 09/28/01 Pages B 2.1.2-1 -B 2.1.2-4 189 Bases 3.0 ,Pages B 3.0 B 3.0-15 Revised 04/04/03 Bases 3.1 Pages B 3.1.1 B 3.1.1-5 189 Pages B 3.1.2 B 3.1.2-6 Revised 09/09/03 Pages B 3.1.3-1 - B 3.1.3-4 - 189 Pages B 3.1.4-1 - B 3.1.4-13 Revised 07/30/03 Pages B 3.1.5-1 -B 3.1.5-7 Revised 07/02/04

, Pages B 3.1.6-1 - B 3.1.6-9 Revised 07/30/03 Pages B 3.1.7 B 3.1.7-6 189 'Revised 08/09/00 Bases 3.2 Pages B 3.2.1 B 3.2.1-11 Revised 08/06/04 Pages B 3.2.2 B 3.2.2-3 Revised 09/28/01.

-Pages B 3.2.3 B 3.2.3-3 Revised 09/28/01

-' Pages B 3.2.4 B 3.2.4-3 189 - Revised 08/09/00 Bases 3.3 Pages B 3.3.1-1 - B 3.3.1-35 Revised 08/06/04 Pages B 3.3.2 B 3.3.2-10 189 - Revised 02/12/01 Pages B 3.3.3 B 3.3.3-24 Revised 01/22/03

Pages B 3.3.4 B 3.3.4-12 Revised 09/09/03 Pages B 3.3.5 B 3.3.5-6 Revised 01/26/04 Pages B 3.3.6 B 3.3.6-6 189- Revised 02/12/01 Pages B 3.3.7 B 3.3.7-12 Revised 05/04/01 Pages B 3.3.8 B 3.3.8-6 189 Pages B 3.3.9 B 3.3.9-5 189 - Revised 08/09/00

- Pages B 3.3.10 B 3.3.10-4 t.  : 1. 189- I tsu -  ;

Bases 3.4 Pages B 3.4.10 B 3.4.1-4 ' Revised 08/24/04 189 I.

• Pages B 3.4.2 B 3.4.2-2 Pages B 3.4.3 B 3.4.3-7, 189 Pages B 3.4.4 B 3.4.4-4 .. . ': Revised 08/06/04

'Pages B 3.4.5 B 3.4.5-5 189 - Revised 08/09/00 Pages B 3.4.6 B 3.4.6-6 . . .

189 - Revised 02/12/01

, Pages B 3.4.7 B 3.4.7  :. ..

Revised 12/02/02

,Pages B 3.4.8 B 3.4.8-5 . . . 189 - Revised 02/12/01 Pages B 3.4.9 B 3.4.9-6 189 Pages B 3.4.10 B 3.4.10-4. t 189 Pages B 3.4.11 B 3.4.11-7; , '-: . 189- Revised 08/09/00 Pages B 3.4.12-1 -B 3.4.12-13 .

Revised 07/22/02 Pages - B 3.4.13-6  ;- Revised 07/02/04 B 3.4.13-1 * . .. :

, Pages B 3.4.14-1 - B 3.4.14-8' , .. . . .

189 - Revised 08/09/00 Pages B 3.4.15-1 - B 3.4.15-6 Revised 07/22/02 Pages B 3.4.16-1 - B 3.4.16-5 Revised 07/16/03 Revised 08/24/2004

PALISADES TECHNICAL SPECIFICATIONS BASES 2 LIST OF EFFECTIVE PAGES Bases 3.5 Pages B 3.5.1 B 3.5.1-5 189 Page B 3.5.1-6 191 Page B 3.5.1-7 189 Page B 3.5.1-8 191 Pages B 3.5.2-1 - B 3.5.2-12 Revised 04/22/2002 Pages B 3.5.3-1 - B 3.5.3-4 Revised 07/22102 Pages B 3.5.4-1 - B 3.5.4-7 Revised 04/22/2002 Pages B 3.5.5-1 - B 3.5.5-5 189 Bases 3.6 Pages B 3.6.1 B 3.6.1-4 Revised 12/10/02 Pages B 3.6.2 B 3.6.2-8 Revised 08/12/03 Pages B 3.6.3 B 3.6.3-12 Revised 03/02/04 Pages B 3.6.4-1. - B 3.6.4-3 Revised 04/27101 Pages B 3.6.5 B 3.6.5-3 Revised 09/09/03 Pages B 3.6.6 B 3.6.6-12 Revised 03/02/04 Pages B 3.6.7 B 3.6.7-6 189 - Revised 11/09/00 Bases 3.7 Pages B 3.7.1-1 -B 3.7.1-4 Revised 08/06/04 Pages B 3.7.2 B 3.7.2-6 Revised 12/02/02 Pages B 3.7.3 B 3.7.3-5 Revised 12/02/02 Pages B 3.7.4 B 3.7.4-4 189 - Revised 08/09/00 Pages B 3.7.5 B 3.7.5-9 Revised 08/01/01 Pages B 3.7.6 B 3.7.64 189 - Revised 08/09/00 Pages B 3.7.7 B 3.7.7-9 Revised 07/22/02 Pages B 3.7.8 B 3.7.8-8 Revised 08/01/01 Revised 07/16101 Pages B 3.7.9 B 3.7.9-3 Pages B 3.7.10 B 3.7.10-7 Revised 08/01/01 Pages B 3.7.11 B 3.7.11-5 189 Pages B 3.7.12 B 3.7.12-7 Revised 07/16/03 Pages B 3.7.13 B 3.7.13-3 189 - Revised 08/09/00 Pages B 3.7.14 B 3.7.14-3 Revised 09/09/03 Pages B 3.7.15 B 3.7.15-2 207 Pages B 3.7.16 B 3.7.16-3 207 Pages B 3.7.17 B 3.7.17-3 Revised 07/22/02 Bases 3.8 Pages B 3.8.1 B 3.8.1-24 Revised 07/02/04 Pages B 3.8.2 B 3.8.2-4 Revised 11/06/01 Pages B 3.8.3 B 3.8.3-7 Revised 07/22/02 Pages B 3.8.4 B 3.8.4-9 189 - Revised 08/09/00 Pages B 3.8.5 B 3.8.5-3 Revised 11/06/01 Pages B 3.8.6 B 3.8.6-6 189 - Revised 08/09/00 Pages B 3.8.7 B 3.8.7-3 189 Pages B 3.8.8 B 3.8.8-3 Revised 11/06/01 Pages B 3.8.9 B 3.8.9-7 Revised 11/06/01 Pages B 3.8.10 B 3.8.10-3 Revised 11/06/01 Bases 3.9 Pages B 3.9. 1 B 3.9.1 -4 189.- Revised 08/09/00 Pages B 3.9.2 B 3.9.2-3 189- Revised 02/12/01 Pages B 3.9.3 B 3.9.3-6 189 - Revised 08/09/00 Pages B 3.9.4 B 3.9.4-4 Revised 07122/02 Pages B 3.9.5 B 3.9.5-4 189 - Revised 02/12/01 Pages B 3.9.6 B 3.9.6-3 189 - Revised 02/27/01

(

Revised 08/24/2004

PALISADES PLANT FACILITY OPERATING LICENSE. DPR-20 APPENDIX A TECHNICAL SPECIFICATIONS BASES.

. .1 As Amended Through Amendment No. 217 Revised 08/24/2004

TV Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 B 3.1 REACTIVITY CONTROL SYSTEMS .

B 3.1.5 Shutdown and Part-Length Rod'Group Insertion Limits .

BASES BACKGROUND The insertion'limits'of the shutdown rods are initial assumptions in all safety analyses that assume full-length control rod insertion upon er-ctor trip.

The insertion limits directly affect core power distributions and assumptions of available SDM, ejected rod worth, and initial reactivity insertion rate.

The Palisades Nuclear Plant design criteria (Ref. 1) and 1 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors," contain the applicable criteria for these reactivity and power distribution design requirements. Limits on shutdown rod insertion have been established, and all'rod positions are monitored and controlled during power operation to ensure that the reactivity limits, ejected rod worth, and SDM limits are preserved. '

The shutdown rods are arranged into groups that are r1dially symmetric.

-Therefore, movement of the shutdown rod groups does not introduce radial asymmetries in the core power distribution. The shutdown and regulating

- rod groups provide the required reactivity worth for immediate reactor shutdown upon a reactor trip..

The Palisades Nuclear Plant has four part-length control rods Installed.

The part-length rods are required to remain completely withdrawn during power operation. The part-length rods do not insert on a reactor trip.

The design calculations are performed with the assumption that thIe shutdown rod groups are withdrawn prior to the regulatipg rod groups. The shutdown rods can be fully withdrawn without the core oing critical. This provides available negative reactivity for SDM in the event of boration errors. All control rod groups are controlled manually by the control room operator. During normal plant operation, the shutdownirod groups are fully withdrawn. The shutdown rod groups must be completely withdrawn from the core prior to withdrawing any regulating rods during an approach to criticality. The shutdown rod groups are then left in this position until the reactor is shut down.

They affect core power, burnup distribution, and add negative reactivity to shut down the reactor upon receipt of a reactor trip signal.

Palisades Nuclear Plant B 3.1.5-1  ; Revised 07/0212004

Shutdown and Part-Length Rod Group Insertion Limits B3.1.5 BASES APPLICABLE Accident analysis assumes that the shutdown rod groups are fully SAFETY ANALYSES withdrawn any time the reactor is critical. This ensures that:

a. The minimum SDM is maintained; and

b. The potential effects of a control rod ejection accident are limited to acceptable limits.

Control rods are considered fully withdrawn at 128 inches, since this position places them in an insignificant reactivity worth region of the integral worth curve for each bank.

On a reactor trip, all full-length control rods (shutdown and regulating),

except the most reactive rod, are assumed to insert into the core. The shutdown and regulating rod groups shall be at or above their insertion limits and available to insert the required amount of negative reactivity on a reactor trip signal. The regulating rods may be partially inserted in the core as allowed by LCO 3.1.6, "Regulating Rod Group Position Limits." The shutdown rod group insertion limit is established to ensure that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN (SDM)) following a reactor trip from full power.

The combination of regulating rod and shutdown rods (less the most reactive rod, which is assumed to remain fully withdrawn) is sufficient to take the reactor from full power conditions at rated temperature to zero power, and to maintain the required SDM at rated no load temperature (Ref. 2). The shutdown rod group insertion limit also limits the reactivity worth of an ejected shutdown rod.

The acceptance criteria for addressing shutdown rods as well as regulating rod insertion limits and inoperability or misalignment are that:

a. There be no violation of:

1.: Specified acceptable fuel design limits, or 2.. Primary Coolant System pressure boundary damage; and

b. The core remains subcritical after accident transients.

. (

Palisades Nuclear Plant B 3.1 .5-2 Revised 07/02/2004

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES APPLICABLE. As such, the shutdown and part-length rod group insertion limits affect SAFETY ANAiYSES safety analyses involving core reactivity, ejected rod worth, and SDM (continued) (Ref. 2). The part-length control rods have the potential to cause power distribution envelopes to be exceeded ifinserted while the reactor is critical. Therefore, they must remain withdrawn in accordance with the limits of the LCO (Ref. 3). .

- The shutdown and part-length rod group insertion limits satisfy

• Criterion 2 of .10 CFR 50.36(c)(2).

S . -.. ,. . .. .4 . . . ..- ..

LCO -The shutdown and part-length rod groups must be within their insertion llimits any time the reactor is critical or.approaching criticality. For a control rod group to be considered above its insertion limit, all

'OPERABLE rods in that group, which are not misaligned, must be above the insertion limit (inoperable and misaligned rods are addressed by LCO 3.1.4). Maintaining the shutdown rod groups within their insertion limits ensures that a sufficient amount of negative reactivity is available to shut down the reactor and maintain the required SDM following a reactor trip. Maintaining the part-length rcd group within its

-insertion limit ensures that the power distribution envelope is maintained. ,, .

APPLICABILITY The shutdown and part-length rod groups must be'within their insertion limits, with the reactor in-MODES i and 2. In MODE 2 the Applicability begins anytime any regulating rod is withdrawn above 5 inches. This ensures that a sufficient aimount of negative reactivity is available to shut down the reactor and maintain the required SDM following a

.: - reactor trip; In MODEA4, 5,or 6, the shutdown rod groupis are inserted in the core to at least the lowernelectrical limit and contribute to the SDM. In MODE 3 the shutdown rod groups may be withdrawn in preparation of a reactor startup;. Refer to LCO 3.1.1, "SHUTDOWN MARGIN (SDM),. for SDM requirements in MODES A, 4, and 5.

LCO 3.9.1, "Boron Concenitration," ensures adequate SDM in MODE 6.

The Applicability has beerinmodified by a Note indicating the LCO requirement is suspended during SR 3.1.4.3 (rod exercise test). Control rod exercising verifies the freedom of the rods to move, and requires the individual shutdown rods to move below the LCO limits for their group.

Only the full-length rods are required to be tested by SR 3.1.4.3. The part-length rods may also be moved however, if a part-length rod is moved below the limit of the associated LCO, the Required Actions of Conditio A

• .: st be taken. Positioning of an individual control rod within its group is addressed by LCO 3.1.4, "Control Rod Alignment."

Palisades Nuclear Plant Paisde Pln Nu.a B 3..-eied0/220 Revised 07/02/2004 3.1.5-3 .I oB

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES ACTIONS LCOs 3.1.4, 3.1.5, and 3.1.6, and their ACTIONS were written to support each other. The combined intent is to assure the following:

1. There is adequate SDM available in withdrawn control rods to assure the reactor is shutdown by, and remains shutdown following, a reactor trip,

2. The control rod positioning does not cause unacceptable axial or radial flux peaking, and

3. The programmed rod withdrawal sequence and group overlap result in reactivity insertion rat6es"ithin the assumptiors of the .

Inadvertent Control Rod Bank Withdrawal Analyses.

The ACTIONS for rods that are mispositioned (misaligned or inserted beyond the limit) were written assuming that an OPERABLE rod discovered to be mispositioned would simply be re-positioned correctly.

While the associated Conditions would have to be entered, the rod could be re-positioned (thus exiting the LCO) without taking any other Required Action. A rod that remains' mispositioned was assumed to be inoperable. The analyses account for operation with one (and only one) mispositioned rod (a dropped rod being the limiting case). With more than one mispositioned rod, the plant would be outside the bounds of the analyses and must be shutdown.

If a rod is discovered to be misaligned (ie, there is more than 8 inches between it and any other rod in its group, but all remaining rods in that group are within 8 inches of each other) Condition 3.1.4 C allows 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore the rod alignment (thus exiting the LCO), perform SR 3.2.2.1 (verification that radial peaking is within limits), or reduce power to < 75% RTP.

If one or more shutdown rods are inserted beyond the insertion limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 D (when one rod is im rmovable but trippable) or Condition 3.1.4 E (when a movable rod is inserted beyond its insertion limit, or when more than one rod is inoperable for any reason) must be entered.

If the rods can be moved, they should be withdrawn and all Conditions exited.

If one rod cannot be moved (but is still considered trippable),

operation may continue in accordance with Condition 3.1.4 D (and 3.1.4 C if it is misaligned).

Revised 07/02/2004 Palisades Nuclear Palisades Plant Nuclear Plant B 3.1.5-4 B 3.1 .5-4 Revised 07/02/2004

1

Shutdown and Part-Length Rod Group insertion Limits B 3.1.5 BASES ACTIONS If more than one rod cannot be moved, Condition 3.1.4 E must also, (continued) be entered: The plant must be in'MODE 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in accordance' with ACTION 3.1.4 E.1.

If one or more part-length rods are inserted beyond the' limit, Condition 3.1.5 A is entered; the rods are declared inoperable and Condition 3.1.4 E is entered (and 3.1.4 C if it is misaligned). Condition 3.1.4 D is not applicable to part-length rods since it only addresses full-length rods. .~~ .

I

. I 4

. ..-. If the rods can be moved,.they.should be.withdrawn and all.. ._

I I

. F.

Conditions exited.'-'

-If any part-length rods are inserted beyond the limit and cannot be

- moved, the plant must be placed in MODE 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in accordance with ACTION 3.1.4 E.1.

If one or more' OPERABLE regulating rods are inserted beyond the limit, Condition 3.1.6 A is entered;.

1. ~~, . : , '.1 The rods must be restored to within limits (by rod withdrawal or power reduction) within two hours. '

If a rod cannot be moved, it mrnst be considered inoperable and Condition 3.1.4'D must be entered (and 3.1.4 C if it is misaligned).

Condition 3.1.4 D allows continued operation with one inoperable, but trippable, rod until the vextreactor shutdown (MODE 3 entry). If more than one rod cannot be mioted, Condition 3.1.4 E must be entered.

The plant must be in MODE 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in accordance with ACTION 314E. ';"':' - . - -'.

The analyses do not account for the possibility of mcJre then one rod failing to insert on a trip. While boron concentration might be adjusted portion

, to of the restore I core'could remain excessively SuTW MARGhItN, o fifi twoadacnt' reactive.

osfiSince the onetta analyses must assume that one rod fails to insert, operation may not continue with a known untripp ble rod. A shutdown would be required by Condition 3.1.4 E.'

R i- 07/02/2004 Palisades Nuclear Plant B 3.1.5-5 _: - Revised

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES ACTIONS A.1 (continued)

Prior to entering this condition, the shutdown and part-length rod groups were fully withdrawn. If a shutdown.rod group is then inserted into the core, its potential negative reactivity is added to the core as it is inserted.

If one or more shutdown or part-length rods are not within limits, the affected rod(s) must be declared inoperable and the applicable Conditions and Required Actions of LCO 3.1.4 entered immediately.

This Required Action is based on the recognition that the shutdown and part-length rods are normally withdi`6wn beyohd their'ihisertiori iliits and are capable of being moved by their control rod drive mechanism.

Although the requirements of this LCO are not applicable during performance of the control rod exercise test, the inability to restore a control rod to within the limits of the LCO following rod exercising would be indicative of a problem affecting the OPERABILITY of the control rod. Therefore, entering the applicable Conditions and Required Actions of LCO 3.1.4 is appropriate since they provide the applicable compensatory measures commensurate with the inoperability of the control rod.

B.1 When Required Action A.1 cannot be met or completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

3.1.5-6 Revised 07/02/2004 Nuclear Plant Palisades Nuclear Plant BB 3.1 .5-6 Revised 07102/2004

Shutdown and Part-Length Rod Group Insertion Limits B 3.1.5 BASES SURVEILLANCE SR 3.1.5.1, REQUIREMENTS S Verification that the shutdown and part-length rod groups are within their insertion limits prior to an approach to criticality ensures that when the reactor is critical, or being taken crifical, the shutdoWn rods will be available to shut down the reactor, and the required SDM will be maintained following a reactor trip. Verification that the part-length rod groups are within their insertion limits ensures that they do not adversely affect power distribution requirements. This SR and Frequency ensure that the shutdown and part-length rod groups are withdrawn before the regulating rods.,are.withdrawn duringga plarnt ..

startup.

Since control rod groups are positioned nianually by the control room operator, verification of shutdown and part-length rod group position at' a'Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is adequate to ensure that the shutdown and part-length rod groups are within their insertion limits. Also, the 12-hour Frequency takes into account other information availablefo the operator in the control room for the purpose of monitoring the status of th6 shutdown and part-ength rod groups. I REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.2

3. FSAR, Section 14.6 i .. .

Palisades Nuclear Plant B 3.1 .5-7 Revised 07/02/2004

LHR B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Linear Heat Rate (LHR) - -, .

BASES BACKGROUND The purpose of this LCO is to limit the core power distribution to the initial values assumed in the accident analyses. Operation within the limits imposed by this LCO either limits or prevents potential fuel cladding failures that could breach the primary fission product barrier and release fission products to the primary coolant in the event of a

'Loss Of Coolant Accident (LOCA),' loss of flow accident, ejected control rod accident, or other postulated accident requiring termination by a Reactor Protection System trip function. This LCO limits the amount of

-damage to the fuel cladding during an accident by ensuring that the

..plant is operating within acceptable bounding conditions at the onset of a transient.

-Methods of controlling the power distribution include:

a. Using control rods to alter the axial power distribution;

b. Decreasing control rod insertion by boration, thereby improving the radial power distribution; and

- c.- Correcting off optimum conditions (e.g., a control rod drop or misoperation of the plant) that cause margin degradations.

The core power distribution is controlled so that, in conjunction with

'other core operating parameters (e.g., control rod insertion and

alignment limits), the power'distribution satisfies this LCO. The limiting safety system settings and this LCO are based on the accident analyses (Refs. 1,and 2), so that specified acceptable fuel design limits are not exceeded as a result of Anticipated Operational Occurrences (AOOs), and the limits of acceptable consequences are not exceeded for other postulated accidents.

Limiting power distribution changes over time also minimizes the xenon distribution changes, which is a significant factor in controlling the axial power distribution.

Power distribution is a product of multiple parameters, various combinations of which may produce acceptable power distributions.

PaiadsNcla latB3..-1Rvse 80620 Palisades Nuclear Plant B 3.2.1 -1 Revised 08/06/2004

LHR B 3.2.1 BASES BACKGROUND The limits on LHR, TOTAL RADIAL PEAKING FACTOR (FRT),

(continued) QUADRANT POWER TILT (Tq), and AXIAL SHAPE INDEX (ASI),

which are obtained directly from the core reload analysis, ensure compliance with the safety limits on LHR and Departure from Nucleate Boiling Ratio (DNBR).

Either of the two core power distribution monitoring systems, the Incore Alarm portion of the Incore Monitoring System or the Excore Monitoring System, provides adequate monitoring of the core power distribution and is capable of verifying that the LHR is within its limits. The Incore Alarm System performs this function by continuously monitoring the local power at many points throughout the core and comparing the measurements to predetermined setpoints above which the limit on LHR could be exceeded. The Excore Monitoring System performs this function by providing comparison of the measured core ASI with predetermined ASI limits based on incore measurements. An Excore Monitoring System Allowable Power Level (APL), which may be less than RATED THERMAL POWER, and an additional restriction on Tq, are applied when using the Excore Monitoring System to ensure that the ASI limits adequately restrict the LHR to less than the limiting values.

In conjunction with the use of the Excore Monitoring System for monitoring LHR and in establishing ASI limits, the following assumptions are made:

a. The control rod insertion limits of LCO 3.1.5, "Shutdown and Part-Length Rod Group Insertion Limits," and LCO 3.1.6, "Regulating Rod Group Position Limits," are satisfied;

b. The additional Tq restriction of SR 3.2.1.6 is satisfied; and Ti

c. FRT, does not exceed the limits of LCO 3.2.2.

The limitations on the TOTAL RADIAL PEAKING FACTOR provided in the COLR ensure that the assumptions used in the analysis for establishing the LHR limits and Limiting Safety System Settings (LSSS) remain valid during operation at the various allowable control rod group insertion limits.

Revised 08/06/2004 Palisades Nuclear Palisades Plant Nuclear Plant B 3.2.1-2 B 3.2.1-2 Revised 08/06/2004

LHR B 3.2.1 BASES BACKGROUND,- The Incore Monitoring System continuously provides a direct indication (continued) of the core power distribution. It also provides alarms that have been established for the individual incore detector segments, ensuring that the peak LHRs are maintained within the limits specified in the COLR.

The setpoints for these alarms include tolerances, set in conservative directions, for:

- 'a. A measurement calculational uncertainty factor (as identified in the COLR);

b. An engineering uncertainty factor of 1.03; and

c. -A THERMAL POWER measurement uncertainty factor of 1.006 of 2565.4 MWt. I The measurement uncertainties associated with LHR and FRT are based on a statistical analysis performed on power distribution benchmarking results. The COLR includes the applicable measurement uncertainties for incore detector usage. The engineering and THERMAL POWER uncertaintiesare incorporated in the power distribution calculation performed by the fuel vendor.

The excore power distribution monitoring system consists of Power Range Channels 5 through 8. The power range channels monitor neutron flux from 0 to 125 percent full power. They are arranged symmetrically around the reactor core to provide information on the radial and axial flux distributions.

-' - 'The power range detector, assembly'consists of two uncompensated ion chambers for each channel. One detector extends axially along the

-lower half of the core whilethe ,other, 'which is located directly above it, monitors flux from the upper half of the core. The DC current signal from each of the ion chambers is fed directly to the control room drawer assembly without pre-amplification' Each excore detector supplies data

. - to a Thermal Margin Monitor (TMM). Each TMM uses these excore signals to calculate Axial Shape Index (ASI) on a-ontinuous basis.

- ~~* .*. .*

'.X

- -ASI can be defined as' ,the compensated ratio of power developed in the upper and lower sections of the core. ..The TMM takes the excore detector signals and develops a power ratio (YE) that describes the distribution of neutron flux developed in the core by the formula:

YE =(L - U)I(L + U) -

Where L is the lower excore segment flux, and U is the upper excore

'segment flux.

Palisades Nuclear-Plant IB 3.2.1 - Revised 08/06/2004

LHR B 3.2.1 BASES BACKGROUND The excore detectors which are located within the concrete biological (continued) shield of the reactor must be compensated for the phenomenon of shape annealing. Shape annealing factors are developed to correct the excore readings for neutron attenuation from the core periphery to the excore detector locations. This accounts for any material that would cause neutron attenuation within the detector path such as: concrete, structural steel and so forth. This allows the excore detectors to represent an accurate measurement of the core power distribution.

Shape annealing has been found to be a linear relationship which can be correlated to the Axial Offset (AO) as determined by an Incore Detector System to the raw readings seen by the excore detectors.

Reactor Engineering has developed shape annealing factors for each individual Excore detector. The TMM uses the above calculated power ratio and the appropriate shape annealing factor to determine the ASI value for an individual excore detector channel.

APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY ANALYSES operation (Condition 1) or AOOs (Condition 2) (Ref. 3). The power distribution and control rod insertion and alignment LCOs preclude core power distributions that violate the following fuel design criteria: (.

a. During a LOCA, peak cladding temperature must not exceed 2200 0F (Ref. 4);

b. During a loss of flow accident, there must be at least 95%

probability at the 95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the core does not experience a DNB condition (Ref. 3).

c. During an ejected rod accident, the fission energy input to the fuel must not exceed 280 callgm; and

d. The full-length control rods must be capable of shutting down the reactor with a minimum required SDM with the highest worth control rod stuck fully withdrawn (Ref. 3).

The power density at any point in the core must be limited to maintain the fuel design criteria (Ref. 4). This is accomplished by maintaining the power distribution and primary coolant conditions so that the peak LHR and DNB parameters are within operating limits supported by accident analyses (Ref. 1), with due regard for the correlations between measured quantities, the power distribution, and uncertainties in determining the power distribution.

Revised 08/06/2004 Plant Nuclear Plant Palisades Nuclear B 3.2.1-4 B 3.2.1-4 Revised 08/06/2004

LHR B 3.2.1 BASES APPLICABLE  : Fuel cladding failure during a LOCA is limited by restricting the SAFETY ANALYSES maximum linear heat generation rate so that the peak cladding (continued) temperature does not exceed 22001F (Ref. 4). High peak cladding temperatures are assumed to cause severe cladding failure by oxidation due to a Zircaloy water. reaction.

' The LCOs governing LHR, ASI, and the Primary Coolant System Operation ensure that these criteria are met as long as the core is operated within the LHR, ASI, FRT, and Tq limits. The latter are process variables that characterize the three dimensional power distribution of.

the reactor core. Operation within the limits for these variables ensures that their actual values are within.the ranges used in the accident analyses.

Fuel cladding damage does not necessarily occur while the plant is operating at conditions outside the limits of these LCOs during normal operation. Fuel cladding damage could result, however, if an accident occurs from initial conditions outside the limits of these LCOs. The potential for fuel cladding damage exists because changes in the power distribution can cause increased power peaking and can correspondingly increase local LHR.

The Incore Monitoring System provides fort monitoring of LHR, FRT, and QUADRANT POWER TILT to ensure that fuel design conditions and safety analysis assumptions are maintained. The Incore Monitoring System is also utilized to determine the target AXIAL OFFSET (AO) and to determine the Allowable Power Level (APL) when using the excore

-  ;'. detectors.' , .

The Excore Monitoring Systemi provides for monitoring of ASI and

-- QUADRANT POWER TILT to ensurethat fuel design conditions and safety analysis assumptionsare maintained.

--LHR satisfies Criterion 2 of 10 CFR 50.36(c)(2).--

LCO The'povwer distribution LCO Emits are based on correlations between power'peaking and certain' measured variables used as inputs to the LHR and DNBR operating limits. The power distribution LCO limits, except Tq, areprovided in the COLR. -The limitation on the LHR in the

' p'eak p6wer fuel rod at the peak power-elevation Z ensures that, in the event of a LOCA, the peak temperature of the fuel cladding does not exce6d 22001F. ' i' Revised .08/0612004 Nuclear Plant Palisades Nuclear Plant B 3.2.1-5 B 3.2. 1;-5 ': . Revised 08/06/2004

X LHR B 3.2.1 BASES LCO The LCO requires that LHR be maintained within the limits specified in (continued) the COLR and either the Incore Alarm System or Excore Monitoring System be OPERABLE to monitor LHR. When using the Incore Alarm System, the LHR is not considered to be out of limits until there are four or more incore detectors simultaneously in alarm. When using the Excore Monitoring System, LHR is considered within limits when the conditions are acceptable for use of the Excore Monitoring System and the associated ASI and Tq limits specified in the SRs are met.

To be considered OPERABLE, the Incore Alarm System must have at least 90 of the 180 incore detectors OPERABLE and 2 incore detectors per axial level per core quadrant OPERABLE. In addition, the plant process computer must be OPERABLE and the required alarm setpoints entered into the plant computer. Only 36 of the 45 instrument locations are included in the Incore Alarm System Uncertainty Analysis (180 of the possible 215 detectors). Instrument locations 1, 4, 13, 34, 41, 42 and 45 are not included, and instrument locations 7 and 44 are used by the Reactor Vessel Level Monitoring System (RVLMS).

To be considered OPERABLE, the Excore Monitoring System must have been calibrated with OPERABLE incore detectors, the ASI must not have been out of limits for the last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and THERMAL POWER must be less than the APL.

(

APPLICABILITY In MODE 1 with THERMAL POWER > 25% RTP, power distribution must be maintained within the limits assumed in the accident analysis to ensure that fuel damage does not result following an AOO. In MODE 1 with THERMAL POWER

• 25% RTP, and in other MODES, this LCO does not apply because there is not sufficient THERMAL POWER to require a limit on the core power distribution, and because ample thermal margin exists to ensure that the fuel integrity is not jeopardized and safety analysis assumptions remain valid.

ACTIONS A.1 There are three acceptable methods for verifying that LHR is within limits. The LCO requires monitoring by either an OPERABLE Incore Alarm System or an OPERABLE Excore Monitoring System. When both of the required systems are inoperable, Condition B allows for monitoring by taking manual readings of the incore detectors. Any of these three methods may indicate that the LHR is not within limits. With the LHR exceeding its limit, excessive fuel damage could occur following an accident. In this Condition, prompt action must be taken to restore the LHR to within the specified limits. One hour to restore the LHR to within its specified limits is reasonable and ensures that the core does not continue to operate in this Condition. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Palisades Nuclear Plant B 3.2.1-6 Revised 08/06/2004

LHR B 3.2.1 BASES ACTIONIS A.1 (Contir III fi

'Completion Time also allows the operator sufficient time for evaluating core conditions and for initiating proper corrective actions.

ACTION IS' B.1 and B.2 (contin,ued)'

,With the Incore Alarm System inoperable for monitoring LHR and the Excore Monitoring System inoperable for monitoring LHR, THERMAL POWER must be reduced to 5 85% RTP within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Operation at

< 85% RTP ensures that ample thermal margin is maintained. A 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time is'adequate to achieve the required plant condition without challenging plant systems. Additionally, with the Incore Alarm and Excore Monitoring Systems inoperable, LHR must be verified to be within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and every 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> thereafter by manually collecting incore detector readings at the terminal blocks in the control room utilizing a suitable signal detector. The manual readings shall be taken'on a minimum of 10 individual detectors per quadrant (to include a total of 90 detectors in a 10 hour1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> period). The time interval of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and the minimum of 10 d6tectors per quadrant are'sufficient to maintain adequate surveillance of the power distribution to detect significant changes until the monitoring systems are returned to' service.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as 'once per. ." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. .. basis. The 25% extension applies'to each performaince of the Required Action after the initial performanrce.. Therefore', while Required Action 3.2.1 B.2 must be initially performed within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> without any SR 3.0.2 extension, subsequent performances at the "Once per 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />" interval may utilize the 25%'SR 3.0.2 extension.' ' ' -

C.1 If the Required Action and associated Completion Time are not met,'

' THERMAL POWER must be reduced to < 25% RTP. This reduced

-power level ensures that the core is operating within its thermal limits

'

• and places the core in a conservative condition. -The allowed

• '. ;Completion Time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is reasonable, based on operating experience, to reach *25% RPT from full power MODE I conditions in an orderly manner and without challenging plant systems.

eNula.ln ..- 7 PalisadesPai-Nuclear

-Rvsd0/620 Plant 'B 3.2.1 Revised 08/06/2004

LHR B 3.2.1 BASES SURVEILLANCE SR 3.2.1.1 REQUIREMENTS The Incore Alarm portion of the Incore Monitoring System provides continuous monitoring of LHR through the plant computer. The PIDAL computer program is used to generate alarm setpoints for the plant computer that are based on measured margin to allowed LHR. As the incore detectors are read by the plant computer, they are continuously compared to the alarm setpoints. If the Incore Alarm System LHR monitoring function is inoperable, excore detectors or manual recordings of the incore detector readings may be used to monitor LHR.

Periodically monitoring LHR ensures that the assumptions made in the Safety Analysis are maintained. This SR is modified by a Note that states that the SR is only required to be met when the Incore Alarm System is being used to monitor LHR. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is consistent with an SR which is to be performed each shift.

SR 3.2.1.2 Continuous monitoring of the LHR is provided by the Incore Alarm System which provides adequate monitoring of the core power distribution and is capable of verifying that the LHR does not exceed its specified limits.

Performance of this SR verifies the Incore Alarm System can accurately monitor LHR by ensuring the alarm setpoints are based on a measured power distribution. Therefore, they are only applicable when the Incore Alarm System is being used to determine the LHR.

The alarm setpoints must be initially adjusted following each fuel loading prior to operation above 50% RTP, and periodically adjusted every 31 Effective Full Power Days (EFPD) thereafter. A 31 EFPD Frequency is consistent with the historical testing frequency of the reactor monitoring system. The SR is modified by a Note which requires the SR to be met only when the Incore Alarm System is being used to determine LHR.

Pln B 3.2.- Reie 08/06/2004 Palisades Nula Paliade Nuclear Plant B 3.2.1-8 Revised 08/06/2004

LHR B 3.2.1 BASES.

SURVEILLANCE SR 3.2.1.3 REQUIREMENTS (continued) SR 3.2.1.3 requires, prior to initial use of the excore LHR monitoring function, verification that the absolute difference of the measured ASI and the target ASI has been

• 0.05 for each OPERABLE channel for the last 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> using the previous 24 hourly recorded values.

Performance of this SR verifies that plant conditions are acceptable for the Excore Monitoring System to accurately monitor the LHR (Ref. 5);

The prior to initial use verification identifies that there have been no significant power distribution anomalies while using other monitoring methods, e.g., the incore detectors, which may affected the ability of the excore detectors to monitor LHR..

The SR is modified by a Note that states that the SR is only required to be met when the Excore Monitoring System is being used to monitor LHR. Failure of this SR prevents the Excore Monitoring System from being considered OPERABLE for monitoring of LHR.

SR 3.2.1.4 SR 3.2.1.4 requires verification that THERMAL POWER is less than or equal to the Allowable Power Level (APL) which is limited to not more than 10% greater than the THERMAL POWER at which the APL was llast determined. Performance of this SR also verifies that plant conditions are acceptable for the Excore Monitoring System to accurately monitor the LHR (Ref. 5). The .1hour Frequency is based on engineering judgement and the need to assure that conditions remain acceptable for use of the Excore Monitoring System to monitor LHR.

. . .- 2 ,-  ; ,

p...... ; . , . . , ,

The SR is modified by a Note that states that the SR is only required to be met when the Excore Monitoring System is being used to monitor LHR. Failure of this SR prevents the Excore Monitoring System from

- -. . being considered OPERABLE for monitoring of LHR.

Plant Nuclear Plant B 3.2.1-9 Revised 08/06/2004 Palisades Nuclear B 3.2.1-9:_ . Revised 08/06/2004

LHR B 3.2.1 BASES SURVEILLANCE SR 3.2.1.5 REQUIREMENTS (continued) SR 3.2.1.5 requires verification that the absolute difference of the measured ASI and the target ASI is < 0.05 every hour. This must be verified on at least 3 of the 4, 2 of the 3, or 2 of the 2 OPERABLE channels, whichever is the applicable case. However, any otherwise OPERABLE channel which indicates an absolute difference of > 0.05 must be considered out of limits. Performance of this SR verifies that plant conditions are acceptable for the Excore Monitoring System to be used to assure LHR is within limits (Ref. 5). The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Frequency is appropriate because the excore detectors input neutron flux information into the ASI calculation which is normally performed automatically and continuously.

The SR is modified by a Note that states that the SR is only required to be met when the Excore Monitoring System is being used to monitor LHR. Failure of this SR (when using an OPERABLE Excore Monitoring System) is a failure to verify that LHR is within limits and is therefore considered a failure to meet the LCO due to LHR not within limits as determined by the Excore Monitoring System.

SR 3.2.1.6

(

SR 3.2.1.6 requires verification that the QUADRANT POWER TILT is

< 0.03. Performance of this SR also verifies that plant conditions are acceptable for the Excore Monitoring System to be used to assure LHR is within limits (Ref. 5). The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Frequency is based on engineering judgement and the need to identify adverse trends in these parameters prior to their affecting the ability of the Excore Monitoring System to monitor LHR.

The SR is modified by a Note that states that the SR is only required to be met when the Excore Monitoring System is being used to monitor LHR. Failure of this SR (when using an OPERABLE Excore Monitoring System) is a failure to verify that LHR is within limits and is therefore considered a failure to meet the LCO due to LHR not within limits as determined by the Excore Monitoring System.

Revised 08/06/2004 Palisades Nuclear Plant Nuclear Plant B 3.2.1-10 B 3.2.1-10 Revised 08/06/2004

LHR B 3.2.1 BASES REFERENCES 1. FSAR, Chapter 14

2. - FSAR, Chapter 6

3. FSAR, Section 5.1

4. 10 CFR 50.46

5. Safety Evaluation Report for Palisades Nuclear Plant Operating License Amendment No. 68, Section 4, dated December 8, 1981 I

Palisades Nuclear Plant .B 3.2.1 -11 Revised 08/06/2004

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation *?

1 . - .

- I i .  : .

BASES '

BACKGROUND The RPS initiates a reactor trip to protect against violating the acceptable fuel design limits and breaching the reactor coolant pressure boundary during Anticipated Operational Occurrences (AOOs). (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.") By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operation of the reactor.' This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RPS,'as'well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are .those events expected to occur one or more times'during the 'plant life, the acceptable limits are:

• The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

' ' Fuel centerline melting shall not occur; and

• The Primary Coolant System (PCS) 'pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 50 (Ref.'1) and 10 CFR 100 (Ref. 2)'criteria during AOOs.

Palisades Nuclear Plant B 3.3.1-1 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Accidents are events that are analyzed even though they are not (continued) expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS is segmented into four interconnected modules. These modules are:

• Measurement channels;

• RPS trip units;

• Matrix Logic; and

• Trip Initiation Logic.

This LCO addresses measurement channels and RPS trip units. It also addresses the automatic bypass removal feature for those trips with Zero Power Mode bypasses. The RPS Logic and Trip Initiation Logic are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Logic and Trip Initiation." The role of the measurement channels, RPS trip units, and RPS Bypasses is discussed below.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

With the exception of Hi Startup Rate, which employs two instrument channels, and Loss of Load, which employs a single pressure sensor, four identical measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated channels A through D.

Some measurement channels provide input to more than one RPS trip unit within the same RPS; channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features (ESF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1-2 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND IvIraOuI

'ne.,

rnme x:1 l Iui

~

nnf IL 'w1 icai II ItI r- rrf~ii~

YLa~J mal1imI Iur,-; .

(continued)

In the case of Hi Startup Rate'and Loss of Load, where fewer than four sensor channels are employed, the reactor trips provided are not relied upon by the plant safety analyses. The sensor channels do however, provide trip input signals to all four RPS channels.

When a channel monitoring a parameter exceeds a predetermined setpoint, indicating an abnormal condition, the bistable monitoring the parameter in that channel will trip. Tripping two or more channels of bistable trip units monitoring the same parameter de-energizes Matrix Logic, (addressed by LCO 3.3.2) which in turn de-energizes the Trip Initiation Logic. This causes all f6ur'DC clutch power supplies to

• de-energize, interrupting power to the control rod drive mechanism clutches, allowing the full length control rods to insert into the core.

For those trips relied upon in the safety analyses, three of the four measurement and trip unit channels can meet the redundancy and testability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LCO requires, however, that four channels be OPERABLE. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip channel bypassed) for maintenance or testing while still maintaining a'minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation, this arrangement meets the requirements of IEEE Standard 279-1971 (Ref. 3). '

.Most of the RPS trips aregenerated by comparing'a single

. measurement to a fixed bistable'setpoint. Two trip Functions, Variable

. .High Power Trip and Thermal Margin Low Pressure Trip, make use of more' than one measurement to provide a trip.-

. The required RPS Trip Furictions utilize the following input

' instrumentation: . -

• Variable High Power TriD (VH PT)

The VHPT uses Q Power as its input. Q Power is the higher of NI

power'from the powerlranige NI drawer and primary calorimetric power (AT power) based on PCS hot leg and'cold leg temperatures.' The measurement channels associated with the VHPT are the power range excore channels, and the PCS hot and cold leg temperature channels.

Palisades Nuclear Plant B 3.3.1-3 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

• Variable High Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signal processing necessary to calculate the TMILP trip setpoint, VHPT trip setpoint and trip comparison, and Q Power calculation. On power decreases the VHPT setpoint tracks power levels downward so that it is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point it increases to the new setpoint, a fixed increment above Q Power at the time of reset, subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

• High Startup Rate Trip The High Startup Rate trip uses the wide range Nuclear Instruments (Nis) to provide an input signal. There are only two (

wide range NI channels. The wide range channel signal processing electronics are physically mounted in RPS cabinet channels C (N1-1/3) and D (Nl-2/4). Separate bistable trip units mounted within the NI-1/3 wide range channel drawer supply High Startup Rate trip signals to RPS channels A and C. Separate bistable trip units mounted within the NI-2/4 wide range channel drawer provide High Startup Rate trip signals to RPS channels B and D.

• Low Primary Coolant Flow Trip The Low Primary Coolant Flow Trip utilizes 16 flow measurement channels which monitor the differential pressure across the primary side of the steam generators. Each RPS channel, A, B, C, and D, receives a signal which is the sum of four differential pressure signals. This totalized signal is compared with a setpoint in the RPS Low Flow bistable trip unit for that RPS channel.

Palisades Nuclear Plant B 3.3.1-4 Revised 08/06/2004

RPS Instrumentation B 3.3.1

• BASES BACKGROUND Measurement Channels (continued) ..i - ...-II -_I . I - , . I (continued) . I I

• Low Steam Generator Level TriDs -

There are two separate Low Steam Generator Level trips, one for each steam generator. Each Low Steam Generator Level trip monitors four level measurement channels for the associated steam generator, one for each RPS channel.

• Low Steam Generator Pressure Trips There are also two separate Low Steam Generator Pressure trips, one for each steam generator. Each Low Steam Generator

-Pressure trip monitors four pressure measurement channels for the associated steam generator,'one for each RPS channel.

-* High Pressurizer Pressure Trip The High Pressurizer Pressure Trip monitors four pressurizer pressure channels, one for each RPS channel.

Thermal Margini Low Pressure (TM/LP) Trip The TM/LP Trip utilizes bistable trip units. Each of these bistable trip units receives a calculated trip setpoint from the Thermal Margin Monitor (TMM) and compares it to the measured Q power (the higher of NI power from the power range NI drawer, or AT power, based on PCS hot leg and cold leg temperatures) pressurizer pressure, PCS cold leg temperature, and Axial Shape Index. 'The TMM provide the complex signal processing necessary to calculate the TM/LP trip setpoint, TM/LP trip comparison signal, and Q Power.

,,~ *. ~... ,

Palisades Nuclear Plant B 3.3.1-5 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

• Loss of Load Trip The Loss of Load trip uses a single pressure switch, 63/AST-2, in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units. The Loss of Load Trip is actuated by turbine auxiliary relays 305L and 305R. Relay 305L provides input to RPS channels A and C; 305R to channels B and D.

Relays 305L and 305R are energized on a turbine trip. Their inputs are the same as the inputs to the turbine solenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, auto stop oil pressure switch 63/AST-2 will actuate relays 305L and 305R and generate a reactor trip. If a turbine trip is generated by an input to the solenoid trip valve, relays 305L and 305R, which are wired in parallel, will also be actuated and will generate a reactor trip.

• Containment High Pressure Trip The Containment High Pressure Trip is actuated by four pressure

(

switches, one for each RPS channel.

• Zero Power Mode Bypass Automatic Removal The Zero Power Bypass allows manually bypassing (i.e., disabling) four reactor trip functions, Low PCS Flow, Low SG A Pressure, Low SG B Pressure, and TM/LP (low PCS pressure),

when reactor power (as indicated by the wide range nuclear instrument channels) is below 10-4%. This bypassing is necessary to allow RPS testing and control rod drive mechanism testing when the reactor is shutdown and plant conditions would cause a reactor trip to be present.

The Zero Power Mode Bypass removal interlock uses the wide range nuclear instruments (NIs) as measurement channels.

There are only two wide range NI channels. Separate bistables are provided to actuate the bypass removal for each RPS channel. Bistables in the N1-1/3 channel provide the bypass removal function for RPS channels A and C; bistables in the N1-2/4 channel for RPS channels B and D.

Palisades Nuclear Plant B 3.3.1-6 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Several measurement instrument channels provide more than one (continued) required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those!

shared channels and the Specifications which they affect.

RPS Trip Units Two types of RPS trip units are used in the RPS cabinets; bistable trip units and auxiliary trip units:

A bistable trip unit receives a measured process signal from its instrument channel and compares it to a setpoint; the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the measured signal is less conservative than the setpoint.

They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open or closed); the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the digital input is received. They also provide local trip indication and remote annunciation.

Each RPS 'channel has four auxiliary trip units and seven bistable trip units.

The contacts from these trip unit relays are arranged into six coincidence matrices, comprising the Matrix Logic.; If bistable trip units monitoring the same parameter in'at least two channels trip, the Matrix

" Logic will generate'a reactor trip (two-out-of-four logic).

-Four of the RPS measurehientfchannels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpoint is not

- -.. necessary.: In these cases, the'bis'table trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contact multiplication so the single input contact'opening can provide multiple contact outputs to the coincidence logic as well as trip indication and annunciation.

• d a ' . i .1- R Paiae Nula Pln B3 3 1 7 Reie 08/06/2004}  !.

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Trip Units (continued)

(continued)

Trips employing auxiliary trip units include the VHPT, which receives contact inputs from the Thermal Margin Monitors; the High Startup Rate trip which employs contact inputs from bistables mounted in the two wide range drawers; the Loss of Load Trip which receives contact inputs from one of two auxiliary relays which are operated by a single switch sensing turbine auto stop oil pressure; and the Containment High Pressure (CHP) trip, which employs containment pressure switch contacts.

There are four RPS trip units, designated as channels A through D, each channel having eleven trip units, one for each RPS Function. Trip unit output relays de-energize when a trip occurs.

All RPS Trip Functions, with the exception of the Loss of Load and CHP trips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Palisades Nuclear Plant B 3.3.1-8 Revised 0810612004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Protective System Bvpasses (continued)'-

Three different types of trip bypass are utilized in the RPS, Operating Bypass, Zero Power Mode Bypass, and Trip Channel Bypass. 'The Operating Bypass or Zero Power Mode Bypass prevent the actuation of a trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the trip unit output from affecting the Logic Matrix. A channel which is bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform'its specified safety function and must be considered to be

-inoperable.'

Operating Bypasses The Operating Bypasses are initiated and removed automatically during startup and shutdown'as power level changes. An Operating Bypass prevents the associated RPS auxiliary trip'unit from receiving a trip

'signal from the associated measurement channel. With the bypass in place, neither the pre-trip alarm nor the trip will actuate if the measured parameter exceeds the set point. An annunciator is provided for each Operating Bypass; The RPS trips with Operating Bypasses are:

-:a. High Startup Rate Trip bypass. The'High Startup Rate trip is automatically bypassed when the associated wide range channel indicates below 1E4% RTP, and when the associated power range excore channel indicates above 13% RTP. These bypasses 'are automatically removed between 1E-4% RTP and 13%'RTP. -':

b. Loss of Load bypass. The Loss of Load trip is automatically

' bypassed when the associated power range excore channel

-indicates'below 17% RTP. The bypass is automatically removed when the chanriel iridicates'above the set point. The same power

- range excore channel bistable is used to bypass the High Startup Rate trip and the Loss of Load trip for that RPS channel.

Palisades Nuclear'Plant B 3.11 .Revised 08106/2004 ,

RPS Instrumentation B 3.3.1 BASES BACKGROUND Operating Bypasses (continued)

(continued)

Each wide range channel contains two bistables set at 1E-4% RTP, one bistable unit for each associated RPS channel. Each of the two wide range channels affect the Operating Bypasses for two RPS channels; wide range channel NI-1/3 for RPS channels A and C, wide range channel NI-2/4 for RPS channels B and D. Each of the four power range excore channel affects the Operating Bypasses for the associated RPS channel. The power range excore channel bistables associated with the Operating Bypasses are set at a nominal 15%, and are required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow, pressure or temperature too low for the RPS trips to be reset. ZPM bypasses may be manually initiated and removed when wide range power is below 1E-4% RTP, and are automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. A ZPM bypass prevents the RPS trip unit from actuating if the measured parameter exceeds the set point. Operation of the pretrip alarm is unaffected by the zero power mode bypass. An annunciator indicates the presence of any ZPM bypass. The RPS trips with ZPM bypasses are:

a. Low Primary Coolant System Flow.

b. Low Steam Generator Pressure.

c. Thermal Margin/Low Pressure.

The wide range NI channels provide contact closure permissive signals when indicated power is below 1E-4% RTP. The ZPM bypasses may then be manually initiated or removed by actuation of key-lock switches.

One key-lock switch located on each RPS cabinet controls the ZPM Bypass for the associated RPS trip channels. The bypass is automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. The same wide range NI channel bistables that provide the ZPM Bypass permissive and removal signals also provide the high startup rate trip Operating Bypass actuation and removal.

Palisades Nuclear Plant B 3.3.1 -10 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES BACKGROUND Trip Channel Bypass (continued)

A Trip Channel Bypass is used when it is desired to physically remove an individual trip unit from the system, or when calibration or servicing of a trip channel could cause an inadvertent trip. A trip Channel Bypass may be manually initiated or removed at any time by actuation of a key-lock switch. A Trip Channel Bypass prevents the trip unit output from

' affecting the RPS logic matrix. A light above the bypass switch

- indicates that the trip channel has been bypassed. Each RPS trip unit has an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.

' -The key cannot be removed when in the bypass position. Only one key for each trip parameter is provided, therefore the operator can bypass only one chanhel of a given parameter at a time. During the bypass

- condition, system logic changes from two-out-of-four to two-out-of-three channels required for trip.

APPLICABLE Each of the analyzed accidents and transients can be detected by one SAFETY ANAXLYSES or more RPS Functions. The' accident analysis contained in Reference 4 takes credit for most RPS trip Functions. The High Startup

- Rate and Loss'of Load Functions, which are not specifically credited in the accident analysis are part of the NRC approved licensing basis for the plant. The High Startup Rate and Loss of Load trips are purely equipment protective, and their use minimizes the potential for

equipment

. u .p.. darriage.

The specific safety analyses applicable to each protective Function are identified below.

1. Variable High Power TriO (VHPT)

-The VHPT provides reactor core protection against positive

' reactivity'eix6ursions`.

The safety analyiVs assumes that this trip is'OPERABLE to terminate' excessive positive reactivity insertions during power

', operation and while shut down.

- ls ,*  ;

Palisades Nuclear Plant B 3.3.1-11 ' Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. High Startup Rate Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the High Startup Rate Trip. The High Startup Rate trip is used to trip the reactor when excore wide range power indicates an excessive rate of change. The High Startup Rate trip minimizes transients for events such as a continuous control rod withdrawal or a boron dilution event from low power levels. The trip may be operationally bypassed when THERMAL POWER is

< 1E-4% RTP, when poor counting statistics may lead to erroneous indication. It may also be operationally bypassed at

> 13% RTP, where moderator temperature coefficient and fuel temperature coefficient make high rate of change of power unlikely.

There are only two wide range drawers, with each supplying contact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolant System Flow Trip The Low PCS Flow trip provides DNB protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a primary coolant pump. (,

Flow in each of the four PCS loops is determined from pressure drop from inlet to outlet of the SGs. The total PCS flow is determined, for the RPS flow channels, by summing the loop pressure drops across the SGs and correlating this pressure sum with the sum of SG differential pressures which exist at 100% flow (four pump operation at full power Tave). Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

4, 5. Low Steam Generator Level Trip The Low Steam Generator Level trips are provided to trip the reactor in the event of excessive steam demand (to prevent overcooling the PCS) and loss of feedwater events (to prevent overpressurization of the PCS).

The Allowable Value assures that there will be sufficient water inventory in the SG at the time of trip to allow a safe and orderly plant shutdown and to prevent SG dryout assuming minimum AFW capacity.

Palisades Nuclear Plant B 3.3.1-12 Revised 08106/2004

RPS Instrumentation B 3.3.1 BASES APPLICABLE 4,5. Low Steam Generator Level Trip. (continued)

SAFETY ANALYSIS (continued) 'Each SG level is sensed by measuring the differential pressure in

- the upper portion of the downcomer annulus in the SG. These trips share four level sensing channels on each SG with the AFW actuation signal.

6, 7. Low Steam Generator. Pressure Trip The Low Steam Generator Pressure trip provides protection against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the PCS. This trip provides'a mitigation function in the event of an MSLB.

- .I The Low SG Pressure channels are shared with the Low SG Pressure signals which isolate the steam and feedwater lines.

8. High Pressurizer Pressure Trip The High Pressurizer Pressure trip, in conjunction with pressurizer

-safety valves and .Main Steam Safety Valves (MSSVs), provides protection against overpressure conditions in the PCS when at operating temperature. The safety analyses assume the High

-Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (e.g., Loss of Load, Main Steam Isolation Valve (MSIV) closure, etc.) or which suddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety grade instrument channels with the TM/LP trip, Anticipated Transient Without Scram (ATWS) and PORV circuits, and the Pressurizer Low Pressure Safety.injection Signal.--

. I 1 'I .,

Palisades Nuclear Plant B 3.3.1-13 -- Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES APPLICABLE 9. Thermal Margin/Low Pressure (TM/LP) Trip SAFETY ANALYSIS (continued) The TM/LP trip is provided to prevent reactor operation when the DNBR is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The trip is initiated whenever the PCS pressure signal drops below a minimum value (Pmin) or a computed value (Pvar) as described below, whichever is higher.

The TM/LP trip uses Q Power, ASI, pressurizer pressure, and cold leg temperature (Tc) as inputs.

Q Power is the higher of core THERMAL POWER (AT Power) or nuclear power. The AT power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range excore channels as inputs. Both the AT and excore power signals have provisions for calibration by calorimetric calculations.

The ASI is calculated from the upper and lower power range excore detector signals, as explained in Section 1.1, "Definitions."

The signal is corrected for the difference between the flux at the core periphery and the flux at the detectors.

The T, value is the higher of the two cold leg signals.

The Low Pressurizer Pressure trip limit (Pvar)iS calculated using the equations given in Table 3.3.1-2.

The calculated limit (Pva,) is then compared to a fixed Low Pressurizer Pressure trip limit (Pmin). The auctioneered highest of these signals becomes the trip limit (Ptflp). Ptrip is compared to the measured PCS pressure and a trip signal is generated when the measured pressure for that channel is less than or equal to Ptrip. A pre-trip alarm is also generated when P is less than or equal to the pre-trip setting, Ptr1p + AP.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS pressure for the existing temperature and power conditions. It is compared to actual PCS pressure in the TM/LP trip unit.

Palisades Nuclear Plant B 3.3.1-14 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES APPLICABLE 10. Loss of Load Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of

.the Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses a single pressure switch in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

~1 . Containment High Pressure Trip The Containment High Pressure trip provides a reactor trip in the event of a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The Containment High Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two

• microswitches. One microswitch on each of four sensors provides an input to the RPS.

12. Zero Power Mode Bvpass Removal The only RPS bypass considered in the safety analyses is the' Zero Power Mode (ZPM) Bypass. The ZPM Bypass is used when the plant is shut down arid it is desired to raise the control rods for control rod drop testing with PCS flow or temperature too low for, the RPS Low PCS Flow, Low SG Pressure, or Thermal

-Margin/Low Pressure trips to be reset. ZPM bypasses are

'automatically removed-if the wide range NI indicated power

, exceeds 1E-4% RTP.

Palisades Nuclear Plant B 3.3.1-15 .Revised ,08106/2004

RPS Instrumentation B 3.3.1 BASES APPLICABLE 12. Zero Power Mode Bypass Removal (continued)

SAFETY ANALYSIS (continued) The safety analyses take credit for automatic removal of the ZPM Bypass if reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur with the affected trips bypassed and PCS flow, pressure, or temperature below the values at which the RPS could be reset. The ZPM Bypass would effectively be removed when the first wide range NI channel indication reached 1E-4% RTP. With the ZPM Bypass for two RPS channels removed, the RPS would trip on one of the un-bypassed trips.

This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur when PCS flow, steam generator pressure, and PCS pressure (TM/LP) were above their trip setpoints, a trip would terminate the event when power increased to the minimum setting (nominally 30%) of the Variable High Power Trip. In this case, the monitored parameters are at or near their normal operational values, and a trip initiated at 30% RTP provides adequate protection.

The RPS design also includes automatic removal of the Operating Bypasses for the High Startup Rate and Loss of Load trips. The

(

safety analyses do not assume functioning of either these trips or the automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of the trip unit (including its output relays), any required portion of the associated instrument channel, or both, renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. Failure of an automatic ZPM bypass removal channel may also impact the associated instrument channel(s) and reduce the reliability of the affected Functions.

Palisades Nuclear Plant B 3.3.1-16 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES LCO Actions allow Trip Channel Bypass of individual channels, but the (continued) bypassed channel must be considered to be inoperable. The bypass key used to bypass a single channel cannot be simultaneously used to bypass that same parameter in other channels. This interlock prevents operation with more than one channel of the same Function trip channel bypassed. The plant is normally restricted to 7 days in a trip channel bypass, or otherwise inoperable condition before either restoring the Function'to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are' selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function.

These uncertainties are addressed as described in plant documents.

Neither Allowable Values nor setpoints are specified for the non-safety related RPS Trip Functions, since no safety analysis assumptions would be violated if they'are not set at a particular value.

The following Bases for each trip Function identify the above RPS trip Function criteria-items that are applicable to establish the trip Function OPERABILITY. .

1. Variable Hiqh Power Trip (VHPT)

• This LCO requires all four channels of the VHPT Function to be

_OPERABLE.'  ;, '

The Allowable Value is high enough to proi-de an'operating envelope that prevents unnecessary VHPT trips during normal plant operations. The Allowable Value is low enough for the system to function adequately during reactivity addition events.

Palisades Nuclear Plant' B 3.3.1 -1 7 . Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES LCO 1. Variable High Power Trip (VHPT) (continued)

(continued)

The VHPT is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During plant startup, the VHPT trip setpoint is initially at its minimum value, *30%. Below 30% RTP, the VHPT setpoint is not required to "track" with Q Power, i.e., be adjusted to within 15% RTP. It remains fixed until manually reset, at which point it increases to

<15% above existing Q Power.

The maximum allowable setting of the VHPT is 109.4% RTP.

Adding to this the possible variation in trip setpoint due to calibration and instrument error, the maximum actual steady state power at which a trip would be actuated is 113.4%, which is the value assumed in the safety analysis.

2. High Startup Rate Trip This LCO requires four channels of High Startup Rate Trip Function to be OPERABLE in MODES 1 and 2.

The High Startup Rate trip serves as a backup to the (

administratively enforced startup rate limit. The Function is not credited in the accident analyses; therefore, no Allowable Value for the trip or operating bypass Functions is derived from analytical limits and none is specified.

The four channels of the High Startup Rate trip are derived from two wide range NI signal processing drawers. Thus, a failure in one wide range channel could render two RPS channels inoperable. It is acceptable to continue operation in this condition because the High Startup Rate trip is not credited in any safety analyses.

The requirement for this trip Function is modified by a footnote, which allows the High Startup Rate trip to be bypassed when the wide range NI indicates below 1OE-4% or when THERMAL POWER is above 13% RTP. If a High Startup Rate trip is bypassed when power is between these limits, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-18 Revised 08106/2004

RPS Instrumentation B 3.3.1 BASES LCO 3. Low Primary Coolant System Flow Trip (continued) .. - . . - . .I

- This LCO requires four channels of Low PCS Flow Trip Function to be OPERABLE.  ;-

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insures that the reactor cannot operate when the flow rate Is less than 93% of the nominal value considering instrument errors. Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E4% RTP, it must be considered to be inoperable.

4, 5.. Low Steam Generator Level Trip This LCO requires four channels of Low Steam Generator Level

- . *. Trip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequate water inventory in the steam generators when the reactor is critical and is.based upon narrow range instrumentation. The 25.9%

indicated level corresponds to the location of the feed ring.

6, 7. Low Steam Generator Pressure Trip This LCO requires four channels of Low Steam Generator Pressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full load

• , operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand.

Since excessive steam demand causes the PCS to cool down, resulting in positive reactivity addition to the core, a reactor trip is required to offset that effect.

Palisades Nuclear Plant -B 3.3.1-19 Revised 08/06/2004

3 RPS Instrumentation B 3.3.1 BASES LCO (continued) 8. High Pressurizer Pressure Trip This LCO requires four channels of High Pressurizer Pressure Trip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressure increases in the PCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated.

9. Thermal Margin/Low Pressure (TM/LP) Trip This LCO requires four channels of TM/LP Trip Function to be OPERABLE.

The TM/LP trip setpoints are derived from the core thermal limits through application of appropriate allowances for measurement uncertainties and processing errors. The allowances specifically account for instrument drift in both power and inlet temperatures, calorimetric power measurement, inlet temperature measurement, and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt, fuel pellet manufacturing tolerances, core flow measurement uncertainty and core bypass flow, inlet temperature measurement time delays, and ASI measurement, are included in the development of the TM/LP trip setpoint used in the accident analysis.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-20 Revised 08106/2004

RPS Instrumentation B 3.3.1 BASES LCO 10. Loss of Load Trip (continued)

The LCO requires four Loss of Load Trip Function channels to be OPERABLE in MODE l with THERMAL POWER 217% RTP.

The Loss of Load trip may be bypassed or be inoperable with THERMAL POWER < 17% RTP, since it is no longer needed to

' prevent lifting of the pressurizer safety valves or steam generator safety valves'in the event of a Loss of Load. Loss of Load Trip unit must be considered inoperable if it is bypassed when THERMAL POWER is above 17% RTP.

-This LCO requires four RPS Loss of Load auxiliary trip units, relays 305L and 305R, and pressure switch 63/AST-2 to be OPERABLE. With those components OPERABLE, a turbine trip will generate a reactor trip. The LCO does not require the various

' turbine trips, themselves, to be. OPERABLE.

The Nuclear Steam Supply System and Steam Dump System are capable of accommodating the Loss of Load without requiring the use of the above equipment.

The Loss of Load Trip Function is not credited in the accident analysis; therefore,'an Allowable Value for the trip cannot be derived from analytical limits, and is not specified.

.- . -- ,* ao I,*....

11. 'Containment High'Pressure'Tri -

'This LCO requires four channels of Containment High Pressure

' Trip Function to'be OPERABLE.

The Allowable Value is high enough to allow for small pressure

- . ... increases in containment expected during normal operation (i.e., plant heatup) that are not indicative of an abnormal condition.

The setting is low enough to initiate a reactor trip to prevent

- containment pressure from exceeding design pressure following a DBA and ensures the reactor is shutdown before initiation of safety injection and-containment spray.:

Palisades Nuclear Plant B 3.3.1 ' Ir-Revised 08/06/2004 -

RPS Instrumentation B 3.3.1 BASES LCO (continued) 12. ZPM Bypass The LCO requires that four channels of automatic Zero Power Mode (ZPM) Bypass removal instrumentation be OPERABLE.

Each channel of automatic ZPM Bypass removal includes a shared wide range NI channel, an actuating bistable in the wide range drawer, and a relay in the associated RPS cabinet. Wide Range NI channel 1/3 is shared between ZPM Bypass removal channels A and C; Wide Range NI channel 2/4, between ZPM Bypass removal channels B and D. An operable bypass removal channel must be capable of automatically removing the capability to bypass the affected RPS trip channels with the ZPM Bypass key switch at the proper setpoint.

APPLICABILITY This LCO requires all safety related trip functions to be OPERABLE in accordance with Table 3.3.1-1.

Those RPS trip Functions which are assumed in the safety analyses (all except High Startup Rate and Loss of Load), are required to be operable in MODES 1 and 2, and in MODES 3, 4, and 5 with more than one full-length control rod capable of being withdrawn and PCS boron concentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES 3, 4, or 5, if PCS boron concentration is at REFUELING BORON CONCENTRATION, or when no more than one full-length control rod is capable of being withdrawn, because the RPS Function is already fulfilled. REFUELING BORON CONCENTRATION provides sufficient negative reactivity to assure the reactor remains subcritical regardless of control rod position, and the safety analyses assume that the highest worth withdrawn full-length control rod will fail to insert on a trip. Therefore, under these conditions, the safety analyses assumptions will be met without the RPS trip Function.

The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, "Nuclear Instrumentation."

Palisades Nuclear Plant B 3.3.1-22 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES APPLICABILITY (continued) -The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3,4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, "Nuclear Instrumentation."

The Loss of Load trip is required to be OPERABLE with THERMAL POWER at or above 17% RTP. Below 17% RTP, the ADVs are capable of relieving the pressure due to a Loss of Load event without challenging other overpressure protection.

The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESF in providing acceptable consequences during accidents..

ACTIONS The most common causes of channel inoperability are outright failure of loop components or drift of those loop components which'is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures-are typically identified by the actuation of alarms due to the channel failing to the "safe" condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an

.. automatic component might not respond properly). Typically, the drift of

- . -the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

In the event a channel's trip setpoint is found nonconservative with

- respect to the Allowable Value, or.the transmitter, instrument loop,

-signal processing electronics, or RPS bistablektrip unit is found inoperable,-all affected Functions provided by that channel must be

• declared inoperable, and the plant must enter.the Condition for the particular protection Functions affected.

Palisades Nuclear Plant B 3.3.1 - Revised 08/06/2004

RPS Instrumentation B 3.3. 1 BASES ACTIONS (continued) When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

A.1 Condition A applies to the failure of a single channel in any required RPS Function, except High Startup Rate, Loss of Load, or ZPM Bypass Removal. (Condition A is modified by a Note stating that this Condition does not apply to the High Startup Rate, Loss of Load, or ZPM Bypass Removal Functions. The failure of one channel of those Functions is addressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel is inoperable, operation is allow'ed to continue. Since the trip unit and associated instrument channel combine to perform the trip function, this Condition is also appropriate if both the trip unit and the associated instrument channel are inoperable. Though not required, the inoperable channel may be bypassed. The provision of four trip channels allows one channel to be bypassed (removed from service) during operations, placing the RPS in two-out-of-three coincidence logic. The failed channel must be restored to OPERABLE status or placed in trip within 7 days.

Required Action A.1 places the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent trip.

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.1-24 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES ACTIONS A.1 (continued)

(continued)

' The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

B.1 Condition B applies to the failure of a single High Startup Rate trip unit or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to entering MODE 2 from MODE 3. A shutdown provides the appropriate opportunity to repair the trip function and conduct the'necessary testing. The Completion Time is based on the fact that the safety analyses take no credit for the functioning of this trip.

C.1 Condition'C applies to the failure of a single Loss of Load or associated instrument chafinel.'-

If one trip unit or associated instrument channel fails, it must be restored to'OPERABLE status'prI6rto THERMAL POWER 217% RTP following a shutdown. If the plant is shutdown at the time the channel becomes inoperable, then the failed channel must be'restored to OPERABLE status prior to THERMAL POWER 217% RTP. For this Completion

- Time, "following a shutdown. means this Required Action'does not have to be completed until prior to THERMAL POWER 2 17% RTP for the first time after the plant has been in MODE 3 following entry into the Condition.' The Completion Time trip assures.that the plant will not be restarted 'with an inoperable Loss of Load trip channel.

Palisades Nuclear Plant B 3.3.1-25 -~ Revised 08106/2004

RPS Instrumentation B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

Condition D applies when one or more automatic ZPM Bypass removal channels are inoperable. If the ZPM Bypass removal channel cannot be restored to OPERABLE status, the affected ZPM Bypasses must be immediately removed, or the bypassed RPS trip Function channels must be immediately declared to be inoperable. Unless additional circuit failures exist, the ZPM Bypass may be removed by placing the associated "Zero Power Mode Bypass" key operated switch in the normal position.

A trip channel which is actually bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must immediately be declared to be inoperable.

E.1 and E.2 Condition E applies to the failure of two channels in any RPS Function, except ZPM Bypass Removal Function. (The failure of ZPM Bypass Removal Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does not apply to the ZPM Bypass Removal Function.

The Required Actions are modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel tripped.

MODE changes in this configuration are allowed because two trip channels for the affected function remain OPERABLE. A trip occurring in either or both of those channels would cause a reactor trip.

In this configuration, the protection system is in a one-out-of-two logic, and the probability of a common cause failure affecting both of the OPERABLE channels during the 7 days permitted is remote.

Required Action E.1 provides for placing one inoperable channel in trip within the Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Though not required, the other inoperable channel may be (trip channel) bypassed.

Palisades Nuclear Plant B 3.3.1-26 Revised 08106/2004

RPS Instrumentation B 3.3.1 BASES ACTIONS E.1 and E.2 (continued)

(continued)

This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed or inoperable in an untripped condition, the RPS is in a two-out-of-three logic for that function; but with another channel failed, the RPS may be operating in a

two-out-of-two' logic. This is outside the assumptions made in the

- analyses and should be corrected. To correct the problem, one of the inoperable channels is placed in trip. This places the RPS in a one-out-of-two for that function logic. If any of the other unbypassed channels for that function receives a trip signal, the reactor will trip.

Action E.2 is modified by a Note stating that this Action does not apply to (is not required for) the High Startup Rate and Loss of Load Functions.

One channel is required to be restored to OPERABLE status within 7 days for reasons' similar to those stated urider Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A

-still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action E.2 must be

-placed in trip if more than 7 days have elapsed since the initial channel

- - failure.

' F! .1. ' * ' .;-

• The power range excore channels are used to generate the internal ASI

- signal used as an input to the TM/LP trip. They also provide input to the

-Thermal Margin Monitors for determination of the Q Power input for the TM/LP trip and the VHPT. "Iftwo power range excore channels cannot

'. be restored to OPERABLE status, power is restricted or reduced during subsequent operations because of increased uncertainty associated with inoperable power range excore channels which provide input to those trips.

' The Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is adequat6to reduce power in an orderly manner without challenging plant systems.

Palisades Nuclear Plant B 3.3.17-27 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES ACTIONS G.1, G.2.1, and G.2.2 (continued)

Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, E, or F are not met, or if the control room ambient air temperature exceeds 90 0F.

If the control room ambient air temperature exceeds 90'F, all Thermal Margin Monitor channels are rendered inoperable because their operating temperature limit is exceeded. In this condition, or if the Required Actions and associated Completion Times are not met, the reactor must be placed in a condition in which the LCO does not apply.

To accomplish this, the plant must be placed in MODE 3, with no more than one full-length control rod capable of being withdrawn or with the PCS boron concentration at REFUELING BORON CONCENTRATION in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The Completion Time is reasonable, based on operating experience, for placing the plant in MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The Completion Time is also reasonable to ensure that no more than one full-length control rod is capable of being withdrawn or that the PCS boron concentration is at REFUELING BORON CONCENTRATION. (

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column of REQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Under most conditions, a CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Palisades Nuclear Plant B 3.3.1-28 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS (continued) Agreement criteria are determined by the plant staff based on a

'combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

- The Containment High Pressure and Loss of Load channels are

- pressure switch actuated. As such, they have no associated control room indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the' LCO required channels.

-SR 3.3.1.2.

This SR verifies that the control room ambient air temperature is within the environmental qualification temperature limits for the most restrictive RPS components', which are the Thermal Margin Monitors. These

- monitors provide inp6t to both the VHPT Function and the TM/LP Trip Function. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is reasonable based on engineering judgement and plant operating experience.

SR 3.3.1.3 A daily calibration balance) is performed when THERMAL POWER is 2'15%. 'The'dally' calibration consists of adjusting the "nuclear powercalibrtate" potentiometers to agree with the calorimetric calculation if the absolute difference is Ž1.5%.i Nuclear power is adjusted via a potentiometer, or THERMAL POWER is adjusted via a

.Thermal Margin- Monitor bias number, :as necessary, in accordance with the daily calibration (heat b1alance) procedure., Performance of the daily calibration ensures that the two inputs to theQ power measurement are i'indicating accurately with'respect to the much more accurate secondary calorimetric calculation. *  ;

Palisades Nuclear Plant B 3;3.1-29' Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS (continued) The Frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is 215% RTP.

The secondary calorimetric is inaccurate at lower power levels. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows time requirements for plant stabilization, data taking, and instrument calibration.

SR 3.3.1.4 It is necessary to calibrate the power range excore channel upper and lower subchannel amplifiers such that the measured ASI reflects the true core power distribution as determined by the incore detectors. ASI is utilized as an input to the TM/LP trip function where it is used to ensure that the measured axial power profiles are bounded by the axial power profiles used in the development of the Tiniet limitation of LCO 3.4.1. An adjustment of the excore channel is necessary only if reactor power is greater than 25% RTP and individual excore channel (

ASI differs from AXIAL OFFSET, as measured by the incores, outside the bounds of the following table:

Allowed Group 4 Group 4 Reactor Rods Ž128" withdrawn Rods <128" withdrawn Power

<1 00% -0.020 5 (AO-ASI) <0.020 -0.040 c (AO-ASI) <0.040

< 95 -0.033 <(AO-ASI) <0.020 -0.053 <(AO-ASI) <0.040

<90 -0.046 *(AO-ASI) <0.020 -0.066 <(AO-ASI) <0.040

< 85 -0.060 *(AO-ASI) <0.020 -0.080 <(AO-ASI) <0.040

< 80 -0.120 <(AO-ASI) *0.080 -0.140 <(AO-ASI) <0.100

< 75 -0.120 <(AO-ASI) <0.080 -0.140 <(AO-ASI) <0.100

< 70 -0.120 *(AO-ASI) <0.080 -0.140 <(AO-ASI) *0.100

<65 -0.120 <(AO-ASI) <0.080 -0.140 <(AO-ASI) <0.100

< 60 -0.160 *(AO-ASI) <0.120 -0.180 <(AO-AS I) <0.140

< 55 -0.160 <(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

< 50 -0.160 <(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

< 45 -0.160 *(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

<40 -0.160 *(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

< 35 -0.160 <(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

< 30 -0.160 <(AO-ASI) <0.120 -0.180 <(AO-ASI) <0.140

< 25 Below 25% RTP any AO/ASI difference is acceptable Table values determined with a conservative Pvar gamma constant of -9505.

Palisades Nuclear Plant B 3.3.1-30 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS (continued) Below 25% RTP any difference between ASI and AXIAL OFFSET is acceptable. A Note indicates the Surveillance is'not required to have been performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is 225% RTP.

Uncertainties in the excore and incore measurement process make it

-impractical to calibrate when THERMAL POWER is < 25% RTP. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows time for plant stabilization, data taking, and instrument calibration.

The 31 day Frequency is adequate, based on operating experience of the excore linear amplifiers and the slow burnup of the detectors. The excore readings are a strong function of the power produced in the peripheral fuel bundles and do not represent an integrated reading across the core.' Slow changes in neutron flux during the fuel cycle can also be detected at this Frequency.

SR 3.3.1.5 A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, except Loss of Load and High Startup Rate, every 92 days to ensure the entire channel will perfdrrn its intended function when needed. For the TM/LP Function; the constants associated with the Thermal Margin Monitors must be' verified to be within tolerances.

A successful test of the required contact(s) of a'channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specificatio'ns tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is base6d on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 5).

.. - I,: .. -

Palisades Nuclear Plant B 3.3.1-31 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) A calibration check of the power range excore channels using the internal test circuitry is required every 92 days. This SR uses an internally generated test signal to check that the 0% and 50% levels read within limits for both the upper and lower detector, both on the analog meter and on the TMM screen. This check verifies that neither the zero point nor the amplifier gain adjustment have undergone excessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operating experience, and takes into account indications and alarms available to the operator in the control room.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on the Loss of Load and High Startup Rate channels is performed prior to a reactor startup to ensure the entire channel will perform its intended function.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL

('

FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-1/3 sends a trip signal to RPS channels A and C; NI-2/4 to channels B and D. Since each High Startup Rate channel would cause a trip on two RPS channels, the High Startup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring turbine auto stop oil pressure which is not tested when the reactor is critical. Operating experience has shown that these components usually pass the Surveillance when performed at a Frequency of once per 7 days prior to each reactor startup.

Palisades Nuclear Plant B 3.3.1-32 Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 REQUIREMENTS (continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (except neutron detectors). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be consistent with the setpoint analysis.

The bistable setpoints must be found to trip within the Allowable Values specified in the LCO and left set consistent with the assumptions of the setpoint analysis. The Variable High Power Trip.setpoint shall be verified to reset properly at several indicated power levels during (simulated) power increases and power decreases.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the setpoint analysis.

As part of the CHANNEL CALIBRATION of the wide range Nuclear

-Instrumentation, automatic removal of the ZPM Bypass for the Low PCS Flow, TM/LP must be verified to assure that these trips are available when required.

The Frequency is based upon the assumption of an 18 month calibration interval for the deterrfnination of the magnitude of equipment drift. ,. ,

This SR is modified by a Note which states that it is not necessary to calibrate neutron detectors because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in power range excore neutron detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.3) and the monthly calibration using the incore detectors (SR 3.3.1.4)., Sudden changes in detector performance Would be noted during the required CHANNEL CHECKS (SR 3.3.1.1).

Palisades Nuclear Plant B 3.31-33 .Revised 08/06/2004

RPS Instrumentation B 3.3.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100

3. IEEE Standard 279-1971, April 5, 1972

4. FSAR, Chapter 14

5. CEN-327, June 2,1986, including Supplement 1, March 3,1989

(

Palisades Nuclear Plant B 3.3.1-34 Revised 08/06/2004

RPS Instrumentation B 3.3.1 Table B 3.3.1-1 (page 1 of 1)

Instruments Affecting Multiple Specifications Required Instrument Channels Affected Specifications Nuclear Instrumentation Source Range N1-113, Count Rate Indication a C-150 Panel 3.3.8 (#1)

Source Range NI-1/3 & 2/4, Count Rate Signal 3.3.9 & 3.9.2 Wide Range NI-1/3 & 2/4, Flux Level 104 Bypass 3.3.1 (#3, 6, 7, 9, & 12)

Wide Range NI-1/3 & 2/4, Startup Rate 3.3.1 (#2)

Wide Range NI-1/3 & 2/4, Flux Level Indication 3.3.7 (#3) & 3.3.9 Power Range NI-5, 6, 7, & 8, Tq 3.2.1 & 3.2.3 Power Range NI-5, 6, 7, & 8, Q Power 3.3.1 (#1 & 9)

Power Range NI-5, 6, 7, & 8, ASI 3.3.1 (#9) & 3.2.1 & 3.2.4 Power Range NI-5, 6, 7, & 8, Loss of Load/High Startup Rate Bypass 3.3.1 (#2 & 10)

PCS T-Cold Instruments TT-0112CA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112CA & 0122CA, Temperature Signal (C-150) 3.3.8 (#6 & 7)

TT-0122CB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112CA & 0122CB, Temperature Signal (LTOP) 3.4.12.b.1 TT-0112CC & 0122CD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#2)

TT-0112 & 0122 CC & CD, Temperature Signal (SMM) 3.3.7 (#5)

TT-0112 & 0122 CA, CB, CC, & CD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9) & 3.4.1.b PCS T-Hot Instruments

.TT-0112HA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6 TT-01 12HA & 0122HA, Temperature Signal (C-150) 3.3.8 (#4 & 5)

TT-0122HB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6 TT-0112 & 0122 HC & HD, Temperature Signal (SMM) 3.3.7 (#5)

TT-0112HC & 0122HD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#1)

TT-0112 & 0122 HA, HB, HCO & HD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9)

Thermal Margin Monitors PY-0102A, B, C, & D 1 3.3.1 (#1 & 9)

Pressurizer Pressure Instruments PT-0102A, B, C, & D, Pressure Signal (RPS & SIS) 3.3.1 (#8 & 9) &

3.3.3 (#l.a & 7a)

PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.1 & 3.4.14 PT-0105A & B, Pressure Signal (WR Indication & LTOP) 3.3.7 (#5) & 3.4.12.b.1 P1-0110, Pressure Indication @ C-150 Panel 3.3.8 (#2)

SG Level Instruments LT-0751 & 0752 A, B, C, & D, Level Signal (RPS & AFAS) 3.3.1 (#4 & 5) &

3.3.3 (#4.a & 4.b)

LI-0757 & 0758 A & B, Wide Range Level Indication 3.3.7 (#11 & 12)

LI-0757C & 0758C, Wide Range Level Indication @ C-150 Panel 3.3.8 (#10 & 11)

SG Pressure Instruments PT-0751 & 0752 A, B, C, & D, Pressure Signal (RPS & SG Isolation) 3.3.1 (#6 & 7) &

3.3.3 (#2a, 2b, 7b, 7c)

PIC-0751 & 0752 C & D, Pressure Indication 3.3.7 (#13 & 14)

PI-0751E & 0752E, Pressure Indication a C-150 Panel 3.3.8 (#8 & 9)

Containment Pressute Instruments PS-1801, 1802, 1803, & 1804, Switch Output (RPS) 3.3.1 (#11)

PS-1801, 1802A, 1803, & 1804A, Switch Output (ESF) 3.3.3 (#5.a)

PS-1801A, 1802,1803A, & 1804, Switch Output (ESF) 3.3.3 (#5.b)

Note: The information provided in this table is intended for use as an aid to distinguish those instrument channels which provide more than one required function and to describe which specifications they affect. The information in this table should not be taken as Inclusive for all instruments nor affected specifications.

Palisades Nuclear Plant B 3.3.1-35 Revised 08/06/2004

DG - UV Start B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Diesel Generator (DG) - Undervoltage Start (UV Start)

BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or insufficiently stable to allow safe plant operation.

Undervoltage protection will generate a UV Start in the event a Loss of Voltage or Degraded Voltage condition occurs. There are two UV Start Functions-for each 2A kV vital bus..-

Undervoltage'protection and load shedding features for safety-related buses at the'2,400 V and lower voltage levels are designed in accordance with 10 CFR 50, Appendix A, General Design Criterion 17 (Ref. 1) and the following features:

-1.' Two levels of automatic undervoltage protection from loss or

'degradation of offsite power sources are provided. The first level (loss of voltage) provides normal loss of voltage protection. The second level of protection (degraded voltage) has voltage and time delay set points selected for automatic trip of the offsite sources to protect safety-related equipment from sustained degraded voltage'conditions at all bus voltage levels,.

- Coincidence logic is provided to preclude spurious trips.

2. The undervoltage protection system automatically prevents load shedding of the safety-related buses when the emergency generators are supplying power to the safeguards loads.

-3. Control circuits for shedding of Class 1E and non-Class 1E loads during a Loss of Coolant Accident (LOCA) themselves are

Class I E or are separated electrically from the Class I E portions.

. I.

Palisades Nuclear Plant B 3.3.5 Revised 01/26/2004 -

DG - UV Start B 3.3.5 BASES BACKGROUND Description (continued)

Each 2,400 V Bus (1C and 1D) is equipped with two levels of undervoltage protection relays (Ref. 2). The first level (Loss of Voltage Function) relays 127-1 and 127-2 are set at approximately 77% of rated voltage with an inverse time relay. One of these relays measures voltage on each of the three phases. They protect against sudden loss of voltage as sensed on the corresponding bus using a three-out-of-three coincidence logic. The actuation of the associated auxiliary relays will trip the associated bus incoming circuit breakers, start its associated DG, initiate bus load shedding, and activate annunciators in the control room. The DG circuit breaker is closed automatically upon establishment of satisfactory voltage and frequency by the use of associated voltage sensing relay 127D-1 or 127D-2.

The second level of undervoltage protection (Degraded Voltage Function) relays 127-7 and 127-8 are set at approximately 93% of rated voltage, with one relay monitoring each of the three phases. These relays protect against sustained degraded voltage conditions on the corresponding bus using a three-out-of-three coincidence logic. These relays have a built-in 0.65 second time delay, after which the associated DG receives a start signal and annunciators in the control room are actuated. If a bus undervoltage exists after an additional six seconds, the associated bus incoming circuit breakers will be tripped and a bus load shed will be initiated.

Trip Setpoints The trip setpoints are based on the analytical limits presented in References 3 and 4, and justified in Reference 5. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, and instrument drift, setpoints specified in SR 3.3.5.2 are conservatively adjusted with respect to the analytical limits. A detailed analysis of the degraded voltage protection is provided in References 3 and 4.

The specified setpoints will ensure that the consequences of accidents will be acceptable, providing the plant is operated from within the LCOs at the onset of the accident and the equipment functions as designed.

Palisades Nuclear Plant B 3.3.5-2 Revised 01/26/2004

DG - UV Start B 3.3.5 BASES APPLICABLE The DG - UV Start is required for Engineered Safety Features (ESF)

SAFETY ANALYSES systems to function in any accident with a loss of offsite power.: Its design basis is that of the ESF Systems.

Accident analyses credit the loading of the DG based on a loss of offsite

-power during a LOCA. The diesel loading has been included in the

-delay time associated with each safety system component requiring DG supplied power following a loss of offsite power. This delay time includes contributions from the DG start, DG loading, and Safety Injection System component actuation..

The required channels of UV Start, in conjunction with the ESF systems powered from the DGs; provide plant protection in the event of any of

! the analyzed accidents discussed in Reference 6, in which a loss of

: ' offsite power is assumed. UV Start channels are required to meet the redundancy and testability requirements of GDC 21 in 10 CFR 50, Appendix A (Ref. 1).

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay and the appropriate sequencing delay, if applicable.' 'The.response times for ESFAS actuated equipment include the appropriate DG loading and sequencing delay.

The DG - UV Start channels satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO for the DG - UV Start requires that three channels per bus of each UV Start instrumentation Function be OPERABLE when the associated.DG is'required'to be OPERABLE. The UV Start supports safety systems associated with ESF actuation.

-The Bases for the'trip setpoints are as follows:

The voltage trip setpoint is set low enbugh such that spurious trips of the offsite source due to operation of the undervoltage relays are not expected for any combination of plant loads and normal grid voltages.

Palisades Nuclear Plant B 3.3.5-3 Revised 01/26/2004

DG - UV Start B 3.3.5 BASES LCO This setpoint at the 2,400 V bus and reflected down to the 480 V buses (continued) has been verified through an analysis to be greater than the minimum allowable motor voltage (90% of nominal voltage). Motors are the most limiting equipment in the system. MCC contactor pickup and drop-out voltage is also adequate at the setpoint values. The analysis ensures that the distribution system is capable of starting and operating all safety-related equipment within the equipment voltage rating at the allowed source voltages. The power distribution system model used in the analysis has been verified by actual testing (Refs. 5 and 7).

The time delays involved will not cause any thermal damage as the setpoints are within voltage ranges for sustained operation. They are long enough to preclude trip of the offsite source caused by the starting of large motors and yet do not exceed the time limits of ESF actuation assumed in FSAR Chapter 14 (Ref. 6) and validated by Reference 8.

Calibration of the undervoltage relays verify that the time delay is sufficient to avoid spurious trips.

APPLICABILITY The DG - UV Start actuation Function is required to be OPERABLE whenever the associated DG is required to be OPERABLE per LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC Sources -

Shutdown," so that it can perform its function on a loss of power or degraded power to the vital bus.

ACTIONS A DG - UV Start channel is inoperable when it does not satisfy the OPERABILITY criteria for the channel's Function.

In the event a channel's trip setpoint is found nonconservative with respect to the specified setpoint, or the channel is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition entered. The required channels are specified on a per DG basis.

Palisades Nuclear Plant B 3.3.5-4 Revised 01/26/2004

DG - UV Start B 3.3.5 BASES ACTIONiS A.1 (continued)

Condition A applies if one or more of the three phase UV sensors or, relay logic is inoperable .for one or more Functions (Degraded Voltage or Loss of Voltage) per DG bus. ,

The affected DG must be declared inoperable and the appropriate Condition(s) entered. Because of the three-out-of-three logic in both the Loss of Voltage'and Degraded Voltage Functions, the appropriate means of addressing channel failure is declaring the DG inoperable,.

and effecting repair in a manner consistent with other DG failures.

Required Action A.1 ensures that Required Actions for the affected DG inoperabilities are initiated. Depending upon plant MODE, the'actions specified in LCO 3.8.1,or LCO 3.8.2, as applicable, are required immediately.

SURVEILLANCE SR 3.3.5.1 REQUIREMENT' A CHANNEL FUNCTIONAL TEST is performed on each UV Start logic channel every 18.months to ensure that the logic channel will perform its intended function when needed. The Undervoltage sensing relays are tested by SR 3.3.5.2. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single-contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable~because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. .;

The Frequency of 18 months is based on the plant conditions necessary

.-to perform the test.. - ,

Palisades Nuclear Plant B 3.3.5-5 . Revised 01/26/2004

DG - UV Start B 3.3.5 BASES SURVEILLANCE SR 3.3.5.2 REQUIREMENTS (continued) A CHANNEL CALIBRATION performed each 18 months verifies the accuracy of each component within the instrument channel. This includes calibration of the undervoltage relays and demonstrates that the equipment falls within the specified operating characteristics defined by the manufacturer.

The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the setpoint analysis.

The Frequency of 18 months is a typical refueling cycle. Operating experience has shown this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A GDCs 17 and 21

(

2. FSAR, Section 8.6

3. CPCo Analysis EA-ELEC-VOLT-033

4. CPCo Analysis EA-ELEC-VOLT-034

5. CPCo Analysis EA-ELEC-VOLT-17

6. FSAR, Chapter 14

7. CPCo Analysis EA-ELEC-VOLT-13

8. CPCo Analysis A-NL-92-111 Palisades Nuclear Plant B 3.3.5-6 Revised 01/26/2004

• PCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.1 PCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits BASES .

BACI (GROUND These Bases address requirements for maintaining PCS pressure, temperature, and flow rate within limits assumed in the safety analyses.

The safety analyses (Ref. 1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on DNB related parameters ensure that these parameters, when appropriate measurement uncertainties are applied, will not be less conservative than were assumed in the analyses and thereby provide assurance that the minimum Departure from Nucleate Boiling Ratio (DNBR) will meet the required criteria for each of the transients analyzed.

Another set of limits on DNB related parameters is provided in Safety Limit (SL) 2.1.1, "Reactor Core Safety Limits." The restriction of the SLs prevent overheating of the fuel and cladding that would result in the

- release of fission products to the primary coolant. The limits of LCO 3.4.1, in combination with other LCOs, are designed to prevent violation of the reactor core SLs.

The LCO limits for minimum and maximum PCS pressures as measured at the pressurizer are consistent with operation within the nominal operating envelope and are bounded by those used as the initial pressures in the analyses.

The LCO limit for maximum PCS cold leg temperature is consistent with operation at steady state power levels'and is bounded by those used as the initial temperatures in the analyses.

- ~ The LCO limits for minimum PCS flow rate is bounded by those used as the initial flovw rates in the analyses. The PCS flow rate is not

. I. ,II expected to vary during plant operation with all Primary Coolant Pumps running.

Palisades Nuclear Plant B 3.4.1 -1 Revised 08124/2004

PCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE The requirements of LCO 3.4.1 represent the initial conditions for SAFETY ANALYSES DNB limited transients analyzed in the safety analyses (Ref. 1). The safety analyses have shown that transients initiated from the limits of this LCO will meet the DNBR Safety Limit (SL 2.1.1). This is the acceptance limit for the PCS DNB parameters. Changes to the facility that could impact these parameters must be assessed for their impact on the DNBR criterion. The transients analyzed for include loss of coolant flow events and dropped or stuck control rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Regulating Rod Group Position Limits"; LCO 3.2.3, "Quadrant Power Tilt"; and LCO 3.2.4, "AXIAL SHAPE INDEX." I The PCS DNB limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).

LCO This LCO specifies limits on the monitored process of variables PCS pressurizer pressure and PCS cold leg temperature, and the calculated value of PCS total flow rate to ensure that the core operates within the limits assumed for the plant safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient.

The LCO numerical values for pressure and temperature specified in the COLR are given for the measurement location but have not been adjusted for instrument error. Plant specific limits of instrument error I

are established by the plant staff to meet the operational requirements of this LCO. Instrument errors and the PCS flow rate measurement error are applied to the LCO numerical values in the safety analysis.

APPLICABILITY In MODE 1, the limits on PCS pressurizer pressure, PCS cold leg temperature, and PCS flow rate must be maintained during steady state operation in order to ensure that DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES, the power level is low enough so that DNBR is not a concern.

Palisades Nuclear Plant B 3.4.1-2 Revised 08/24/2004

PCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES ACTIONS 'A.1 Pressurizer pressure and cold leg temperature are controllable and measurable pararneters. PCS flow rate is not a'controllable parameter and is not expected to vary during'steady state operation. With any of these parameters not within the LCO limits, action must be taken to restore the parameter.

The 2-hour Completion Time for restoration of the parameters provides sufficient time to adjust plant parameters, to determine the cause of the

' 'off normal condition, and to restore the readings within limits.

The Completion Time is based on plant operating experience.

B.1 If Required Action A.1 is not met within the associated Completion Time, the plant must be brought to'a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. In'MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds.

- Six hours is a reasonable time that permits the plant power to be reduced at an orderly rate without challenging plant systems.

SURVEILLANCE SR 3.4.1.1 and SR 3.4.1.2 REQUIREMENTS .

The Surveillance for monitoring pressurizer pressure and PCS cold'leg temperature is performed using installed instrumentation. The 12-hour

• interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and verify operation is within safety analysis assumptions.

SR. 3.4.1.3..,.

Measurement of PCS total flow rate verifies that the actual PCS flow rate is within the bounds of the analyses. This verification may be performed by a calorimetric heat balance or other method.

The Frequency of 18 months reflects the importance of verifying flow after a refueling outage where the core has been altered, which may have caused an alteration of flow resistance. PCS flow rate must also be verified after plugging of each 10 or more steam generator tubes since plugging 10 or more tubes could result in an increase in PCS flow resistance. Plugging less than 10 steam generator tubes will not have a significant impact on PCS flow resistance and, as such, does not require a verification of PCS flow rate.

Palisades Nuclear Plant B 3.4.1-3 Revised 08124/2004

PCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE SR 3.4.1.3 (continued)

REQUIREMENTS The SR is modified by a Note that states the SR is only required to be performed 31 EFPD after THERMAL POWER is Ž 90% RTP. The Note is necessary to allow measurement of the flow rate at normal operating conditions at power in MODE 1. The most common, and perhaps accurate, method used to perform the PCS total flow surveillance is by means of a primary to secondary heat balance (calorimetric) with the plant at or near full rated power. The most accurate results for such a test are obtained with the plant at or near full power when differential temperatures measured across the reactor are the greatest.

Consequently, the test should not be performed until reaching near full power (i.e., > 90% RTP) conditions. Similarly, test accuracy is also influenced by plant stability. In order for accurate results to be obtained, steady state plant conditions must exist to permit meaningful data to be gathered during the test. Typically, following an extended shutdown the secondary side of the plant will take up to several days to stabilize after power escalation. It is impracticable to perform a primary to secondary heat balance of the precision required for the PCS flow measurement until stabilization has been achieved. Furthermore, an integral part of the PCS flow heat balance involves the use of Ultrasonic Flow Measurement equipment for measuring steam generator feedwater flow. This equipment requires, stable plant operation at or near full power conditions before it can be used. As such, the Surveillance cannot be performed in MODE 2 or below, and will not yield accurate results if performed below 90% RTP.

REFERENCES 1. FSAR, Section 14.1 Palisades Nuclear Plant B 3.4.1-4 Revised 08124/2004

PCS Loops - MODES I and 2 B 3.4.4 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.4 PCS Loops - MODES 1 and 2 BASES . . . . .

BACKGROUND The primary function of the PCS is removal of the heat generated in the fuel due to the fission process and transfer of this heat, via the Steam Generators (SGs), to the secondary plant.

The secondary functions of the PCS include:

a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;

b. Improving the neutron economy by acting as a reflector;

c. :Carrying the soluble neutron poison, boric acid;

d. Providing a second barrier against fission product release to the environment; and

e. Removing the heat generated in the fuel due to fission product decay following a plant shutdown.

The PCS configuration for heat transport uses two PCS loops. Each PCS loop contains an SG and two Primary Coolant Pumps (PCPs). A PCP is located in each of the two SG cold legs'. The pump flow rate has been sized to provide core heat removal with appropriate margin to Departure from Nucleate Boiling (DNB) during power operation and for anticipated transients originating' from power operation. This Specification requires two PCS loops with both PCPs in operation in each loop. The intdnt of "theSpecification is'to require core heat removal with forced flow during power operation. Specifying'two PCS loops provides the minimum necessary paths (two SGs) for heat removal.

APPLICABLE Safety analyses contain various assumptions for the Design Bases SAFETY ANALYSES Accident (DBA) initial conditions including PCS pressure, PCS temperature, reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the primary coolant forced flow rate, which is represented by the number of PCS loops in service.

Palisades Nuclear Plant - B 3.4.4-1 Revised 08/06/2004

PCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABLE Both transient and steady state analyses have been performed to SAFETY ANALYSES establish the effect of flow on DNB. The transient or accident analysis (continued) for the plant has been performed assuming four PCPs are in operation. The majority of the plant safety analyses are based on initial conditions at high core power or zero power. The accident analyses that are of most importance to PCP operation are the Loss of Forced Primary Coolant Flow, Primary Coolant Pump Rotor Seizure and Uncontrolled Control Rod Withdrawal events (Ref. 1).

Steady state DNB analysis had been performed for the four pump combination. The steady state DNB analysis, which generates the pressure and temperature and Safety Limit (i.e., the Departure from Nucleate Boiling Ratio (DNBR) limit), assumes a maximum power level of 110.4% RTP. This is the design overpower condition for four pump operation. The 110.4% value is the accident analysis setpoint of the trip and is based on an analysis assumption that bounds possible instrumentation errors. The DNBR limit defines a locus of pressure and temperature points that result in a minimum DNBR greater than or equal to the critical heat flux correlation limit.

PCS Loops - MODES 1 and 2 satisfy Criteria 2 and 3 of 10 CFR 50.36(c)(2).

LCO The purpose of this LCO is to require adequate forced flow for core heat removal. Flow is represented by having both PCS loops with both PCPs in each loop in operation for removal of heat by the two SGs. To meet safety analysis acceptance criteria for DNB, four pumps are required at rated power.

Each OPERABLE loop consists of two PCPs providing forced flow for heat transport to an SG that is OPERABLE in accordance with the Steam Generator Tube Surveillance Program. SG, and hence PCS loop OPERABILITY with regards to SG water level is ensured by the Reactor Protection System (RPS) in MODES 1 and 2. A reactor trip places the plant in MODE 3 if any SG water level is < 25.9% (narrow range) as sensed by the RPS. The minimum level to declare the SG OPERABLE is 25.9% (narrow range).

In MODES 1 and 2, the reactor can be critical and thus has the potential to produce maximum THERMAL POWER. Thus, to ensure that the assumptions of the accident analyses remain valid, all PCS loops are required to be in operation in these MODES to prevent DNB and core damage.

Palisades Nuclear Plant B 3.4.4-2 Revised 08/0612004

PCS Loops - MODES I and 2 B 3.4.4 BASES APPLICABILITY The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, 5, and 6.

Operation in other MODES is covered by:

' LCO 3A4.5, "PCS Loops-MODE 3";

LCO 3.4.6, "PCS Loops-MODE 4";

LCO 3.4.7, Loops-MODE .PCS 5, Loops Filled";

LCO 3.4.8, "PCS Loops-MODE 5, Loops Not Filled";

LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation-High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation-Low Water Level" (MODE 6).

ACTIONS A.1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the plant to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits. -It should be noted that the reactor will trip and place the plant in MODE 3 as soon as the RPS senses less than four PCPs operating.

The Completion Time of 6 hot&rs is reasonable, bas6d on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety syst6ms.

- .,, - . . I . . . ... . ..

. :, . . . i Palisades Nuclear Plant B 3.4.4-3 Revised 08106/2004

PCS Loops - MODES 1 and 2 B 3.4.4 BASES SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of the required number of loops in operation. Verification may include indication of PCS flow, temperature, or pump status, which help to ensure that forced flow is providing heat removal while maintaining the margin to DNB. The Frequency of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> has been shown by operating practice to be sufficient to regularly assess degradation and verify operation within safety analyses assumptions. In addition, control room indication and alarms will normally indicate loop status.

REFERENCES 1. FSAR, Section 14.1 Palisades Nuclear Plant B 3.4.4-4 Revised 08/06/2004

PCS Operational LEAKAGE B 3.4.13 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.13 PCS Operational LEAKAGE BASES BACKGROUND Components that contain or transport primary coolant to or from the reactor core make up the PCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the PCS.

During plant life, the joint and valve interfaces can produce varying

'amounts of PCS LEAKAGE; through either normal operational wear-or. t . I I - .. . I .

mechanical deterioration. The purpose of the PCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that'do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.

The Palisades Nuclear Plant design criteria (Ref. 1) require means for detecting and, to the extent practical, identifying the source of PCS LEAKAGE.

The safety significance of PCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring primary coolant LEAKAGE intothe containmentarea is necessary. Quickly, separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing.

them to take corrective action should a leak occur detrimental to the safety of the facility and the public.

A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these

>systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with PCS LEAKAGE detection.

This LCO deals with protection of the Primary Coolant Pressure Boundary (PCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a Loss Of Coolant Accident (LOCA).-

Palisades Nuclear Plant IB 3.4.13 . Revised 07/02/2004

.. ..I ..

S, I PCS Operational LEAKAGE B 3.4.13 BASES BACKGROUND As defined in 10 CFR 50.2, the PCPB includes all those pressure-(continued) containing components, such as the reactor pressure vessel, piping, pumps, and valves, which are

(1) Part of the primary coolant system, or (2) Connected to the primary coolant system, up to and including any and all pf the following:

(i) The outermost containment isolation valve ih system piping which penetrates the containment, (ii) The sec od o two valves normally closed during'qormal reactor operation in system piping which does not penetrate the containment, (iii) The pressurizer safety valves and PORVs.

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not SAFETY ANALYSES address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for all events resulting in a discharge of steam from the steam generators to the atmosphere assumes 0.3 gpm primary to secondary LEAKAGE as the initial condition.

Primary to secondary LEAKAGE is a factor in the dose releases outside

(

containment resulting from a Main Steam Line Break (MSLB), Steam Generator Tube Rupture (SGTR) and the Control Rod Ejection (CRE) accident analyses.

The leakage contaminates the secondary fluid.

The FSAR (Ref. 2 and 5) analysis for SGTR assumes the contaminated secondary fluid is released via the Main Steam Safety Valved and Atmospheric Dump Valves. The 0.3 gpm primary to secondary LEAKAG4 is inconsequential, relative to the dose contribution from-the affected SG.

The MSLB (Ref 3 and 5) is more limiting than SGTR for site radiation releases.

The safety analysis for the MSLB accident assumes 0.3 gpm primary to secondary LEAKAGE in one steam generator as an initial condition.

The CRE (Ref 4 and 5) accident with primary fluid release through the Atmospheric Dump Valves is the most limiting event for site radiation releases.

The safety analysis for the CRE accident assumes 0.3 gpm primary to secondary LEAKAGE in one steam generator as an initial condition.

The dose consequences resulting from the SGTR, MSLB and CRE accidents are well within the guidelines defined in 10 CFR 100 and meets the requirements of Appendix A of 10 CFR 50 (GDC 19).

PCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.4.13-2 Revised 07102/2004

PCS Operational LEAKAGE

• B3.4.13 BASES LCO PCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE

-No pressure boundary LEAKAGE from within the PCPB is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in increased LEAKAGE. 'Violation of this LCO could result in continued degradation of the PCPB. LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.  ;

As defined in Section 1.0, pressure boundary LEAKAGE is E* "LEAKAGE`(bxcept'SG'tEAKAGE) through a nonisolable fault in' an l PCS component body, pipe wall, or vessel wall."

b. Unidentified LEAKAGE

- One gallon per minute (gpm) of unidentified LEAKAGE from within the PCPB is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump-level monitoring equipment can detect within a reasonable time period.

• Violation of this LCO could result in continued debradation of the PCPB, if the LEAKAGE is from the pressure boundary.

-c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE from within the PCPB is allowed

- because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is'well within the capability of

'the PCS makeup system. Identified LEAKAGE includes LEAKAGE to the containment from specifically located sources which is known not to adversely affect the OPERABILITY of required leakage detection

'systems, but does 'not include pressu're boundary,,LEAKAGE or controll 'Primary Coolarit Pump (PCP) seal leaioff to the Volume

' Control Tank (a n'ormal function' not considered LEAKAGE). Violation of this LCO could resultfin contiri ed degradation of a component or system. . I e

,, ,  ; dos ntinclud prssr bondr LEKG or : 2

34.1, PCS Pressure lsolatior Valve (PIV) Leakage,"

-:- LCO measures leakage through each individual PIV and can impact this LCO. Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in PCS LEAKAGE when

-the other is leaktight: If both valves leak and result in a loss of mass

-from the PCS, the loss must be included in the allowable identified LEAKAGE. - .

Palisades Nuclear Plant - B 3.4.13-3 Revised 07/02/2004

PCS Operational LEAKAGE B 3.4.13 BASES LCO' d. Primary to Secondary LEAKAGE through Any One SG (continued)

The 432 gallons per day limit on primary to secondary LEAKAGE through any one SG ensures the total primary to secondary LEAKAGE through both SGs produces acceptable offsite doses in the MSLB accident analysis. In addition, the LEAKAGE limit also ensures that SG integrity is maintained in the event of a CRE, MSLB or under LOCA conditions. Violation of this LCO could exceed the offsite dose limits for this accident analysis. Primary to secondary LEAKAGE must be included in the total allowable limit for identified LEAKAGE.

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for PCPB LEAKAGE is greatest when the PCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the primary coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This Completion Time allows time to verify leakage rates and either (

identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the PCPB.

B.1 and B.2 If any pressure boundary LEAKAGE from within the PCPB exists or if unidentified, identified, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the PCPB are much lower, and further deterioration is much less likely.

Palisades Nuclear Plant B 3.4.1 3-4 Revised 07/02/2004

PCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 ., . .

REQUIREMENTS Verifying PCS LEAKAGE to be'within the LCO limits ensures the integrity of the PCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. Unidentified'LEAKAGE and identified LEAKAGE are determined by performance of an PCS Wvater inventory balance. Primary to secondary LEAKAGE is also measured by performance of a PCS water inventory balance in conjunction with effluent monitoring vvithin the secondary steam and feedwater systems.

.The PCS water inventory balance must be performed with the reactordat...............

steady state operating conditions and near operating pressure.'.

Therefore, this SR is modified by a Note which states that the SR is not required to be performed in MODES 3 and 4, until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations'during maneuvering are not useful and a Note requires the Surveillance to be met only when steady state is established. For PCS operational LEAKAGE determination by.water inventory balance, steady state is defined as stable PCS pressure, temperature, power level, pressurizer and'makeup tank levels, makeup and letdown, and PCP seal leakoff.-

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level.

These leakage detection systems 'are 'specified in'LCO 3.4.15, "PCS Leakage Detection Instrumentation."

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency is a reasonable interval to treni LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents: A Note under the Frequency column states that this SR is required to be performed during steady state operatiord.

SR' 3.4.13.2

'This SR pr6vides'the means necessary to determine SG OPERABILITY in an' operational MODE. 'The requirement to demonstrate SG tube integrity in accordance with the Steam Generator Tube Surveillance Program ernphasizes therimportance of SG tube integrity, even though this Surveillance cannotbe' performed at normal operating conditions.

Palisades Nuclear Plant B 3.4.13-5' Revised 07102/2004

PCS Operational LEAKAGE B 3.4.13 BASES REFERENCES 1. FSAR, Section 5.1.5 .1

2. FSAR, Section 14.15

3. FSAR, Section 14.14

4. FSAR, Section 14.16

5. FSAR, Section 14.24

.. I ... I... . .. .~~.- .

Palisades Nuclear Plant B 3.4.13-6 Revised 07/02/2004

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves and devices form part of the containment pressure boundary and provide a means for isolating penetration flow paths. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured) and blind flanges are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analysis.

One of these barriers may be a closed system.

The Containment Isolation System is designed to provide isolation capability following a Design Basis Accident (DBA) for fluid lines that penetrate containment. Major nonessential lines (i.e., fluid systems that do not perform an immediate accident mitigation function) that penetrate containment, except for the main steam lines and instrument air line, are either automatically isolated following an accident or are normally maintained closed in MODES 1, 2, 3, and 4. Containment isolation occurs upon receipt of a Containment High Pressure (CHP) signal or a Containment High Radiation (CHR) signal. However, not all containment isolation valves are actuated by both signals. The signals close automatic containment isolation valves in fluid penetrations that are required to be isolated during accident conditions in order to minimize release of fission products from the Primary Coolant System (PCS) to the environment. Other penetrations that are required to be isolated during accident conditions are isolated by the use of valves or check valves in the closed position, or blind flanges. As a result, the containment isolation devices help ensure that the containment atmosphere will be isolated in the event of a release of fission products to the containment atmosphere from the PCS following a DBA.

Palisades Nuclear Plant B 3.6.3-1 ,Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES BACKGROUND The plant safety analyses (Ref. 5) assume containment isolation for the (continued) mitigation of a Loss of Coolant Accident (LOCA) and a control rod ejection accident. The Main Steam Line Break (MSLB) and Steam Generator Tube Rupture (SGTR) accident analyses assume that the mass of steam from the Steam Generator is released directly to the environment, and no credit is taken for containment isolation to mitigate the radiological consequences of those accidents. Therefore, valves in fluid lines connected directly to the secondary side of the steam generators are not included in this Technical Specification.

The OPERABILITY requirements for containment isolation valves and devices help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment leakage limits assumed in the accident analyses will not be exceeded in a DBA.

The 8 inch purge exhaust valves are designed for purging the containment atmosphere to the stack while introducing filtered makeup, through the 12 inch air room supply valves from the outside, when the plant is shut down during refueling operations and maintenance. The purge exhaust valves and air room supply valves are air operated isolation valves located outside the containment. These valves are operated manually from the control room. These valves will close automatically upon receipt of a CHP or CHR signal. The air operated valves fail closed upon a loss of air. These valves are not qualified for automatic closure from their open position under DBA conditions.

Therefore, these valves are locked closed in MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained.

Open purge exhaust or air room supply valves, following an accident that releases contamination to the containment atmosphere, would cause a significant increase in the containment leakage rate.

APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY ANALYSES related to minimizing the release of fission products from the primary coolant system to the environment, and establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve (device) OPERABILITY supports leak tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO.

Palisades Nuclear Plant B 3.6.3-2 Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES APPLICABLE A Loss of Coolant Accident (LOCA) and a control rod ejection accident SAFETY ANALYSES are the two DBAs that require isolation of containment to minimize (continued) release of fission products to the environment (Ref. 5). In the analysis for each of these accidents, it is assumed that containment isolation devices that are required to be closed during accident conditions are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation devices (including containment purge valves) are minimized. The safety analysis assumes that the purge exhaust and air room supply valves are closed at event initiation.

The DBA analysis assumes that, within 25 seconds after receiving a CHP

- -or CHR signal each automatic power operated valve is closed and containment leakage terminated except for the design leakage rate.

- The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the design of the containment purge valves. Two valves in series on each line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. Both isolation valves on the 8 inch and 12 inch lines are pneumatically operated spring-closed valves.

The 8 inch purge exhaust and 12 inch air room supply valves may be unable to close in the environment following a LOCA. Therefore, each of the purge valves is required to remain locked closed during MODES 1, 2, 3, and 4. In this case, the single failure criterion remains applicable to the coritainment purge valves due to the potential for failure in the control circuit associated with each valve. Again, the purge system valve design precludes a single failure from compromising the containment boundary as long as the system is operated in accordance with the subject LCO.

The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Containment isolation valves form a part of the containment boundary.

-Compliance with this LCO will ensure a containment configuration that will limit leakage to those leakage rates assumed in the safety analyses.

-Containment penetrations fornfluid systems that perform an accident mitigation function are not required to be isolated..,

Palisades Nuclear Plant B 3.6.3 Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES LCO Containment isolation valves (devices) consist of isolation valves (manual (continued) valves, check valves, air operated valves, and motor operated valves),

and blind flanges. There are two major categories of containment isolation devices that are used depending on the type of penetration and the function of the associated piping system:

a. Active - automatic containment isolation devices that, following an accident, either receive a containment isolation signal to close, or close as a result of differential pressure;

b. Passive - normally closed containment isolation devices that are maintained closed in MODES 1, 2, 3, and 4 since they do not receive a containment isolation signal to close and the penetration is not used for normal power operation.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate upon receipt of a CHP or CHR signal as appropriate. Check valves are verified to be OPERABLE through the valve Inservice Testing Program. The purge exhaust and air room supply valves must be locked closed.

The normally closed isolation devices are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, check valves are closed with flow secured through the pipe, or blind flanges are in place.

The devices covered by this LCO are listed in the FSAR (Ref. 2).

The purge exhaust and air room supply valves with resilient seals must meet the same leakage rate testing requirements as other Type C tested containment isolation valves addressed by LCO 3.6.1, "Containment."

This LCO provides assurance that the containment isolation devices will perform their designed safety functions to minimize the release of fission products from the primary coolant system to the environment and establish the containment boundary during accidents.

Palisades Nuclear Plant B 3.6.3-4 Revised 03/0212004

Containment Isolation Valves B 3.6.3 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission products to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not Irequired to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations." -

ACTIONS The ACTIONS are modified by four notes. Note 1 allows isolated penetration flow paths, except for 8 inch exhaust and 12 inch air room

supply purge valve penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the device controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the fact that the 8 inch purge exhaust valves and the 12 inch air room supply valves may be unable to close in the environment following a LOCA and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, these valves may not be opened under administrative controls..

Note 2 provides clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation device. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation devices are governed by subsequent Condition entry and :application of associated Required Actions.

Note 3 ensures that appropriate remedial 'actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation device.. ,

,;, --. - .- E - * . - - ; ,8;

Note 4 requires entry into the applicable Conditions and Required Actions of LCO 36.1 when leakage results in exceeding the overall containment leakage limit. .- '- - - ..

A.1 and A.2 ' -

Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment

' .:isolation valves. For penetration flow paths with only one containment

.'isolation valve and a closed system, Condition C provides appropriate actions. .. . . .

Palisades Nuclear Plant B 3.6.3-5 .Revised 03/02/2004 -

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

In the event one containment isolation valve in one or more penetration flow paths is inoperable (except for purge exhaust or air room supply valves), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation.

Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low.

For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

Palisades Nuclear Plant B 3.6.3-6 Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

The Completion Time of once per 31 days for verifying each affected penetration flow path outside the containment is isolated is appropriate considering that the penetration can be isolated by the remaining isolable device. As stated in SR 3.02, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a 'once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial

- performance. Therefore, for devices outside the containment, while Required Action 3.6.3 A.2 must be initially performed within 31 days

.without any SR 3.0.2 extension,-subsequent performances may utilize the 25% SR 3.0.2 extension.

B.1 With two containment isolation valves in one or more penetration flow paths inoperable (except for purge exhaust valve or air room supply valve not locked closed); the affected penetration flow path must be isolated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is consistent with the ACTIONS of

- LCO 3.6.1. -

In the event the affected penetration is isolated in accordance with Required Action B.1 the affected penetration must be verified to be

isolated on a periodic basis per Required Action A.2, which remains in

effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. - * ,*

-The Completion Time of once per 31 days for verifying each affected

- penetration flow path is isolated is appropriate considering the fact that

- ' the' devices are operated under administrative controls and the probability

- of their misalignment is low. -

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves.

Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

Palisades Nuclear Plant B 3.6.3-7 Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 2. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation barrier and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position.

The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate considering the devices are operated under administrative controls and the probability of their misalignment is low. As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as "once per. . ." however, the 25% extension does not apply to the initial performance on a "once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance.

Therefore, while Required Action 3.6.3 C.2 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

Palisades Nuclear Plant B 3.6.3-8 Revised 03102/2004

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

-Required Action C.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

D.1 The purge exhaust and air room supply isolation valves have not been qualified to close following a LOCA'and are required to be locked closed.

If one or more of these valves is found not locked closed, the potential exists for the valves to be inadvertently opened. One hour is provided to lock closed the affected valves. The 1-hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining these valves closed.

E.1 and E 2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status: the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within'36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. . -'

SURVEILLANCE -SR 3.6.3.1 ':

REQUIREMENTS .. 2.' .,

-This SR'ensures that the 8-inch purge exhaust and 12 inch air room supply valves 're locked'closed as required. If'a valve is open, or closed but not locked, in violation' of this SR, the valve is considered inoperable.

' Valves may be locked closed electrically, mechanically, or by other

', physical means These' lves may be unable'to close in the environment following a LOCA

'Theirefore, ebch of the valves is'required to remain closed during MODES 1, 2, 3, and 4., The 31-day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.2.

Palisades Nuclear Plant B.3.6.3-9. Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.2 REQUIREMENTS (continued) This SR requires verification that each manual containment isolation valve and blind flange located outside containment, and not locked, sealed, or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. This SR does not require any testing or device manipulation. Rather, it involves verification that those containment I isolation devices outside containment and capable of being mispositioned are in the correct position. Since verification of device position for containment isolation devices outside containment is relatively easy, the 31-day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to devices that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation devices, once they have been verified to be in the proper position, is small.

SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. For containment isolation devices inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these containment isolation devices are operated under administrative controls and the probability of their misalignment is low. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time that they are open. This SR does not apply to devices that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Palisades Nuclear Plant B 3.6.3-1 0 Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES SURVEILL ANCE SR 3.6.3.3 (continued)

REQUIREh AFNITI The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification

- by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation devices, once they have been verified to be in their proper position, is small.

SR 3.6.3.4 Verifying that the isolation time of each automatic power operated

'containment isolation valve is within limits is required to demonstrate OPERABILITY. The solation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis.- The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.5 ' ' '

For containment 8 irioh purge exhaust and 12 inch air room supply valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFRI 50, Appendix J, Option B (Ref. 3), is required to ensure the valves are physically closed (SR 3.6.3.1' verifies the valves are locked closed). Operating experience has'demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of 184 days was established as part of the NRC resolution of Generic Issue B-20, "Contairiment Leakage Due to Seal Deterioration" 'Ref. 4) as specified in the Safety Evaluation for

• Amendment N6..90 to the FacilifjOperating License;

• . Di .* . - , -.

.~~~~~ . . ...-'...,,-.

. .  : . I i. I

.. I ; - : . . .I . .., , C. .. : - ,...-- : I -

. .I I. , i.  :: :t : s - .. - -

Palisades Nuclear Plant 8 3.6.3-11 ; Revised 03/02/2004

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.6 REQUIREMENTS (continued) Automatic containment isolation valves close on a containment isolation signal to minimize leakage of fission products from containment following a DBA. This SR ensures each automatic containment isolation valve will actuate to its isolation position on an actual or simulated actuation signal, i.e., CHP or CHR. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency was developed considering it is prudent that this SR be performed only during a plant outage, since isolation of penetrations would eliminate cooling water flow and disrupt normal operation of many critical components. Operating experience has shown that these components usually pass this SR when performed on the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 5.8

2. FSAR, Section 6.7.2 and Table 6-14

3. 10 CFR 50, Appendix J, Option B

4. Generic Issue B-20

5. FSAR, Chapter 14 Palisades Nuclear Plant B 3.6.3-12 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 B 3.6 CONTAINMENT SYSTEMS

. .i B 3.6.6 Containment Cooling Systems BASES

BACKGROUND The Containment Spray and Containment Air Cooler systems provide containment atmosphere cooling to limit post accident pressure and temperature in containment to less than the design values. Reduction of containment pressure reduces the release of fission product radioactivity from containment to the environment, in the event of a Main Steam Line Break (MSLB) or a large break Loss of Coolant Accident (LOCA). The Containment Spray and Containment Air Cooler systems are designed to the requirements of the Palisades Nuclear Plant design criteria (Ref. 1).

The Containment Air Cooler System and Containment Spray System are Engineered Safety Feature (ESF) systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained. The systems are arranged with two spray pumps and one air cooler fan powered from one diesel generator, and with one spray pump and three air cooler fans powered from the other diesel generator.

The Containment Spray System was originally designed to be redundant to the Containment Air Coolers (CACs) and fans. These systems were originally designed such that either two containment spray pumps or three CACs could limit containment pressure to less than design. However, the current safety analyses take credit for one containment spray pump when evaluating cases with three CACs, and for one air cooler fan in cases with two spray pumps and both Main Steam Isolation Valve (MSIV) bypass valves closed. -If an MSIV bypass valve is open, 2 service water pumps and 2 CACs are also required to be OPERABLE in addition to the 2 spray pumps for containment heat removal.

To address this dependency between the Containment Spray System and the Containment Air Cooler System the title of this Specification is "Containment Cooling Systems," and includes 'both systems. The LCO is written in terms of trains of containment cooling. One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header, and Air Cooler Fan V-4A. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray Pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A, and V-3A.

Palisades Nuclear Plant B 3.6.6-1 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES BACKGROUND If reliance is placed solely on one spray pump and three CACs, at least (continued) two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs. Additional details of the required equipment and its operation is discussed with the containment cooling system with which it is associated.

Containment Spray System The Containment Spray System consists of three half-capacity (50%)

motor driven pumps, two shutdown cooling heat exchangers, two spray headers, two full sets of full capacity (100%) nozzles, valves, and piping, two full capacity (100%) pump suction lines from the Safety Injection and Refueling Water Tank (SIRWT) and the containment sump with the associated piping, valves, power sources, instruments, and controls. The heat exchangers are shared with the Shutdown Cooling System. SIRWT supplies borated water to the containment spray during the injection phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the SIRWT to the containment sump.

Normally, both Shutdown Cooling Heat Exchangers must be available to provide cooling of the containment spray flow in the event of a Loss of Coolant Accident. If the Containment Spray side (tube side) of one SDC Heat Exchanger is out of service, 100% of the required post accident cooling capability can be provided, if other equipment outages are limited (refer to Bases for Required Action C.1).

The Containment Spray System provides a spray of cold borated water into the upper regions of containment to reduce the containment pressure and temperature during a MSLB or large break LOCA event. In addition, the Containment Spray System in conjunction with the use of trisodium phosphate (LCO 3.5.5, "Trisodium Phosphate,") serve to remove iodine which may be released following an accident. The SIRWT solution temperature is an important factor in determining the heat removal capability of the Containment Spray System during the injection phase.

Palisades Nuclear Plant B 3.6.6-2 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES BACKGROUND Containment Spray System (continued)

In the recirculation mode of operation, heat is removed from the containment sump water by the shutdown cooling heat exchangers.

The Containment Spray System is actuated either automatically by a Containment High Pressure (CHP) signal or manually.' An automatic actuation opens the containment spray header isolation valves, starts the three containment spray pumps, and begins the injection phase.

Individual component controls may be used to manually initiate Containment Spray. -The injection phase continues until an SIRWT Level Low signal is received. The Low Level signal for the SIRWT generates a Recirculation Actuation Signal (RAS) that aligns valves from the containment spray pump suction to the containment sump. RAS opens

-the HPSI subcooling valve CV-3071, if the associated HPSI pump is operating. After the containment sump valve CV-3030 opens from RAS, HPSI subcooling valve CV-3070 will open, if the associated HPSI pump is operating. RAS will close containment spray valve CV-3001, if containment sump valve CV-3030 does not open. The Containment Spray System in recirculation mode'maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water.

Operation of the Containment Spray System in the recirculation mode is controlled by the operator in accordance with the emergency operating procedures,. .

The containment spray pumps .also provide a required support function

,for the High Pressure Safety Injection pumps as described in the Bases for specification 3.5.2. The High Pressure Safety Injection pumps alone may not have adequate NPSH after a postulated accident and the

,realignment of theirsuctions from the' SIRWT to the containment sump.

, Flow is automatically provided from the discharge of.the containment spray pumps to the suction of the High Pressure Safety Injection (HPSI)

- -pumpsafter the change to recirculation mode has ccurred, if the HPSI

,pumpis operating. The additional suction pressure ensures that

- adequate NPSH is available for the High Pressue' Safety Injection pumps.

Palisades Nuclear Plant B 3.6.6-3 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES BACKGROUND Containment Air Cooler System (continued)

The Containment Air Cooler System includes four air handling and cooling units, referred to as the Containment Air Coolers (CACs), which are located entirely within the containment building. Three of the CACs (VHX-1, VHX-2, and VHX-3) are safety related coolers and are cooled by the critical service water. The fourth CAC (VHX-4) is not taken credit for in maintaining containment temperature within limit (the service water inlet valve for VHX-4 is closed by an SIS signal to conserve service water flow), but is used during normal operation along with the three CACs to maintain containment temperature below the design limits. The fan associated with VHX-4, V-4A, is assumed in the safety analysis as assisting in the containment atmosphere mixing function.

The DG which powers the fans associated with VHX-1, VHX-2, and VHX-3 (V-1A, V-2A and V-3A) also powers two service water pumps.

This is necessary because if reliance is placed solely on the train with one spray pump and three CACs, at least two service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs.

Each CAC has two vaneaxial fans with direct connected motors which draw air through the cooling coils. Both of these fans are normally in operation, but only one fan and motor for each CAC is rated for post accident conditions. The post accident rated "safety related" fan units, V-1A, V-2A, V-3A, and V-4A, serve not only to provide forced flow for the associated cooler, but also provide mixing of the containment atmosphere. A single operating safety related fan unit will provide enough air flow to assure that there is adequate mixing of unsprayed containment areas to assure the assumed iodine removal by the containment spray. The fan units also support the functioning of the hydrogen recombiners, as discussed in the Bases for LCO 3.6.7, "Hydrogen Recombiners." In post accident operation following a SIS, all four Containment air coolers are designed to change automatically to the emergency mode.

The CACs are automatically changed to the emergency mode by a Safety Injection Signal (SIS). This signal will trip the normal rated fan motor in each unit, open the high-capacity service water discharge valve from VHX-1, VHX-2, and VHX-3, and close the high-capacity service water supply valve to VHX-4. The test to verify the service water valves actuate to their correct position upon receipt of an SIS signal is included in the surveillance test performed as part of Specification 3.7.8, "Service Water System." The safety related fans are normally in operation and only receive an actuation signal through the DBA sequencers following an SIS in conjunction with a loss of offsite power. This actuation is tested by the surveillance which verifies the energizing of loads from the DBA sequencers in Specification 3.8.1, "AC Sources-Operating."

Palisades Nuclear Plant B 3.6.6-4 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES APPLICABLE. The Containment Spray System and Containment Air Cooler SAFETY ANALYSES System limit the temperature and pressure that could be experienced following either a Loss of Coolant Accident (LOCA) or a Main Steam Line Break (MSLB). The large break LOCA and MSLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients.,

The Containment Cooling Systems have been analyzed for three accident cases (Ref. 2). All accidents analyses account for the most limiting single active failure.

-1. A Large Break LOCA,

2. An MSLB occurring at various power levels with both MSIV bypass valves closed, and

3. An MSLB occurring at 0% RTP with both MSIV bypass valves open. .

The postulated large break LOCA is analyzed, in regard to containment ESF systems, assuming the loss of offsite power and the loss of one ESF

- bus, which is the worst case single active failure, resulting in one train of Containment Cooling being rendered inoperable (Ref. 6).

The postulated MSLB is analyzed, in regard to containment ESF systems, assuming the worst case single active failure.  ;

- . The MSLB event is analyzed at various power levels with both MSIV bypass valves closed, and at 0% RTP with both' MSIV bypass valves

,. .open: Having any MSIV bypa'ss valve open allo'wsadditional blowdown from the intact steam generator.,

The analysis and evaluation show that under the worst-case scenario, the

-highest peak containment pressure and the peak containment vapor temperature are within the intent of the design basis. (See the Bases for

Specifications 3.6.4, "Containment Pressure," and 3.6.5, 'Containment Air

.:.Temperature," f6r.a detailed discussion.) The analyses and evaluations considered a range of power levels and equipment configurations as described in Re'ference 2. The'pea k containment pressure case is the 0% power MSLB with initial (pre-a cident) conditions of 140OF and

• 16.2 psia. The peak temperature case is the 102% power MSLB with initial (pre-accident)'conditions of,1400F and 15.7 psia. The analyses also assume a response time delayed initiation in order to provide conservative peak calculated containment pressure and temperature

- 'responses.

Palisades Nuclear Plant B 3.6.6-5 .Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES APPLICABLE The external design pressure of the containment shell is 3 psig. This SAFETY ANALYSES value is approximately 0.5 psig greater than the maximum external (continued) pressure that could be developed if the containment were sealed during a period of low barometric pressure and high temperature and, subsequently, the containment atmosphere was cooled with a concurrent major rise in barometric pressure.

The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the Containment High Pressure setpoint to achieve full flow through the CACs and containment spray nozzles. The spray lines within containment are maintained filled to the 735 ft elevation to provide for rapid spray initiation. The Containment Cooling System total response time of < 60 seconds includes diesel generator startup (for loss of offsite power), loading of equipment, CAC and containment spray pump startup, and spray line filling.

The performance of the Containment Spray System for post accident conditions is given in Reference 3. The performance of the Containment Air Coolers is given in Reference 4.

The Containment Spray System and the Containment Cooling System satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO During an MSLB or large break LOCA event, a minimum of one containment cooling train is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header, and air cooler fan V-4A. This train must be supplemented with 2 service water pumps and 2 containment air coolers if an MSIV bypass valve is open. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray Pump P-54A, Containment Spray Valve CV-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-1A, V-2A, and V-3A. To ensure that these requirements are met, two trains of containment cooling must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.

Palisades Nuclear Plant B 3.6.6-6 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES LCO The Containment Spray System portion of the containment cooling trains (continued) includes three spray pumps, two spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the SIRWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

The Containment Air Cooler System portion of the containment cooling train which must be OPERABLE includes the three safety related air coolers which each consist of four cooling coil banks, the safety related fan which must be in operation to be OPERABLE, gravity-operated fan discharge dampers, instruments, and controls to ensure an OPERABLE flow path.

CAC fans V-1A, V-2A, V-3A, and V-4A must be in operation to be considered OPERABLE. 'These fans only receive a start signal from the DBA sequencer; they are assumed to be in operation, and are not started by either a CHP or an SIS signal.

APPLICABILITY In MODES 1, 2, and 3; a large break LOCA event could cause a release of radioactive material to containment and an increase in containment pressure and temperature requiring the operation of the containment spray trains and containment cooling trains.

• In MODES 4,'5 and 6,'the probability and consequences of these events

• are reduced due to the pressure and temperature limitations of these I MODES.;. Thus, the Containment Spray and Containment Cooling systems are not required to be OPERABLE in MODES 4, 5 and 6.

ACTIONS A.1 '- ' I.-, , ; -

- Condition'A is applicable'whenever one or more containment cooling

-trains is inoperable; Action A.1 requires restoration of both trains to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72-hour'Completion Time for

C6rditi6n A is based on the assumption that at least 100% of the required post accident containment cooling capability (that assumed in the safety analys'es) is available. 'If less than 100% of the required post containment

• accident cooling is available, Condition C must also be entered.

Mechanical'system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time

.under conditions when a required system can perform its required safety function, but may not be able to do so assuming an additional failure.

When operating in accordance with the Required Actions of an LCO Condition, it is not necessary to be able to cope with an additional single failure.

Palisades Nuclear Plant B 3.6.6-7 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES ACTIONS A.1 (continued)

The Containment Cooling systems can provide one hundred percent of the required post accident cooling capability following the occurrence of any single active failure. Therefore, the containment cooling function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under that condition, however, the ability to provide the function after the occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

B.1 and B.2 Condition B is applicable when the Required Actions of Condition A cannot be completed within the required Completion Time. Condition A is applicable whenever one or more trains is inoperable. Therefore, when Condition B is applicable, Condition A is also applicable. (If less than 100% of the post accident containment cooling capability is available, Condition C must be entered as well.) Being in Conditions A and B concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition B while the plant is still within the applicable conditions of the LCO.

If the inoperable containment cooling trains cannot be restored to OPERABLE status within the required Completion Time of Condition A, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 Condition C is applicable with one or more trains inoperable when there is less than 100% of the required post accident containment cooling capability available. Condition A is applicable whenever one or more trains is inoperable. Therefore, when this Condition is applicable, Condition A is also applicable. Being in Conditions A and C concurrently maintains both Completion Time clocks for instances where equipment repair restores 100% of the required post accident containment cooling capability while the LCO is still applicable, allowing exit from Condition C (and LCO 3.0.3).

Palisades Nuclear Plant B 3.6.6-8 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES ACTIONS C.1 (continued)

Several specific cases have been analyzed in the safety analysis to provide operating flexibility for equipment outages and testing. These analyses show that action A.1 can be entered under certain circumstances, because 100% of the post accident cooling capability is maintained. These specific cases are discussed below.

One hundred percent of the required post accident cooling capability can be provided with both MSIV bypass valves closed if either;

1. Two containment spray pumps, two spray headers, and one CAC fan are OPERABLE, or

2. One containment spray pump, two spray headers, and three safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon).

One hundred percent of the required post accident cooling capability can be provided for operation with a MSIV bypass valve open or closed if either;

1. Two containment spray pumps, two spray headers, and two safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon), or

2. One containment spray pump, one spray header, and three safety related CACs are OPERABLE (at least three service water pumps must be OPERABLE to provide the necessary service water flow to assure OPERABILITY of the CACs).

If the Containment Spray side (tube side) of SDC Heat Exchanger E-60B is out of service, 100% of the' required post accident cooling capability can be provided, if other equipment outages are limited. One hundred percent of the post accident cooling can be provided with the

-Containment Spray side of SDC Heat Exchanger E-60B out of service if

-the following equipment is OPERABLE: three safety related Containment

. Air Coolers, two Containment Spray Pumps, two spray headers, CCW pumps P-52A and P-52B, two SWS pumps,,and both CCW Heat Exchangers, and if . .

-;1. One CCWContainment Isolation Valve; CV-0910, CV-0911, or

CV-0940, is OPERABLE, and

2. Two CCW isolation valves for the' non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE.

Palisades Nuclear Plant B 3.6.6 . Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES ACTIONS C.1 (continued)

With less than 100% of the required post accident containment cooling capability available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation. This SR also does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct positions prior to being secured.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves outside containment and capable'of potentially being mispositioned, are in the correct position.

SR 3.6.6.2 Operating each safety related Containment Air Cooler fan unit for 2 15 mirnutes ensures that all trains are OPERABLE and are functioning properly. The 31-day Frequency was developed considering the known reliability of the fan units, the two train redundancy available, and the low probability of a significant degradation of the containment cooling train occurring between surveillances.

SR 3.6.6.3 Verifying the containment spray header is full of water to the 735 ft elevation minimizes the time required to fill the header. This ensures that spray flow will be admitted to the containment atmosphere within the time frame assumed in the containment analysis.' The 31-day Frequency is based on the static nature of the fill header and the low probability of a significant degradation of the water level in the piping occurring between surveillances.

SR 3.6.6.4 Verifying a total service water flow rate of 2 4800 gpm to CACs VHX-1, VHX-2, and VHX-3, when aligned for accident conditions, provides assurance the design flow rate assumed in the safety analyses will be achieved (Ref. 8). Also considered in selecting this Frequency were the Palisades Nuclear Plant B 3.6.6-1 0 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 (continued)

REQUIREMENTS known reliability of the cooling water system, the two train redundancy, and the low probability of a significant degradation of flow occurring between surveillances.

SR 3.6.6.5

-- Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. 'Flow

- I and differential pressure are normal tests of centrifugal pump I - - rperformance required by Section XI of the ASME Code (Ref. 5).

Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend peirformince, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.6 and SR 3.6.6.7 SR 3.6.6.6 verifies.each automatic containment spray valve actuates to its correct position upon receipt of an actual or.simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise'secured in the required position under administrative controls.

SR 3.6.6.7 verifies each containment spray pump starts automatically on an actual or simulated actuation signal. 'The 18-month Frequency is based on the need to peiform'these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

• . Operating experience ha's shown that'these components usually pass the Surveillances when performed at the 18 month Frequency. Therefore,

.the Frequency was concluded tb be acceptable from a reliability

- ,- standpoint.; ' '

Where the surveillance'of containment sump isolation valves is also required by SR 3.5.2.5, a single surveillance may be used to satisfy both requirements.  ;

SR 3.6.6.8 This SR verifies each containment cooling fan actuates upon receipt of an actual or simulated actuation signal. The 18-month Frequency is Palisades Nuclear Plant B 3.6.6-1 1 Revised 03/02/2004

Containment Cooling Systems B 3.6.6 BASES SURVEILLANCE SR 3.6.6.8 (continued)

REQUIREMENTS based on engineering judgement and has been shown to be acceptable through operating experience. See SR 3.6.6.6 and SR 3.6.6.7, above, for further discussion of the basis for the 18 month Frequency.

SR 3.6.6.9 With the containment spray inlet valves closed and the spray header drained of any solution, an inspection of spray nozzles, or a test that blows low-pressure air or smoke through test connections can be completed. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Verification following maintenance which could result in nozzle blockage is appropriate because this is the only activity that.could lead to nozzle blockage.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.18

3. FSAR, Sections 6.2

4. FSAR, Section 6.3

5. ASME, Boiler and Pressure Vessel Code, Section Xl

6. FSAR, Table 14.18.1-3

7. FSAR, Table 14.18.2-1

8. FSAR, Table 9-1

9. EA-MSLB-2001-01 Rev. 1, Containment Response to a MSLB Using CONTEMPT-LT/28,'January 2002.

10. EA-LOCA-2001-01 Rev. 1, Containment Response to a LOCA Using CONTEMPT-LT/28, January 2002.

Palisades Nuclear Plant B 3.6.6-12 Revised 03/02/2004

MSSVs B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)

BASES BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection for the secondary system. The MSSVs also provide protection against overpressurizing the Primary Coolant Pressure Boundary (PCPB) by providing a heat sink for the removal of energy

'from the Primary Coolant System (PCS) if the preferred heat sink, provided by the condenser and Circulating Water System, is not available.;.

Twelve MSSVs are located on each main steam header, outside containment,'upstream of the main steam isolation valves, as described in the FSAR, Section 4.3.4 (Ref. 1). The MSSV rated capacity passes the full steam flow at RTP plus instrument error with twenty-three valves full open. This meets the requirements of the ASME Boiler and Pressure Vessel Code,'Section III (Ref. 2). The MSSV design includes staggered lift settings, according to Table 3.7.1-1, in the accompanying LCO, so that only the number of valves needed will actuate. Staggered lift settings reduce the potential for valve chattering because of insufficient steam pressure to fully open all valves following a turbine reactor trip.

APPLICABLE. The design basis for the MSSVs comes from Reference 1; the SAFETY ANALYSES purpose is to limit secondary system pressure to < 110%.of design pressure when passing 100% of design steam flow. This design basis is sufficient to cope with any Anticipated Operational Occurrence (AOO) or accident considered in the Design Basis Accident (DBA) and transient analysis. (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more, times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the

' main condenser, arnd loss of all offsite power.")

. . . . I Palisades Nuclear Plant .B 3.7.1 -- Revised 08/06/2004

MSSVs B 3.7.1 BASES APPLICABLE The events that challenge the MSSV relieving capacity, and thus PCS SAFETY ANALYSES pressure, are those characterized as decreased heat removal events, (continued) and are presented in the FSAR, Sections 14.12 and 14.13 (Refs. 3 and

4) respectfully. Of these, the full power loss of external load event is the most limiting. The event is initiated by either a loss of external electrical load or a turbine trip. No credit is taken for direct reactor trip on turbine trip, the turbine bypass valve, atmospheric dump valves, or pressurizer PORVs. The reduced heat transfer causes an increase in PCS temperature, and the resulting PCS fluid expansion causes an increase in pressure. The PCS pressure increases to < 2614.9 psia, this peak pressure is < 110% of the design pressure, or 2750 psia for the primary system, with the pressurizer safety valves providing relief capacity. The secondary system pressure increases to 1040.8 psia, this pressure is

< 110% of the design pressure, or 1100 psia for the secondary system, with the MSSVs providing relief capability.

The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO This LCO requires twenty-three MSSVs to be OPERABLE in compliance with Reference 2. The OPERABILITY of the MSSVs is defined as the ability to open within the lift setting tolerances and to relieve steam generator overpressure. The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Program.

The lift settings, according to Table 3.7.1-l in the accompanying LCO, correspond to ambient conditions of the valve at nominal operating temperature and pressure.

This LCO provides assurance that the MSSVs will perform their designed safety function to mitigate the consequences of accidents that could result in a challenge to the PCPB.

APPLICABILITY In MODES 1, 2, and 3 a minimum of twenty-three MSSVs are required to be OPERABLE, to provide overpressure protection required by both ASME Code and the accident analysis.

In MODES 4 and 5, there are no credible transients requiring the MSSVs.

The steam generators are not normally used for heat removal in MODES 5 and 6, and thus cannot be overpressurized; there is no requirement for the MSSVs to be OPERABLE in these MODES.

Palisades Nuclear Plant B 3.7.1 -2 Revised 08/06/2004

MSSVs B 3.7.1 BASES ACTIONS A.1 With one or more required MSSVs inoperable, the ability to limit system pressure during accident conditions will be degraded. The four hour Completion Time allows the operator a reasonable amount of time to make minor repairs or adjustments to restore the required number of inoperable MSSVs to OPERABLE status.

B.1 and B.2 If the required MSSVs cannot be restored to OPERABLE status in the associated Completion Time, the'plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE 'SR 3.7.11 REQUIREMENTS This SR verifies the OPERABILITY of the MSSVs by the verification of each MSSV lift settings in accordance with the Inservice Testing Program. The ASME Code, Section Xl (Ref. 5), requires that safety and relief valve tests be performed in accordance with ANSI/ASME OM-1 -1987 (Ref. 6). .According to Reference 6, the following tests are required for MSSVs:

- a.. Visual examination;-

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting); and

d. Compliance with owner's seat tightness criteria.

Palisades Nuclear Plant B 31 1 -3 Revised 08/06/2004

MSSVs B 3.7.1 BASES SURVEILLANCE SR 3.7.1.1 (continued)

REQUIREMENTS The ANSI/ASME Standard requires that all valves be tested every 5 years, and a minimum of 20% of the valves tested every 24 months.

The ASME Code specifies the activities and frequencies necessary to satisfy the requirements.

Table 3.7.1-1 allows a +/- 3% setpoint tolerance for OPERABILITY; however, the valves are reset to + 1% during the Surveillance to allow for drift.

The ambient temperature of the operating environment shall be simulated during the set-pressure'test in accordance with Reference 6.

REFERENCES 1. FSAR, Section 4.3.4

2. ASME, Boiler and Pressure Vessel Code, Section 1II,Article NC-7000, Class 2 Components

3. FSAR, Section 14.12

4. FSAR, Section 14.13

5. ASME, Boiler and Pressure Vessel Code,Section XI, Article IWV-1 000

6. ANSI/ASME OM-1-1987 Palisades Nuclear Plant B 3.7.1-4 Revised 08106/2004

• I 'I AC Sources - Operatihg B 3.8.1 3.8 ELECTRICAL POWER SYSTEMS I. I .

I . . . 7 B 3.8.1 AC Sources - Operating*

. I .

. . I BASES I BACKGROUND The plant Class 1E Electrical Power Distribution System AC sources consist of the offsite power sources, and the onsite standby power sources, Diesel Generators 1-1 and 1-2 (DGs). As required by ,

10 CFR 50,' Appendix A, GDC 17 (Ref. 1), the design of the At electrical power system provides-independence and redundancy-to:.

ensure an, available source of power to the Engineered Safety reature (ESF) systems.

The AC power system at Palisades consists of a 345 kV switchyard, three circuits connecting the plant with off-site power'(station power, startup, and safeguards transformers), the on-site distribution system, and two DGs. The on-site distribution system is divided.irito safety related (Class I-E) and non-safety related portions.

The switchyard interconnects six transmission lines from the off-site transmission system, the output line froh the Covert Generating Station, and the output line from the Palisades main'generator. These lines are connected in a "breaker and a half' scheme between the Front (F) and Rear (R) buses such that any single off-site line miay supply the Palisades station loads when the plant is shutdown.

'Two circuits supplying Palisades 2400 V buses from off-site are fed directly from a switchyard bus through the startup and safeguards transformers. They are available both during operation and during shutdown. The third circuit supplies the plant loads qy "back feeding" through the main generator output circuit and station power.

transformers after the generator has been disconnected by a motor operated disconnect. - -'

The station power transformers are connected into the main generator

'output circuit. Station' power transformers 1-1 and 1-2 connect to the

'generator'22 kV output bus. Station power transformer 1-3 connects to the generator output line 'on the high voltage side of the main transformer.' Station power transformers 1-1 and 1-3 supply non-safety related 4160 V loads during plant power operation and during backfeeding operations. Station power transformer 1-2 can supply both safety related and non-safety related 2400 V loads during plant power operation or backfeeding operation.

B 3.8_.1- Reie 071_.02../2004 . _.__

Nuclear Pln Palisades Nucea Paiae Plant B 3.8.1 -1: - - .- --Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES BACKGROUND The three startup transformers are connected to a common 345 kV (continued) overhead line from the switchyard R bus. Startup transformers 1-1 and 1-3 supply 4160 V non-safety related station loads; Startup Transformer 1-2 can supply both safety related and non-safety related 2400 V loads.

The startup transformers are available during operation and shutdown.

Safeguards Transformer 1-1 is connected to the switchyard F bus. It feeds station 2400 V loads through an underground line. It is available to supply these loads during operation and shutdown.

The onsite distribution system consists of seven main distribution buses (4160 V buses 1A, 1B, IF, and 1G, and 2400 V buses 1C, 1D, and IE) and supported lower voltage buses, Motor Contr6l C6tbrd (MCC6),',aiad ' '

lighting panels. The 4160 V buses and 2400 V bus 1E are not safety related. Buses IC and I D and their supported buses and MCCs form two independent, redundant, safety related distribution trains. Each distribution train supplies one train of engineered safety features equipment.

In the event of a generator trip, all loads supplied by the station power transformers are automatically transferred to the startup transformers.

Loads supplied by the safeguards transformer are unaffected by a plant trip. If power is lost to the safeguards transformer, the 2400 V loads will automatically transfer to startup'transformer 1-2. If the startup transformers are not energized when these transfers occur, their output breakers will be blocked from closing and the 2400 V safety related buses will be energized by the DGs.

The two DGs each supply one 2400 V bus. They provide backup power in the event of loss of off-site power, or loss of power to the associated 2400 V bus. The continuous rating of the DGs is 2500 kW, with 110 percent overload permissible for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The required fuel in the Fuel Oil Storage Tank and DG Day Tank will supply one DG for a minimum period of 7 days assuming accident loading conditions and fuel conservation practices.

If either 2400 V bus,1 C or 1D, experiences a sustained undervoltage, the associated DG is started, the affected bus is separated from its offsite power sources, major loads are stripped from that bus and its supported buses, the DGs are connected to the bus, and ECCS or shutdown loads are started by an automatic load sequencer.

. K Palisades Nuclear Plant B 3.8.1-2 Revised 07/02/2004

- I1' AC Sources.- Operating B 3.8.1 BASES BACKGROUND The DGs share a common fuel oil.storage and transfer system. A (continued). single buried Fuel Oil Storage Tank is used, along with -an individual day .

tank for each DG, to maintain the required fuel oil inventory. Two fuel.

transfer pumps are provided. The fuel transfer pumps are necessary for

• - long-term operation of the DGs. Testing has shown'that each DG

- consumes about 2.6 gallons of fuel oil per minute at 2400 kW. Each day tank is required to contain at least 2500 gallons. Therefore, each fuel oil day tank contains sufficient fuel for more than 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> of full load (2500 kW) operation. Beyond that time, a fuel transfer pump is

• - - required for continued DG operation.

• - . . fuel .Either pump .is..capable ..of.supplying either DG. How.ever,.

. transfer each fuel-transfer pump is not capable, with normally available switching, of being powered from either DG. DG 1-1 can power either.

fuel transfer pump, but DG 1-2 can only power P-1 8A. The fuel oil pumps share a common fuel oil storage tank, and common piping.

• Fuel transfer pump P-18A is powered from MCC-8, which is normally connected to Bus ID (DG 1-2) through Station Power Transformer 12 and Load Center 12. In an emergency, P-18A can be powered from Bus IC (DG'.1-1) by cross-connecting Load Centersl11 and 12. .1

'Fuel transfer-pump P-18B is powered.from MCC-1, which is normally connected to Bus IC (DG 1-1) through Station Power Transformer 19 and Load Center 19. P-18B cannot be powered, using installed equipment, fromBus ID (DG 1-2).

APPLICABLE The safety analyses do not explicitly address AC electrical power. They SAFETY ANALYSES do, however, assume that the Engineered Safety. Features (E.PF) are available. The OPERABILITY of the ESF functions is supported by the

- . AC Power Sources. ., . . ..

• -  :.-The design requirements are.for each assumed safety function to be available under the following conditions: -

a. The occurrence of an accident or transient,

b. The resultant consequential failures,

., -1

' c. A Worst-case single active failure, I

d. Loss of all offsite or all onsite AC power, and

e. The most reactive control rod fails to insert.

Revised 07/02/2004 Palisades Nuclear Plant Palisades Nuclear Plant B 3.8.1-3:

B 3.8.1-3. Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES APPLICABLE One proposed mechanism for the loss of off-site power is'a perturbation SAFETY ANALYSES of the transmission grid because of the loss of the plant's generating (continued) capacity. A loss of off-site power as a result of a generator trip can only occur during MODE 1 with the generator connected to the grid.

However, it is also assumed in analysis for some events in MODE 2, such as a control rod ejection. No specific mechanism for initiating a loss of off-site power when the plant is not on the line is discussed in the FSAR.

.I In most cases, it is conservative to assume that off-site power is lost concurrent with the accident and that the single failure is that of a DG.

That would leave only one train of safeguards equipmeqt to cope with the accident, the other being disabled by the loss of AC power. Those analyses which assume that a loss of off-site power and failure of a single DG accompany the accident-assume 11 seconds from the loss of power until the bus is re-energized. This time includes time for all portions of the circuitry necessary for detecting the undervoltage (relays and auxiliary relays) and starting the DG. Included in the 11 seconds, the analyses also assume 10 seconds for the DG to start and connect to the bus, and additional time for the sequencer to start each safeguards load.

The same assumptions are not conservative for all accident analyses.

When analyzing the effects of a steam or feed line break, the loss of the condensate and feedwater pumps would reduce the steam generator inventory, so a loss of off-site power is not assumed.

In MODE 5 and MODE 6, loss of off-site power can be considered as an initiating event for a loss of shutdown cooling event.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO' Two qualified circuits between the offsite transmission network and the onsiteClass' E Electrical Power Distribution System and an independent DG for each safeguards train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence or a postulated DBA.

K.

Plant Nuclear Plant 3.8.1-4 B 3.8.1-4 Revised 07/02/2004 Palisades Nuclear B Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES LCO- General Design Criterion 17 (Ref. 1) requires, in part, that: "Electric (continued) power from the transmission network to the onsite electric distribution

~.. I system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental t -

.conditions."

The qualified offsite circuits available are Safeguards Transformer 1-1 and Startup Transformer 1-2. Station Power Transformer 1-2 is not qualified as a required source for LCO 3.8.1 since it is not independent of the other.two.offsite circuits. .This LCO.does not prohibit usepf Station Power Transformer to power the 2400 V safety related buses, but the two qualified.sources must be OPERABLE.

• -Each offsite circuit must be capable of maintaining acceptable frequency and voltage, and accepting required loads during an accident, while supplying the 2400 V safety related buses.

Following a loss of offsite power, each DG must be capable of starting and connecting to its respective 2400 V bus. This will be accomplished within 10 seconds after receipt of a DG start signal. Each DG must also

- be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the 2400 V safety related buses.

Proper sequencing of loads and tripping of nonessential loads are required functions for DG OPERABILITY.

APPLICABILITY The AC sources are required to be OPERABLE above MODE 5 to ensure that redundant sources of off-site and on-site AC power are available to support engi6eered safeguards equipment in the event of

an accident or transient. ,-The AC sources also support the equipment necessary for power operation; plant heatups and cooldowns, and

• *'  : shutdown operation. ., . '

The AC source requirements for MODES 5 and 6, and during movement of irradiated fuel assemblies are addressed in LCO 3.8.2, "AC Sources - Shutdown."

Revised 07/0212004 Nuclear Plant Palisades Nuclear Plant B 3.8.1-5 B 3.8.1-5 .I Revised 07/02/2004

I . I AC Sources - Operating B 3.8.1 BASES ACTIONS A.1 To ensure a highly reliable power source remains with the one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result infailure to meet this Required Action. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required'Actions whose-Cborpleti6n Tini' is stated as "onde " '

per. . ." however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per. . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.8.1 A.1 must be initially performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> without any SR 3.0.2 extension, subsequent performances at the "Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />" interval may utilize the 25% SR 3.0.2 extension. .

A.2 According to the recommendations of Regulatory Guide (RG) 1.93 (

(Ref. 2), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to'supply electrical power to the onsite Class 1E Distribution System.

I(

Palisades Nuclear Plant B 3.8.1-6 Revised 07102/2004

• 1Y

- ;AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued) , *.

The 72-hourCompletion Time takes irito account the capacity and '

capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. The second Completion Time for Required Action A.2 establlishes a limit on the maximum -time allowed for any conibination of required AC power sources to be inoperable during any single continuous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This could lead to a total-of.10 days, since.initial.failure to meet the LCO,,to restore_.........e the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 7 days (for a total of 17 days) allowed prior to complete restoration of the LCO. The 10-dayl Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 10 day'Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion ITime must be met.

The Completion Time allows for an exception to the normal "time zero"

for beginning the Completion Time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Co'ndition A was entered.

To ensure a highly reliable power source remains with an inoperable

-DG, it is necessary to verify the availability'of the offsite circuits on a more frequent basis. Since the Required Action bnly) specifies "perform," a failure of SR 3.8.1.1 acceptance criteria hoes not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoplrability, additional

- ' Conditions and Required Actions must then be entered.

B 3.8.1-7 Revised 07102/2004 Nuclear Plant Palisades Nuclear Plant B 3.,8.1-7 . -.Revised 07102/2004

AC Sources - Operating B 3.8.1 BASES ACTIONS B.2 (continued)

In accordance with LCO 3.0.6, the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO for that required equipment.

Required Action B.2 is intended to provide assurance that'a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. Redundant required feature failures consist of inoperable features within a train redundant to the train that has an inoperable DG. If the train that has an inoperable DG contains multiple f6atures redundant to'the'irioi6 rable 'feat'fr eiii the other train, all those multiple features must be declared inoperable. For example, if DG 1-1 and Containment Spray Pump P-54A are inoperable concurrently, Containment Spray Pumps P-54B and P-54C must both be declared inoperable. In this example, if off-site power were lost, neither P-54B nor P-54C would be available.

The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair'any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the Completion Time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on the other train is inoperable.

If at any time during the existence of this Condition (one DG inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required supporting or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for Required Action B.2. Four hours from the discovery of these events existing concurrently, is acceptable because it minimizes risk while allowing time for restoration before subjecting the plant to transients associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost.

Palisades Nuclear Plant B 3.8.1 -8 Revised 07/02/2004-

V - ---

AC Sources.- Operating B 3.8.1 BASES ACTIONS B.2 (continued) .

The 4-hour Completion Time takes into account the OPERABILITY of.

the redundant counterpart to the inoperable required feature.

Additionally, the 4-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a'reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3 provides an allowance to avoid unnecessary

...testing of the OPERABLE. DG. If it can be determined.that the.causp..of.,.

the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2.

(test starting of the OPERABLE DG) does not have to be performed. If the cause of inoperability exists on other'DGs, the other DGs would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be-confirmed to not exist on the remaining DG, performance of SR 3.8.1.2 suffices to provide

assurance of continued OPERABILITY of that DG. I

" In the event the inoperable .DG is restored to OPERABLE status prior to

. completing Required Action B.3.1 or B.3.2 the corrective action system would normally continue to evaluate the common cause possibility.

This continued evaluation, however, is no longer under the 24-hour l constraint imposed while in Condition B. According to Generic

- Lefter.i84-15 (Ref. 3), 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is reasonable to confirm that the OPERABLE DG is not affected by the same problem as the inoperable DG. . '

- BNuclear 3.,1 '9Plat ,I , 0"

• j -, - , . . ,,;

,* *

• I Paliade Nula Plan B. ..-. eisd0/220

AC Sources - Operating B 3.8.1 BASES ACTIONS B.4 (continued)

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System for a limited period. The 7-day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

~~~. I.......

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the o. If Condition Bis' entered`While; for instance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total of 10 days, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 13 days) allowed prior to complete restoration of the LCO. The 10-day Completion Time I provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 7 day and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met. (

As in Required Action B.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

Palisades Nuclear Plant B 3.8.1 -10 Revised 07/02/2004

-iI

' .'*- AC Sources TOperating

.. B 3.8.1 BASES ACTIONS C.1 . . . .

(continued). .,

(cnine)In accordance with LCO 3.0.6 the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO.for that required equipment.

• Required Action C.1, which applies when two required offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result.in a complete loss.of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The rationale for the reduction to i2.hours. is..that. RG ...93. (Ref,.2) repommmends a Completion Time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for two required offsite circuits inoperable, based upon the assumption.that two complete safety trains are

- OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate. These features are powered from redundant

-AC safety trains.

The Completion Time for Required Action C.1 is intended to allowv the operator time to evaluate and repair any discovered Inoperabilities.

.This Completion Time also allows for an.exception to the normal "time zero" for beginning the.Completion Time "clock." In this Required

'Action, the Completion Time only begins on discovery that both:

a. All re4uired offsite circuits are inoperable; and b'. -A required feature is inoperable. -

If at any time during the existence of Condition C (two offsite circuits inoperable),' a required feature becomes inoperable, this-Completion Time begins to be tracked.. . . .

Jj Palisades Nuclear Plant PlsdNulrPa B3.8.1-11 . R

-'Revised 020 07/02/2004

AC Sources - Operating B 3.8.1 BASES ACTIONS C.2 (continued)

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This level of degradation means that the offsite electrical power system does not have the capability to accomplish a safe shutdown and to mitigate the effects of an accident; however, the onsite AC' sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available'to maintain the jlanf ih a safe shutd6wr6 6bdition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst-case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

If two offsite sources are restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide the requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. The 12-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

B 3.8_.12 Reie _0_,/02./2_00_.4 __

Nuclear Pln Palisades Nucea Paiae Plant B 3.8.1-12 Revised 07102/2004

to AC Sources,- Operating B 3.8.1 BASES CTa ACT ,I f% K IC (co ntinued) -

With both DGs inoperable, there are no remaining standby AC sources.

Thus, with an assumed loss of offsite electrical power, no AC source would be available to power the minimum required ESF functions.

Since the offsite electrical power system~n is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause

• grid instability, which could result in a total loss of AC powr). Since an inadvertent generator trip could also result in a total loss of offsite AC

- power, however, .the.time allowed fpr.continued operation. is se ereIy .,

restricted.. The intent here is to avoid the'risk associated with an

-immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to the recommendations of'RG 1.93 (Ref. 2), with both DGs inoperable, operation may continue for a period that should not exceed 21hours. .:.;

- F.1 and F.2 . ' ' ' I If the inoperable AC power sources cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to an operating condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE'5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience,' to reach the required plant conditions from full power conditions in an'orderly manner and without challenging plant systems.,

GCo diio - .  ;  :

- . . lI '

rdCondition G corresponds to a level of degradation in which all

'redundancy in the AC electrical power, supplies has been lost. At this severely degraded level, any further losses in the Ad electrical power system will cause a loss of function. Therefore, no additional time is

.-justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled.shutdown.

Revised 07/02/2004 Plant Palisades Nuclear Plant B 3.8.1-13 B 3.8.1-13 . Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 4).

Periodic component tests are supplemented by extensive functional tests during refueling outages (undersimulated accident conditions).

The SRs for demonstrating the OPERABILITY.of the DGs are in accordance with the recommendations of RG 1.9 (Ref. 5) and RG 1.137 (Ref. 6).

Where the SRs discussed herein specify voltage and frequency tolerances for the DGs operated in the "Unit" mode, the following is applicable. The minimum steady state output voltage of 2280 V is 95%

of the nominal 2400 V'generator'rating. ThisVvalue is aboVe theettlng of the primary undervoltage relays (127-1 and 127-2) and above the minimum analyzed acceptable bus voltage. It also allows for voltage drops to motors and other equipment down through the 120 V level.

The specified maximum steady state output voltage of 2520 V is 105%

of the nominal generator rating of 2400 V. It is below the maximum voltage rating of the safeguards motors, 2530 V. The specified minimum and maximum frequencies of the DG are 59.5 Hz and 61.2 Hz, respectively. The minimum'value assures that ESF pumps provide sufficient flow to meet the accident analyses. The maximum value is equal to 102% of the 60 Hz nominal frequency and is derived from the recommendations given in RG 1.9 (Ref. 5).

Higher maximum tolerances are specified for final steady state voltage and frequency following a loss of load test, because that test must be performed with the DG controls in the "Parallel" mode. Since "Parallel" mode operation introduces both voltage and speed droop, the DG final conditions will not return to the nominal "Unit" mode settings:.

SR 3.8.1.1 This SR assures that the required offsite circuits are OPERABLE. Each offsite circuit must be energized from associated switchyard bus through its disconnect switch to be OPERABLE.

Since each required offsite circuit transformer has only one possible source of power, the associated switchyard bus, and since loss of voltage to either the switchyard bus or the transformer is alarmed in the control room, correct alignment and voltage may be verified by the absence of these alarms.

Pln . . 3.8.-1 Reie 07/02/2004 _. _. __

Palisades Nucea Paiae Nuclear Plant B 3.8.1-14 Revised 07/02/2004

AC Sources - Operating' B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 (continued)

REQUIREMENTS Thel7 day Frequency is adequate because disconnect switch'positions cannot change without operator action and because their status is displayed in the control room.

SR 3.8.1.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the plant in a safe shutdown condition.

. . *. 'J.psS.a .; .-. z@. ,I ,,*@

The monthly test starting of the DG provides assurance that the DG would start and be ready for loading in the time period assumed in the safety analyses. The monthly test, however does not, and is not intended to,-test all portions of the circuitry necessary for automatic starting and loading. The operation of the bus undervoltage relays and their auxiliary relays which initiate DG starting, the control relay, which

• 'initiates DG breaker closure, and the DG breaker closure itself are not verified by this test. Verification of automatic operation of these components requires de-energizing the associated 2400 V bus and cannot be done during plant operation- For this test, the 10-second timing is started when the DG receives a start signal, and ends when the DG voltage sensing relays actuate.. For the purposes of SR 3.8.1.2, the DGs are manually started from standby conditions. Standby conditions for a DG mean the diesel engine is not running, its coolant

'and oil temperatures are being maintained consistent with manufacturer recommendations, and 2 20 minutes have elapsed since the last DG air roll. ,. -

Three relays sense the terminal voltage on each'DG. These relays, in conjunction with a load shedding relay actuated by bus undervoltage, initiate automatic closing of the DG breaker., During monthly testing, the actuation of the three voltage sensing-relays is used as the timing point to determine when the DG is ready for loading..

The 31-day Frequency for performance of SR 3.8.1.2 agrees with the original licensing' basis for the'Palisades plant.

~~:.

_I..,,.:, ,,(

Palisades Nuclear Plant B 3.8.1-15 :. e Na Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 REQUIREMENTS (continued) This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or' equal to the equivalent of the maximum expected accident loads for at least 15 minutes. A minimum total run time of 60 minutes is required to stabilize engine temperatures.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.-

.,Additionally, when paralleled, there, are certain conditions where the protection schemes may not prevent' JG'overloading'ahd 'subsequent' breaker trip and lockout.

The 31-day Frequency for this Surveillance is consistent with the original Palisades licensing basis.

The SR is modified by three Notes. Note 1 states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change. in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated. Note 2 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid (

perturbations. Note 3 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at

'or above the level at which fuel oil is automatically added. The specified level is adequate for a minimum of 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> of DG operation at full load. . '

The 31-day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low-level alarms are provided and plant operators would be aware of any uses of the DG during this period.

Revised 07/02/2004 Nuclear Plant Palisades Nuclear Plant B 3.8.1-16 B 3.8.1-16 Revised 07/02/2004

. AC Sources.- Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 PFPQ 1PFFMPFTq (coni inued) Each DG is provided with an engine overspeed trip to prevent damage.

to the engine. The loss of a large load could cause diesel engine overspeed, which, if excessive,.might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. This Surveillance may be accomplished with the DG in the "Parallel" mode.

-. ' - .. :.An acceptable method is,to.,parallel the.DG withqtae~grid and Ioap the.

DG to a load equal tobr greater than its single largest post-accident

load. The DG breaker is tripped while its voltage and frequency (or speed) are being recorded. The time,-voltage, and frequency tolerances specified in this SR are derived from the recommendations of RG 1.9, Revision 3 (Ref. 5).

RG 1.9 (Ref. 5) recommends that the increase in diesel speed during the transient does not exceed 75% of the difference.

between synchronous speed and the overspeed trip Isetpoint, or 15% above synchronous speed, whichever is lower. The Palisades DGs have a synchronous speed of 900 rpm and an overspeed trip setting'range of 1060tb 1105 rpm. Therefore, the maximum acceptable transient frequency'for this SR is 68 Hz.

'The minimum steady state voltage is specified to provide adequate margin for the switchgear and for both the 2400 and 480 V safeguards motors; the maximum steady state voltage is 2400 +10% V as recommended by RG 1.9 (Ref. 5).

The minimum acceptable frequency is specified to a'sure th't the safeguards pumps powered from the DG would supply adequate flow to meet the safety anralyses. The maximum acceptable steady state frequency is slightly higher than the +2% (61.2 Hz) recommended by RG 1;9 (Ref. 5) because the test must be. performed with the DG controls in the Parallel mode.. The increased frequency allowance of 0.3 Hz is based on the expected speed differential associated with

.-performance of th'e test while in the "Parallel" mode.

The 18-month surveillance Frequency is consistent with the I recommendation of RG 1.9 (Ref. 5).

3.8.1-17 -- - - ' - Revised 07/02/2004 Palisades Nuclear Plant Plant BB 3.8.1-17 - -- Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 REQUIREMENTS (continued) This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This. Surveillance ensures proper engine and generator load response under a complete loss of load.

These acceptance criteria provide DG damage protection. The 4000 V limitation is based on generator rating of 2400/41 60V and the ratings of those components (connecting cables and switchgear) that would experience the voltage transient. While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DGisrnot dededfoi futuie application, including re-connection to the' bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG design power factor limit of 0.8, testing must be performed using a power factor

• 0.9. This is consistent with RG 1.9 (Ref. 5).

The 18-month Frequency is consistent with the recommendation of RG 1.9 (Ref. 5) and is intended to be consistent with expected fuel cycle lengths.

('

SR 3.8.1.7 '

As recommended by RG 1.9 (Ref. 5) this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and re-energizing of the emergency buses and respective loads from the DG.'

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those that are not disconnected from the bus by load shedding relays. They are energized when the DG I

breaker closes. It is not necessary to monitor each permanently connected load.

Q Pl ant._

Nuc ea Plant Pa i a e Nuclear K..evi sed -UA(_1_H1 U U4 Palisades 1: 3. 8.1 -186 Kevisea Ut1UZ/ZUU4

- -AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.7 (continued) . .

REQUIREMENTS .-

The DG auto-start and breaker closure time of 10 seconds is derived .

from requirements of the accident analysisto respond to a design basis

-large break LOCA. Forthis test, the 10-second timing is started when the DG receives a start signal, and ends when the DG breaker closes.

The safety analyses assume .11 seconds from the loss of power until

'the bus is rewenergized.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads that are actuated by the Normal

.... .Shutdown Sequencer. -Each. load should.be startedjto osspre.that the..

DG is capable' of accelerating these loads at the intervals programmed for the Normal Shutdown Sequence. The sequenced pumps may be operating on recirculation flow.

The requirements to maintain steady state voltage and frequency apply to the "steady state" period after all sequenced loads have been started. This period need only.be long enough to achieve'and measure steady-voltage and frequency..

The Surveillance should be continued for.a minimum of 5 minutes in order to demonstrate that all starting transients'have decayed and

...stability has been achieved. -The requirement to supply permanently connected loads for 2 5 minutes, refers to the duration of the DG .

connection to the associated safeguards bus. It'is not intended to require that sequenced loads be operated throughout the 5-minute l period. It is not necessary to monitor each permanently connected

.load. .

The requirement to verify the connectioh and supply of permanently and loading logic. This testing may.be acd6mplished in a y series of

-sequential, overlapping, or total steps so th'at the required connection and loading sequence is verified.

The'Frequency.of 18 months is consistent with the recommendations of

- .RG1.9 (Ref. 5).. .,.:..,'

This SR.is modified by a Note. The reason forWthe Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system 'and challenge safety systems.

Palisades Nuclear Plant t B 3.8.1-19R - Revised 0 07/02/2004

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 REQUIREMENTS (continued) RG 1.9 (Ref. 5) recommends demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 2 120 minutes of which is at a load above its analyzed peak accident loading and the remainder of the time at a load equivalent to the continuous duty rating of the DG. SR 3.8.1.8 only requires 2 100 minutes at a load above the OG analyzed peak accident loading. The 100 minutes required by the SR satisfies the intent of the recommendations of the RG, but allows some tolerance between the time requirement and the DG rating. Without this

.. tolerance, the load would have to be reduced at precisely 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to satisfy the SR without 'exceeding the" ianufacturb's igtirid of MIe DG:.'

The DG starts for this Surveillance can be performed either from standby or hot conditions.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG design power factor limit of 0.8, testing must be performed using a power factor of

• 0.9. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The 18-month Frequency is consistent with the recommendations of RG 1.9 (Ref. 5).

(.

3.8.1-20 Revised 07/02/2004 Nuclear Plant Palisades Nuclear Plant BB 3.8.1-20 Revised 07/02/2004

AC Sourc~es , Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 .

REQUIREMENTS (continued) As recommended byRG 1.9.(Ref. 5), this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned to ready to load status when offsite power is restored. .The test is performed while the I I. . -

DG is supplying its associated 2400 V bus, but not necessarily carrying the sequenced accident loads. The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open, the automatic load sequencer is reset, and the DG controls are returned to "Unit."

During the peri6d wheh the DG is paralleled to the grid,.it must'be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the

-protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

Th6 Frequencyof 18 mbnths is consistent with the recommendations of

• RG 1.9 (Ref. 5). '  : ' ' .I

. This SR is modified by.a Note. The reason for the Note is that

'performingthe Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

, .1 I

J %:

I evsd0/220 B 381 Nula Pln Palisades Nuclear Plant -

Palisades~~~~~

. . 3.8.1-21 --Revised 07/02/2004

_- _L

- -- -- -- -- -- - -- --- Jp AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 REQUIREMENTS (continued) If power is lost to bus IC or 1D, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to'motor breakers to prevent overloading of the DGs by concurrent motor starting currents. The 0.3-second load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltag6 prior to applying the next load and ensures that safety analysis assumptions regarding ESF equipment time delays are met. Logic Drawing E-17 Sheet 4 (Ref. 7) provides a summary of the automatic loading of safety related buses.

The Frequency of 18 months is cohsistent witth thbe recom66riend'a'tid-ns'6of RG 1.9 (Ref. 5), takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the. Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.11 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the

(

fuel, PCS, and containment design limits are not exceeded.

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those that are not disconnected from the bus by load shedding relays. They are energized when the DG I breaker closes. It is not necessary to monitor each permanently connected load. The DG auto-start and breaker closure time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. For this test, the 10-second timing is started when the DG receives a start signal, and ends when the DG breaker closes. The safety analyses assume I

11 seconds from the loss of power until the bus is re-energized.

K Revised 07/02/2004 Plant Nuclear Plant Palisades Nuclear B 3.8.1-22 B 3.8.1 -22 Revised 07/02/2004

- AC Sources --Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued) ,'

REQUIREMENTS In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads that are actuated by the DAl Sequencer. Each load should be started to assure that the DG is, capable of accelerating these. loads.at-the intervals programmed for the,,..,,,..,^,...,....,.

DBA Sequence. :Since'the containment spray pumps do,not actuate on SIS generated by Pressure Low Pressure, the test should be performed such that spray pump starting by the sequencer is also verified along with the other SIS loads. The sequenced pumps may be operating on recirculation flow or in other testing modes. The requirements to maintain steady ,State voltage and frequency apply to the "steady state" period afterall sequenced loadshave been started. This period need only be long enough to achieve and measure steady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has 'been achieved:'Th6 requirement to supply permanently connected ioads form 5 minutes, refers to the duration of the DG connection to the associated 2400 V bus. It is not intended to require that sequenced loads be operated throughout the 5-minute period. It is l not necessary to monitor each permanently connected load.

The Frequency, of 18 months takes into consideration, plant conditions required to perform the Su'rveillance and is intended tp be con'sistent with an ex06cted fuel cyclejehnth of 18 rmonths.'

This SR is modified by a Note. The reason for'the N~te is that

performing the Surveillance would remove a required offsite circuit from

,service, perturb th'e electrical distribution system, and challenge safety

. systems.

Revised 07/02/2004 Nuclear Plant Palisades Nuclear Plant 6 3.8.1-23 B 3.8.1-23 -Revised 07/02/2004

AC Sources - Operating B 3.8.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 17

2. Regulatory Guide 1.93, December 1974

3. Generic Letter 84-15, July 2, 1984

4. 10 CFR 50, Appendix A, GDC' 18

5. Regulatory Guide 1.9, Rev. 3, July 1993

6. Regulatory Guide 1.137, Rev-.1, October 1979

7. Palisades 'Logic' Drawing E'1i7,"Sheet4'

(

K Palisades Nuclear Plant B 3.8.1-24 Revised 07/02/2004