ML093450485

Request for Amendment to TS Table 3.3.5-1,Engineered Safety Features Actuation System Instrumentation, and Figure 3.5.5-1, Minimum Required Refueling Water Tank (RWT) Volume & Supporting Changes

ML093450485
Person / Time
Site:	Palo Verde
Issue date:	11/30/2009
From:	Mims D Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-06099-DCM/DFS
Download: ML093450485 (50)

Text

10 CFR 50.90 Z-A L A subsidiaryof Pinnacle West CapitalCorporation Dwight C. Mims Mail Station 7605 Palo Verde Nuclear Vice President Tel. 623-393-5403 P. 0. Box 52034 Generating Station Regulatory Affairs and Plant Improvement Fax 623-393-6077 Phoenix, Arizona 85072-2034 102-06099-DCM/DFS November 30, 2009 Attn: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3 Docket Numbers STN 50-528, 50-529, and 50-530 Request for Amendment to Technical Specification Table 3.3.5-1, Engineered Safety Features Actuation System Instrumentation, and Figure 3.5.5-1, Minimum Required Refueling Water Tank (RWT)

Volume and Supporting Changes Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests to amend PVNGS Operating License Numbers NPF-41, NPF-51, and NPF-74, by amending the PVNGS Technical Specifications (TS) incorporated by Appendix A to the Operating Licenses for PVNGS Units 1, 2, and 3. The proposed amendment changes the licensing basis to credit an existing manual operator action to isolate the RWT in order to preclude the potential for air entrainment from the RWT following a Recirculation Actuation Signal (RAS). Air entrainment is a potential concern for a limited number of small break Loss of Coolant Accident (LOCA) scenarios following a RAS. The change in the credited function results in supporting changes including:

raising the RWT low level Allowable Values for the RAS, raising the RWT minimum required volume, and implementation of a time critical operator action to close the RWT isolation valves, including consideration of a potentially more limiting single failure of a Low Pressure Safety Injection (LPSI) pump to automatically stop, as designed, at RAS.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Ae*_f Callaway 0 Comanche Peak 0 Diablo Canyon 0 Palo Verde 0 South Texas 0 San Onofre 0 Wolf Creek

NRC Document Control Desk Request for Amendment to Technical Specification Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes Page 2 The limited potential for air entrainment with the current RWT design has been determined not to significantly affect the continued operation of any associated ESF system. This proposed change will preclude the possibility of air entrainment from the RWT following a RAS for all LOCA scenarios. This license amendment is being requested to fulfill Commitment 2 of APS Letter Number 102-05910, titled: "Nine-Month Response to NRC Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems," dated October 14, 2008 (ADAMS Accession No. ML082940032). Approval of the proposed amendment is requested by November 30, 2010. Once approved, APS will implement the amendment within 90 days.

APS is making no new commitments with this proposed amendment.

In accordance with the PVNGS Quality Assurance program, the Plant Review Board and the Offsite Safety Review Committee have reviewed and concurred with this proposed amendment. By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91(b)(1).

Should you need further information regarding this amendment request, please contact Russell A. Stroud, Licensing Section Leader, at (623) 393-5111.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on /C/ 0 Sincerely, 4C1J DCM/

Enclosure:

Evaluation of the Proposed Change (with attachments) cc: E. E. Collins Jr. NRC Region IV Regional Administrator J. R. Hall NRC NRR Project Manager R. I. Treadway NRC Senior Resident Inspector for PVNGS A. V. Godwin Arizona Radiation Regulatory Agency (ARRA)

T. Morales Arizona Radiation Regulatory Agency (ARRA)

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

Subject:

Request for Amendment to Technical Specification Table 3.3.5-1, Engineered Safety Features Actuation System Instrumentation, and Figure 3.5.5-1, Minimum Required Refueling Water Tank Volume and Supporting Changes

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION

3. TECHNICAL EVALUATION

4. REGULATORY EVALUATION 4.1. Applicable Regulatory Requirement / Criteria 4.2. Precedent 4.3. No Significant Hazards Consideration Determination 4.4. Conclusions

5. ENVIRONMENTAL CONSIDERATIONS

6. REFERENCES ATTACHMENTS:

1. Proposed Technical Specification Changes (mark-up)

2. Revised (clean) Technical Specification Pages

3. Proposed Changes to Technical Specification Bases Pages (for information only)

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

1.

SUMMARY

DESCRIPTION

Background

The Combustion Engineering System 80 interface requirements for Palo Verde Nuclear Generating Station (PVNGS) UFSAR Sections 6.3.1.3.M and 6.5.2.7.A specified that the junction of the suction lines from the Refueling Water Tank (RWT) and the containment sump be placed at an elevation of no less than 16 feet below the minimum containment water level during a Loss of Coolant Accident (LOCA). This requirement was established to ensure sufficient pressure from containment at the junction such that air would not be introduced into the Emergency Core Cooling System (ECCS) and Containment Spray (CS) pumps from the RWT during transfer of the suction to the containment sump. The intent of this interface requirement was to create a differential pressure between the containment sump and the RWT to ensure no air entrainment into the ECCS and CS pumps. This interface requirement was conservatively implemented at PVNGS with the actual plant configuration providing almost 40 feet of elevation between the minimum containment water level and the suction line junction. However, the design analyses did not fully address dynamic conditions present during the period immediately following a Recirculation Actuation Signal (RAS).

On October 11, 2005, based upon NRC questions and subsequent Arizona Public Service Company (APS) engineering review, APS concluded that existing design analyses did not adequately address the possibility of air entrainment into the ECCS and CS pumps from the RWT following a RAS. Accordingly, Unit 2 and Unit 3 initiated Technical Specification (TS) required shutdowns (Unit 1 was already shutdown for scheduled refueling and maintenance). The NRC subsequently issued a non-cited violation of 10 CFR 50, Appendix B, Criterion Ill, "Design Control," to APS related to the potential for air entrainment in the ECCS suction header from the RWT.

Since the suction path from the RWT is not automatically isolated, the head difference between the containment sump and the RWT at low containment pressure conditions (smaller LOCA break sizes) could result in continued drawdown of the RWT following a RAS until operators close the RWT suction isolation valves or until pressures are balanced between the containment sump and RWT. The dynamic conditions during this drawdown period were subsequently evaluated, and it was demonstrated that though some air could be entrained during these smaller break LOCAs, there would be no degradation of ECCS pump performance during suction transfer from the RWT to the containment sump 1 . However, a mechanistic, quantitative analysis sufficient to support the intent of the original design basis of no entrained air (not including soluble gasses) had not been established.

APS subsequently implemented emergency operating procedure changes to direct a.

manual trip of the redundant CS pump following the start of a LOCA event to maintain a 1 Palo Verde Nuclear Generating Station - NRC Supplemental Inspection Report 05000528/2005012; 05000529/2005012; and 05000530/200501, January 27, 2006, Enclosure, pages 9 and 10.

1

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes higher containment pressure at the RAS and provide additional margin with respect to air entrainment from the RWT. In addition, APS has now completed design evaluations for permanent plant modifications that will preclude the possibility of air entrainment in the Engineering Safety Features (ESF) pump suction during a LOCA event. The result of these evaluations is contained in this license amendment request and includes a TS amendment to: 1) raise the RAS Allowable Value to provide sufficient RWT transfer volume; and 2) raise the minimum required RWT level to ensure sufficient injection volume is available at the new (higher) RAS setpoint. Both of these TS changes are in support of crediting a time critical operator action to manually close the RWT isolation valves CH-530 and CH-531 to isolate the RWT from the ESF pump suction piping after a RAS. The current plant procedures instruct the operators to manually close these valves sometime after a RAS; however, that action is not currently credited for RWT isolation.

During the evaluation of the above changes, APS recognized and evaluated a single failure that was not previously considered during RWT drain down evaluations following a RAS. This failure is a Low Pressure Safety Injection (LPSI) pump failure to automatically stop, as designed, on a RAS. Evaluation of this failure has determined that it has a minimal probability of occurrence and its increased effect on risk to the plant is not significant. Therefore, the previously analyzed single failure remains the licensing basis bounding failure.

Summary This enclosure supports an APS request to amend Operating License NPF-41, NPF-51, and NPF-74, by amending the PVNGS TS incorporated by Appendix A to the Operating Licenses for PVNGS Units 1, 2, and 3. The proposed amendment will raise RWT low level Allowable Values for the RAS provided in TS Table 3.3.5-1, raise the minimum required RWT volume shown in TS Figure 3.5.5-1, and implement a time critical operator action to close the RWT Isolation Valves including consideration of a potentially more limiting single failure of a LPSI pump to automatically stop, as designed, at a RAS.

2. DETAILED DESCRIPTION The proposed license amendment:

• Modifies Table 3.3.5-1 of TS 3.3.5, Engineered Safety Features Actuation System Instrumentation, to increase the RWT low level Allowable Values for a RAS from "> 6.9 and < 7.9%" to '5 9.15 and < 9.65%" (PVNGS Calculation 13-JC-CH-0209, Revision 9, "Refueling Water Tank Level Measurement," Reference 6.1). This change will ensure that a larger water volume is maintained above the RWT vortex breaker during the post-accident ECCS recirculation mode (after a RAS) before the RWT is isolated. The additional volume will support crediting closure of the RWT isolation valves before reaching a RWT level where air could be entrained into the ESF pump suction piping. Note (d) of the TS table has been applied to the RAS setpoint. This note provides guidance on evaluating as-2

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes found conditions and ensuring that setpoints are reset properly within allowed tolerances for continued operability. This note applied similar guidance in the precedent provided by the approval of License Amendment 157 for Units 1, 2, and 3, dated November 16, 2005 (ADAMS Accession No. ML053130215) and the guidance provided in Technical Specification Task Force (TSTF) 493, "Clarify Application of Setpoint Methodology for LSSS Functions," which was recently issued for comment by the NRC. APS previously committed in letter no. 102-05305 (ADAMS Accession No. ML052080046), to continue to work with the industry on the finalization of the pending TSTF technical specification change and adopt the applicable changes.

• Increases the minimum required RWT volume in Figure 3.5.5-1 of TS 3.5.5, from 601,000 gallons at 210°F to 611,000 gallons at 21 0°F to accommodate the proposed (higher) RAS setpoint Allowable Values. Additionally, the minimum RWT volume at 565 0 F will be increased from 624,000 gallons to 634,000 gallons.

The minimum RWT volume between 210°F and 565°F shown in TS Figure 3.5.5-1 is also increased proportionally per APS Calculation 1.3-JC-CH-0209 (Reference 6.1). This change will ensure sufficient borated water is delivered from the RWT during the ECCS injection mode before switchover occurs at the proposed (higher) RAS setpoint.

• Credits time critical manual closure of RWT isolation valves CH-530 and CH-531 to isolate the tank from the ESF pump suction piping after a RAS. The current plant procedures instruct operators to manually close these valves sometime after a RAS; however, that action is not credited for RWT isolation. To preclude the potential for air entrainment during RWT drain down following a RAS for a limited number of small break LOCA scenarios, valves CH-530 and CH-531 will now be required to be closed to isolate the RWT within eight minutes after a RAS. The proposed change to credit closure of these valves makes the existing operator action time critical. That is, the operators will still be required to close valves CH-530 and CH-531 following a RAS; but, now the action will be required to be completed within the specific period after the signal has occurred. This will ensure, for any LOCA break size, the RWT is isolated before its water level reaches the point where air could be entrained and operation of the ESF pumps could be compromised.

• Evaluates a single failure that was not previously considered during the analysis of RWT drain down following a RAS. Certain LOCA break sizes could result in conditions where the RWT would continue to drain and the vortex breaker would be uncovered. Evaluation of these LOCA scenarios identified that a failure of the LPSI pump to automatically stop, as designed, on a RAS, may potentially be more limiting than the bounding single failure previously analyzed for drain down of the RWT after a RAS. Evaluation of this failure, however, has determined that it has a minimal probability of occurrence and its increased effect on risk is not 3

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes significant. Therefore, the previously analyzed single failure will remain the licensing basis bounding failure.

These proposed changes do not affect any hardware or instrument uncertainties. That is, the proposed amendment will not change the elevations of the existing RWT overflow nozzle, the high suction nozzle, the vortex breakers, or the ESF pump suction nozzles. The associated post-modification instrument uncertainties and tolerance bands will not be affected. The proposed changes maintain sufficient volume in the RWT to ensure the applicable RWT design functions continue to be met.

PVNGS is a three-unit facility that shares common TS pages and implementation of these TS changes for each of these units will be completed over time as the associated modifications are completed. The format of this change will be to add additional TS pages in support of this proposed amendment (i.e., After RWT TS setpoint changes).

The additional pages for the After RWT TS setpoint change will be applicable for Units that have implemented the proposed changes contained in this submittal. The current TS pages are revised to indicate that they are the Pre-RWT TS setpoint changes and will continue to be applicable for Units with the existing RWT setpoints. TS Bases pages will also be changed to reflect the Pre-RWT and After RWT setpoint changes.

When the three units have implemented the proposed changes contained in this submittal, APS will submit a license amendment request to remove the pages related to the Pre-RWT TS setpoint changes that no longer apply.

3. TECHNICAL EVALUATION The intent of TS 3.3.5 and TS 3.5.5 is to maintain sufficient water volume in the RWT such that it will fulfill its safety function. During a LOCA, the ESF pumps inject borated water from the RWT into the Reactor Coolant System (RCS) and Containment. This is known as the ECCS injection mode. At a pre-determined level in the RWT (RAS setpoint), the source of water for the ESF pumps is changed from the RWT to the containment sump. Automatic alignment of the ESF pump suction to the containment sump at a RAS initiates the switchover to the ECCS recirculation mode. This switchover must occur before the RWT empties to ensure no potential degradation of the ESF pumps (which could impact core and/or containment cooling capability).

However, switchover must only occur after a sufficient amount of water has been transferred from the RWT to support pump suction from the containment sump (to ensure adequate Net Positive Suction Head (NPSH) for the pumps). Furthermore, enough borated water must be transferred from the RWT to ensure the reactor remains subcritical following a LOCA.

PVNGS TS Figure 3.5.5-1 defines the minimum required RWT volume. This requirement ensures adequate volume in the RWT to meet the following three functions:

• The RWT contains sufficient borated water to support the ECCS and Containment Spray System (CSS) during the post-accident injection mode, 4

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

• The containment sump will contain sufficient borated water at the time that transfer to the recirculation mode occurs to support continued operation of the ESF pumps and sump screen coverage, and

" There is sufficient borated water to maintain the reactor in a subcritical condition following a LOCA.

Currently, operators are directed by procedure to isolate the RWT following a RAS; however, this action is not time dependent. Based on the potential for air entrainment during a limited range of small break LOCAs, RWT isolation will now be completed within a specific period following a RAS. The proposed TS change to raise the RAS Allowable Values (TS Table 3.3.5-1) is to accommodate the time necessary for the operators to perform this action before the RWT vortex breaker could be uncovered. To ensure a sufficient volume of borated water is transferred from the RWT before a RAS, the minimum RWT levels (TS Figure 3.5.5-1) must also be raised.

This submittal satisfies the commitment to submit a license amendment request made in APS Letter Number 102-05910, "Nine-Month Response to NRC Generic Letter 2008-01, 'Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems'," dated October 14, 2008 (ADAMS Accession No. ML082940032)(Reference 6.2). Commitment 2 on page 6 of that letter states the following:

"Designchange SI-1057 and associated design basis document changes will be developed to support a proposed TS amendment to preclude the possibility of air entrainment from the RWT into SI system suction piping during the transferto recirculation. This change includes raising the RAS set point and associateddesign calculationsand requires NRC approvalof a license amendment request (LAR).

The LAR will include a revision to the UFSAR describing the required closure of the RWT outlet valves by control room operatorswithin a prescribed condition.

Associated Licensing Bases changes include a revision to reflect that proper initiation of recirculationis required to preclude excessive air entrainmentfrom either the RWT or the containment sump and to the UFSAR to describe the additional design requirementsnecessary to preclude the possibility of drawing air from the RWT to the safeguardpump suction during recirculation. The LAR will be submitted by 11/30/2009."

In addition, there are UFSAR changes that describe and support the proposed amendment. Those UFSAR changes are summarized below and will be implemented as a part of the implementation of the approved license amendment.

Current Design and Licensing Basis The RWT is described in UFSAR Sections 6.3.1.2 and 9.3.4.1.2. Storage of fluid for the Safety Injection System (SIS) is accomplished by the RWT, which contains a sufficient amount of borated water to accomplish the ECCS functional requirements. The RWT is designed such that the minimum volume of borated water is available to support ECCS and CSS operation.

5

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes UFSAR Section 9.3.4.4.3 provides that upon receipt of a Safety Injection Actuation Signal (SIAS), the ESF pumps take suction from the RWT and continue to drain the tank until a RAS, at which point the ESF pumps switch suction to the Emergency Recirculation Sump. The operators then manually isolate the RWT by closing valves CH-530 and CH-531.

UFSAR Section 6.3.2.7 provides that the two modes of ECCS operation, injection and recirculation, are automatically initiated by a SIAS and a RAS, respectively. Operator action is required to close the RWT discharge valves after verifying the containment sump discharge valves have opened after receiving a RAS.

UFSAR Question 6A.42 (NRC Question 440.21) addresses the time required to complete the sequence of actions included in the transfer from ECCS injection to ECCS recirculation. The APS response states that the transfer from injection to recirculation occurs automatically upon receipt of a RAS and that after the containment sump valves are opened, the operators may close the RWT isolation valves manually from the control room. The response notes that the closure of these valves is not mandatory for proper ECCS performance given that the Combustion Engineering (CE) interface requirement for piping design and component elevations precludes the possibility of drawing air from the RWT to the ESF pump suction during recirculation.

UFSAR Question 6A.43 (NRC Question 440.22) addresses RWT sizing and the necessary water volumes to accommodate the following considerations: 1) instrument error, 2) working allowance, 3) transfer allowance, 4) single failure, and 5) unusable volume. Transfer allowance refers to the volume of water that is available to supply the ESF pumps during the time needed to complete the transfer process from injection to recirculation. The response states that the operator is allowed to close the RWT discharge valves after verifying that the transfer is complete and notes that should the operator fail to close the RWT discharge valves, compliance with the CE interface requirements for physical arrangement ensures sufficient pressure at the ESF pump suction to prevent ingress of air from the RWT. Single failure refers to the ECCS system single failure that would result in larger volumes of water being needed for the transfer process. In this situation, the single failure of a single ECCS train to realign to the containment sump at a RAS results in the continuation of large RWT outflows and reduces the time available for the manual recirculation switchover before the tank is drawn dry and the operating ECCS pumps are damaged. The response states that should the sump valve in one train fail to open following a RAS, position indication of this valve in the control room will indicate the failure, and the operator can secure the respective ESF pumps from the control room to prevent their damage. Usable volume refers to the amount of water above the suction pipes plus an additional volume that may be needed due to NPSH considerations and vortexing tendencies within the tank.

The response states that vortexing tendencies within the tank are precluded by a suction cage inside the tank, and the minimum required RWT level and volume are the useful level and volume above the volume that is unusable due to vortex considerations.

The response also states that the RWT is at a sufficient height such that the ESF pump 6

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes required NPSH is exceeded by a significant margin and RWT level is not a limiting condition for NPSH considerations.

Design and Licensing Basis Changes The CE interface requirements specified criteria for the physical arrangement of the ESF pump suction piping to preclude air entrainment from the RWT after a RAS and suction transfer to the containment sump. However, the adequacy of this interface requirement was questioned by the NRC during an inspection performed in 2005 (Condition Report/Disposition Request (CRDR) 2835132 - APS corrective action program documentation of NRC 95002 Inspection concern on RAS performance -

October 6, 2005, Reference 6.3). It has subsequently been determined that the physical arrangement of the piping as specified in the CE interface requirements may not prevent air entrainment from the RWT for the full range of break sizes as originally intended. An engineering evaluation confirmed that air entrainment is a potential concern for a limited range of small break LOCA sizes that result in a RAS. As a result, the proposed changes will credit closure of the RWT isolation valves (CH-530 and CH-531) once a RAS signal is received and operators verify containment sump isolation valves are open to preclude the possibility of uncovering the vortex breaker during any LOCA scenario. Although the RWT isolation valves have always been closed, per procedure, to isolate the RWT post-RAS, their closure was not credited or time dependent. However, to ensure mitigation of the full range of LOCA breaks these valves are now credited to close within a specified time. This is considered a change to the credited function of the RWT isolation valves which requires NRC review and approval, pursuant to 10 CFR 50.59 and 10 CFR 50.90.

The proposed changes to TS Table 3.3.5-1 support the time-critical closure of the RWT isolation valves after a RAS. The RAS setpoint and associated Allowable Values (the maximum and minimum values that establish the As-Found calibration tolerance band of the RAS setpoint) are being raised to accommodate the execution of the operator action and closure of the valves to preclude the possibility of uncovering the vortex breaker and the potential for air entrainment from the RWT following switchover. In addition, the proposed increase in the minimum RWT levels in TS Figure 3.5.5-1 ensures sufficient borated water is delivered from the RWT before switchover occurs at the proposed (higher) RAS setpoint.

Summary of UFSAR Changes The following UFSAR changes will be made in support of this proposed change:

• Add timely operator action discussion to sections 6.2.2.5, 6.2.2.6, 6.3.1.4, 6.3.2.7, 6.3.5.2, 6.5.2.8, 7.5.1.1, and 9.3.4.4.

• Add a clarification on RAS actions to section 6.2.2.6.

" Add items to Tables 6.2.2-4 and 6.3.2-3 addressing RWT Isolation Valves CH-530 and CH-531, and timely operator action.

• Revise low refueling water tank level data in Table 7.3-11 A.

7

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

• Add a new condition to Table 9.3.4-3 addressing additional failure mode for RWT Isolation Valves CH-530 and CH-531 and timely operator action.

Development of Time Limit for RWT Isolation As described above, the APS evaluation determined the CE interface requirement relative to the physical arrangement of the ESF pump suction piping may not prevent air entrainment from the RWT after a RAS for the full range of break sizes as originally intended. As a result, the proposed amendment will credit timely closure of the RWT isolation valves after a RAS to preclude the potential for air entrainment. In support of this change, more water volume will be maintained between the RAS setpoint and RWT vortex breaker elevations (transfer volume) to improve transition margin during the post-accident ECCS recirculation mode before the RWT is manually isolated. The established transfer volume corresponds to a specific allocation of time that will allow the operator(s) to verify the containment sump isolation valves are open, to initiate closure of the RWT isolation valves and for the valves to close to isolate the RWT before the level drops below the top of the vortex breaker. Timely action to close the RWT isolation valves will preclude the potential for air entrainment in the ESF pump suction piping from the RWT outlet for all LOCA break sizes. The total time credited in the design for RWT isolation from both ESF trains is eight minutes after a RAS, which includes the operator action times and the stroke time of the valves (PVNGS Calculation 13-MC-CH-201, Revision 7, "Refueling Water Tank (RWT) Hold-Up Tank (HT) and Reactor Make-Up Water Tank (RMWT) Sizing," Reference 6.4).

Design times for the proposed operator action were established using the guidance in ANSI/ANS-58.8, "Time Response Design Criteria for Safety-Related Operator Actions,"

1984 (Reference 6.5) as documented in PVNGS Engineering Study 13-MS-B094, Revision 0, "Operator Action Time for RWT Isolation After RAS," (Reference 6.6). The criteria in this standard identify time intervals and other restrictions that provide an adequate safety margin for safety related system design and safety analyses of the design basis events. The time intervals specified in these criteria are minimum values to be provided in the plant design to permit credit for safety related operator actions.

The general direction regarding human factors and operator actions provided in Standard Review Plan (NUREG-0800) Chapter 18 (Reference 6.7) and NRC Information Notice (IN) 97-78, "Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times," dated October 23, 1997 (Reference 6.8) were also considered, as appropriate. The major design issues are summarized below.

Required OperatorActions The required operator action is to initiate closure of the RWT discharge valves after a RAS. This operator action is not new, but the proposed change will now credit timely closure of the valves so the action will become time-critical. This is a simple task that requires the operation of a single handswitch for each valve at the main control board after verifying the containment sump isolation valves are open.

8

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes Instrumentation and Controls The task of verifying proper switchover from ECCS injection to ECCS recirculation and closing valves CH-530 and CH-531 after a RAS is performed entirely within the main control room. At the initiation of the event, there are a number of safety related alarms and indications in the control room to alert the operating crew that a LOCA has occurred. At the time of a RAS, when the operator action to isolate the RWT is required, the event has been diagnosed and required actions are clearly defined. The main control board instrument displays provide the operator with clearly presented safety related readout information at the required time to assess the need for isolating the RWT without making significant diagnoses. There are multiple indications that a RAS has occurred, including visual (high priority red) and audible alarms, to alert the control room operators. The operator is already positioned at the control board and, thus, is available and on station to take the required actions. The valve CH-530 and CH-531 position status lights provide sufficient indication that the action to close each of the valves has been correctly initiated and that the valves have closed.

Written Procedures The operator action will be controlled through written procedures for post-LOCA response. These emergency operating procedures (EOP) are an integral part of the licensed operator qualification and requalification training programs. The action to close these valves after a RAS already exists in the EOPs, but the proposed change credits this task as time-critical. To ensure completion of the task within the allotted time, the EOPs will be modified to: (a) include a note that the action to close valves CH-530 and CH-531 after RAS is a time-critical step; and (b) re-sequence the actions after RAS to isolate the RWT sooner. Although the timing of this action is critical to ensure continued ESF pump operation during LOCAs within a limited range of smaller break sizes where air entrainment is a potential concern, the EOPs will dictate the same time-critical step for all LOCAs to relieve the operator of the burden of having to identify the break size before taking action. Changes to the EOPs will be communicated to PVNGS plant operators and appropriate training will be provided. The actions will also be included in Procedure 40DP-9ZZ04, "Time Critical Action (TCA) Program" (Reference 6.9), which provides a means to: 1) ensure that the time-critical actions within the scope of the procedure can be accomplished by plant personnel, 2) document periodic validation of credited action times, and 3) ensure that changes to the plant or to procedures or protocols do not invalidate the credited action times.

Time Testinq To validate the capability to perform the credited time critical operator action and demonstrate margin to the design times, timed tests were performed by a random sample of operating crews at the PVNGS simulator using the proposed procedure.

These tests demonstrated that the task could be performed in approximately 60 percent of the established design time limit (95 percent confidence level). Data was collected from six different licensed operating crews, which constitutes a sample size of approximately 30 percent. Each crew was presented with the same LOCA scenario and 9

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes concurrent malfunction at the RAS. The concurrent malfunction at the RAS was included to consider potential complications that might occur during the transition from ECCS injection to ECCS recirculation. The simulator testing results confirmed the established design times provide significant margin. The training for the crews that were time tested included only a review of the draft procedure during a pre-job briefing.

The crews were instructed to perform the steps in the sequence listed, perform at a "normal" pace with no extraordinary efforts to accelerate completion of the task, follow standard command and control protocol with the Control Room Supervisor directing and supervising the activities, and use standard repeat back and confirmation format (three-way) for verbal communications. The crews were not made aware of the additional malfunction included in the scenario or of the maximum allowable time for isolating the RWT.

PotentialErrors There are two possible errors an operator may commit during the performance of the required tasks: a) the action may be performed late; or b) the action may be performed early.

a) Action Performed Late Introducing a time limit for closure of valves CH-530 and CH-531 creates the possibility the action may be performed late. Performing the action late is of no consequence during LOCAs where containment pressure is sufficient to stop flow from the RWT before the vortex breaker is uncovered since the RWT discharge isolation valves do not need to be closed to prevent air entrainment during these events. However, if the LOCA is within the limited range of break sizes where air entrainment is a potential concern, then failure to close valves CH-530 and CH-531 within the allotted period may result in degradation of ESF pump performance. The likelihood the operator will commit this error is very low since the credited times for the operator action to initiate closure of valves CH-530 and CH-531 were established using ANSI/ANS-58.8-1984 guidance (Reference 6.5).

The criteria in this standard identify time intervals and other restrictions that provide an adequate safety margin for safety related system design and safety analyses of the design basis events. The use of ANSI/ANS-58.8-1984 (Reference 6.5) to establish design times for operator actions is consistent with the current PVNGS licensing basis in UFSAR Section 15.6.3.2.2, and NRC IN 97-78 (Reference 6.8). As previously noted, time tests performed on a random sample of operating crews at the PVNGS simulator demonstrated significant margin to the criteria specified by the standard.

Further, there are numerous safety related indications and alarms in the control room to alert the operating crew the action will be or is required. In addition, time testing at the PVNGS simulator demonstrated the operators can complete the task in approximately 60 percent of the design time limit (95 percent confidence level), even when the event is complicated by a concurrent malfunction at the RAS. Thus, significant time margin is available to the operator to recover from 10

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes unanticipated delays in isolating the RWT. APS will perform additional verifications of this time-critical action in accordance with PVNGS procedures.

In the unlikely event an operator performs this action late, there is design margin in the RWT transfer volume sizing analysis as follows:

The analysis assumed maximum (runout) pump flow rates. The smaller break LOCAs where air entrainment is a potential concern would require less High Pressure Safety Injection (HPSI) flow and the pumps would be throttled to deliver much less than maximum flow. In addition, for smaller LOCAs where containment pressure is less than five (5) psig and all other CS termination criteria are met, both CS pumps would be stopped per the EOPs.

This reduced RWT pump down rate after a RAS would provide additional time for the operator action to isolate the RWT.

" The analysis assumed pump down at the maximum rate for eight minutes after a RAS (until both isolation valves are closed to isolate both ESF trains from the RWT). The reduction in flow when the first RWT discharge valve closes and one ESF train is isolated was conservatively neglected. This reduced RWT pump down rate after a RAS would provide additional time for the operator action to isolate the RWT.

• The analysis assumed a conservatively long stroke time for valves CH-530 and CH-531 to maximize the pump down time and required transfer volume.

The assumed stroke time provides margin to the maximum stroke time; thus, additional time would be available for the operator action to initiate closure of the valves.

b) Action Performed Early Since the action to close valves CH-530 and CH-531 after a RAS already exists in the EOPs, the potential error of performing the task early is not new.

However, introducing a time limit for this action creates new time pressures for the operators which could increase the potential for this error. Closing the valves early is of no consequence with respect to air entrainment since air entrainment is not a concern if the RWT is isolated from the ESF pump suction.

However, the consequence of this error is potential degradation of ESF pump performance due to inadequate suction water supply. The likelihood the operator will commit this error is very low. There are numerous safety related indications and alarms in the control room to maintain operator awareness relative to RAS status.

In the unlikely event that the operator commits this error before a RAS, a Safety Equipment Status System (SESS) alarm would actuate as soon as either valve position switch registered "not fully open." This safety grade alarm provides immediate feedback to the operating crew that the error has occurred. Once the valve is completely closed, the operator could immediately reopen the valve in an attempt to minimize the affect on ESF pump performance in the affected 11

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes train. Further, the immediate feedback provided by the SESS alarm to the operating crew would prevent the operator from committing the same error on the redundant train. Thus, even if the affected ESF train could not be recovered, the redundant train could successfully mitigate the event. Early performance of the task after a RAS (e.g., performing the EOP steps out of sequence) would have potential consequences only if the sump valves are not yet open.

However, the sump valves automatically open on a RAS and sufficient flow will be established prior to the time required for these valves to achieve a full open position. Early performance of this task after a RAS would not result in ESF pump degradation.

Assumptions Supporting the Proposed TS Changes The analysis for determining the revised RAS setpoint Allowable Values (TS Table 3.3.5-1) and minimum required RWT level (TS Figure 3.5.5-1) includes the following assumptions:

" The RAS setpoint was established to provide the required RWT transfer volume between the top of the vortex breaker and the RAS, including appropriate instrument uncertainty. This conservatively assumed that all ESF pump flow after a RAS is from the RWT until the RWT is isolated. This may not be the case in some break scenarios since both the RWT and the containment sump suction sources are aligned at a RAS.

" The minimum required RWT level was established based on delivery of the required injection volume before a RAS, including appropriate instrument uncertainty. This implies that suction for the ESF pumps is provided by only the containment sump and flow from the RWT stops at a RAS, which may not be the case in some break scenarios.

• Post-seismic conditions were used for establishing instrument uncertainties that are slightly larger than normal.

Impacts of the Proposed TS Changes The impacts of the increased RAS setpoint and associated Allowable Values and minimum RWT water volume on RWT design functions were evaluated:

• The RAS setpoint was established to ensure sufficient volume is available after a RAS to credit closure of the RWT discharge valves before the RWT vortex breaker becomes uncovered. Thus, suction transfer from the RWT to the containment sump will occur before the potential for air entrainment becomes an issue. This ensures no degradation of the ESF pumps and no impact to core and/or containment cooling capability.

" The proposed minimum required RWT level has been chosen to ensure an adequate volume of borated water will be delivered from the RWT before a RAS, which ensures:

12

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

> The RWT contains sufficient borated water to support the ECCS and CSS during the post-accident injection mode.

> The containment sump contains sufficient borated water at the time of switchover to support continued operation of the ESF pumps throughout the recirculation mode and sump screen coverage.

> There is sufficient borated water to maintain the reactor in a subcritical condition following a LOCA.

The potential impacts of the proposed TS changes to existing analyses were also considered as follows:

, Maximum Post-LOCA Containment Flood Level To ensure that equipment qualification requirements are satisfied, a calculation exists that determines the maximum containment water level postulated to occur during a LOCA (Appendix B of PVNGS Calculation 13-MC-SI-0804, Revision 7, "Containment Building Water Level During LOCA," Reference 6.10). The current maximum containment flood level analysis is based on the water volume between the RWT overflow nozzle and the bottom of the RWT suction line, which is located approximately two feet below the top of the vortex breaker. The proposed changes will not modify the elevations of the RWT overflow nozzle, vortex breaker, or suction line, but the revised RAS setpoint and credited closure of valves CH-530 and CH-531 will ensure that the RWT is isolated before the level drops below the top of the vortex breaker. Therefore, the RWT water volume and resulting maximum flood level are reduced and remain within the limits of the design analysis. A revision to the containment flood analysis will reflect the reduced water volume.

" Trisodium Phosphate (TSP) Requirements To buffer the acidic sump fluid in containment during a LOCA, sufficient anhydrous TSP is placed in baskets to mix with and provide an acceptable pH of the containment sump fluid. This is to maintain equipment environmental qualification requirements, to inhibit stress corrosion cracking, and to ensure effective fission product removal from the containment atmosphere following a LOCA. Lower and upper limits are placed on pH, so calculations are performed to determine the minimum and maximum post-LOCA pH (PVNGS Calculation 13-MC-SI-0016, Revision 5, "Tri-Sodium Phosphate Basis Calculation,"

Reference 6.11).

The calculation for the minimum post-LOCA sump pH assumes a conservatively large volume of borated water has been delivered from the RWT. This volume is the equivalent of that contained between the RWT overflow line and an RWT level that is below the top of the vortex breaker. Since the revised RAS setpoint and credited closure of valves CH-530 and CH-531 will ensure that the RWT is isolated before the level drops below the top of the vortex breaker, the volume of 13

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes borated water associated with the proposed change is bounded by the existing analysis. A revision to the TSP analysis will reflect the reduced water volume as a result of the reduced maximum flood level.

The calculation for the maximum post-LOCA sump pH assumes a conservatively small volume of borated water has been delivered from the RWT. This volume is contained between the TS minimum RWT water level as required by TS Figure 3.5.5-1 and the RAS setpoint (injection volume). The proposed TS changes increase the available injection volume in the RWT to provide additional margin to the calculated minimum volume that is needed to support design functions. Thus, the changes are bounded by the existing analysis.

• Post-LOCA Boron Precipitation To demonstrate conformance with 10 CFR 50.46 Criterion 5, Long-Term Cooling, the potential for boron precipitation to occur at low system temperatures following a LOCA is evaluated. Specifically, the boric acid concentration in the core and containment sump following a large break LOCA is determined to evaluate boron precipitation. The current analysis conservatively assumes a large volume of borated water from the RWT with a high boron concentration.

The assumed volume is based on the maximum usable volume of the RWT.

The boron concentration is assumed to be 4400 parts per million (ppm), which is the maximum RWT boron concentration allowed by TS (SR 3.5.5.3). Since the proposed changes do not involve a change to either the physical design of the RWT, which defines the maximum usable RWT volume, or the RWT maximum boron concentration, the current post-LOCA boron precipitation analysis remains bounding.

RWT Structural Integrity The proposed amendment will increase the TS minimum required and nominal level in the RWT. However, the current RWT structural and seismic analysis assumes the tank is full to the overflow nozzle (PVNGS Calculation 13-CC-CT-0015, Revision 11, "Misc. Site Facilities - Refueling Water Tank," Reference 6.12).

The proposed TS amendment will not modify the elevation of the RWT overflow nozzle or the tank dimensions; therefore, the volume assumed in the structural and seismic analysis remains bounding.

RWT Heater and Vent Sizing The proposed amendment will increase the TS minimum required RWT level.

However, the current RWT heater sizing calculation assumes the tank is filled to the overflow nozzle (PVNGS Calculation 13-MC-CH-201, Reference 6.4).

As the proposed RWT level and RAS setpoint changes will not modify the elevation of the RWT overflow nozzle or any of the tank's dimensions, the RWT heater sizing analysis remains applicable.

14

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes The RWT vent line sizing calculation evaluates the venting capabilities for the tank during pump down conditions to verify that excessive vacuum conditions will not impair the tank (PVNGS Calculation 13-MC-CH-0321, Revision 0, "Refueling Water Tank Vent Line Sizing," Reference 6.13).

The proposed amendment does not affect the maximum RWT pump down rate or the vent line design; therefore, the RWT vent line sizing calculation will not be affected.

• RWT Inventory Available to Support Normal Operations The proposed amendment will increase the TS minimum required RWT level. As the RWT inventory above the TS minimum required level is the volume that is available to support plant operations at any particular time (operating band), this change alone would reduce the operating band. However, this change will be accompanied by a corresponding increase in the RWT high alarm setpoint and replacement instrumentation resulting in reduced instrument uncertainty such that the current operating band is essentially unchanged. The high alarm setpoint is not a TS value and is not within the scope of this submittal.

• Large Break LOCA Radiological Consequences Analyses are performed to evaluate the radiological consequences of a design basis LOCA to demonstrate that the limits of 10 CFR 100 for off-site dose and 10 CFR 50 Appendix A, Criterion 19 for control room dose are met (PVNGS Calculation 13-NC-ZY-0205, Revision 9, "Large Break LOCA Radiological Consequences," Reference 6.14). The current calculation includes a dose contribution from back leakage of recirculation sump water to the RWT during long-term cooling. Valves CH-530 and CH-531 are assumed to leak along with RWT suction check valves CH-305 and CH-306, allowing leakage of the recirculation sump water to the RWT due to high post-LOCA containment pressure. The proposed TS changes do not affect the RWT back leakage assumptions in this calculation; therefore, the LOCA radiological analyses are not affected.

Singqle Failure Evaluation In establishing the required RWT transfer volume and revised RWT levels, APS reviewed the single failures for these associated systems. The limiting single failure with respect to RWT transfer volume as described in the UFSAR is a failure of an ESF train to realign to the containment sump at a RAS. This failure results in the continuation of large RWT outflows via the affected train and reduces the time available for completion of the transfer to recirculation. In this scenario, the running ESF pumps in the associated train are stopped per the EOPs to prevent damage. This failure is bounded by the RWT transfer volume analyses supporting this proposed license amendment.

15

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes It has been determined for a limited range of smaller break sizes that containment pressure may not be sufficient to prevent continued flow from the RWT after a RAS, even without a single failure. In these scenarios, the single failure of a LPSI pump to stop at a RAS could potentially cause a larger RWT drain down rate and, thus, a greater required transfer volume to prevent air entrainment. The basis for not considering this single failure in the determination of the minimum required RWT transfer volume is as follows:

• The current LOCA recovery EOPs direct the operators early in the event, after verification that two CS pumps have started and are operating, to stop one of these redundant CS pumps. This action is supported by a Westinghouse analysis (PVNGS SDOC N001-1501-00008, Revision 1, "Emergency Operating Procedure (EOP) Report to Support Early Termination of One Containment Spray Train," Reference 6.15) that demonstrates stopping one CS pump will maintain the containment pressure high enough, but within design limits, to significantly reduce the range of LOCA break sizes where air entrainment remains a potential concern.

• LPSI pump failure to trip concurrent with a LOCA within the limited range of break sizes where air entrainment is a concern is considered to have a low potential for occurrence. This conclusion is based on a detailed fault tree analysis of the LPSI pump trip circuit and a plant specific engineering evaluation of the impact of this failure on risk (PVNGS Engineering Study 13-ES-A037, Revision 0, "Fault Tree Analysis and Reliability Evaluation for Low Pressure Safety Injection (LPSI) Pump Trip at the Recirculation Actuation Signal (RAS),"

Reference 6.16 and PVNGS Engineering Study 13-NS-C089, Revision 0, "PRA Evaluation of LPSI Pump Failing to Trip on RAS," Reference 6.17). The fault tree included all events or combination of events (including those in the operating environment) that could result in a failure mode in which one or more of the LPSI pumps fails to stop at a RAS. In addition, the component failure probabilities in the LPSI pump circuit fault tree incorporated plant specific data. Based on this fault tree analysis, the engineering evaluation determined the potential increase in core damage and large early release risk posed by the failure of a LPSI pump to trip on a RAS that could result in enough air being drawn into the suction of the ESF pumps to render them unavailable. For the LPSI failure, the susceptible LOCAs where air could be drawn into the suction of the ESF pumps were determined to be the medium and large break LOCAs. The remaining small break LOCAs, which constitute about 90% of the total LOCA frequency, are not of concern since RCS pressure remains high enough to preclude LPSI flow into the RCS (thus, there is no additional potential for air entrainment if LPSI does not trip). The increase in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) associated with the LPSI pump trip failure scenarios is well below the limit for "very small" per Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, dated November 2002.

16

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

• In the unlikely event these combinations of events occur, the available time for the operator to initiate closure of the RWT discharge valves could be reduced.

However, all operating crews tested at the PVNGS simulator demonstrated the task could be completed even within the reduced time that would be available if the RWT pump down rate included the LPSI pump operating at its maximum (runout) flow rate. It is noted the simulator scenario was complicated by a concurrent malfunction at the RAS, which included failure of one LPSI pump to trip. Thus, the simulator results included operator time needed to recognize and respond to this additional failure at a RAS.

" Per the EOPs, the first step after a RAS is to ensure that the LPSI pumps are stopped. The sooner it is recognized that the LPSI pump failed to trip and the pump is stopped, the greater the remaining RWT transfer volume and available operator action time. This EOP step provides added assurance that sufficient transfer volume would be available in the RWT to support the operator action.

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements / Criteria The ECCS is designed to cool the reactor core and provide additional shutdown capability following initiation of any of the following accident conditions:

• LOCA

• Control Element Assembly Ejection Accident

• A pipe break in the Main Steam System including an Uncontrolled Steam Release or a Loss of Feedwater

• Steam Generator Tube Rupture 10 CFR 50.46, "Acceptance Criteria for ECCS for Light-Water Nuclear Power Reactors," requires licensees to design their ECCS systems such that its calculated cooling performance following postulated LOCAs meets five criteria:

peak cladding temperature, maximum cladding oxidation, maximum hydrogen generation, coolable geometry, and long-term cooling. The proposed changes ensure continued performance of the ECCS to meet these regulatory requirements.

10 CFR 50 Appendix A, General Design Criterion (GDC) 13, "Instrumentation and Control," requires instrumentation and control to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges. The proposed changes ensure the Engineered Safety Features 17

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes Actuation System (ESFAS) will continue to function as designed to monitor plant variables and initiate ESF systems during a LOCA.

10 CFR 50 Appendix A, GDC 16, "Containment Design," requires a reactor containment and associated systems be provided to establish an essentially leak-tight barrier against the uncontrolled release of radioactivity to the environment and to ensure the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require. The proposed changes ensure the ECCS and CSS will continue to operate as designed to maintain the integrity of the containment for all accident conditions.

10 CFR 50 Appendix A, GDC 35, "Emergency Core Cooling," requires abundant emergency core cooling be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that:

1. Fuel and clad damage that could interfere with continued effective core cooling is prevented, and

2. Clad metal-water reaction is limited to negligible amounts.

The proposed changes ensure the ECCS will continue to operate as designed to maintain the integrity of the core for all accident conditions.

10 CFR 50 Appendix A, GDC 38, "Containment Heat Removal," requires a system to remove heat from the reactor containment be provided. The system function shall be to rapidly reduce the containment pressure and temperature following a LOCA, and maintain them at acceptably low levels. The proposed changes maintain the ability for the CSS and containment recirculation function to continue to operate as designed to provide the required heat removal from the containment for accident conditions.

10 CFR 50 Appendix A, GDC 41, "Containment Atmosphere Cleanup," requires systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quantity of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere following postulated accidents to assure that containment integrity is maintained. The proposed changes maintain the ability for the CSS and associated systems to continue to operate as designed to control fission products, hydrogen, oxygen, and other substances that may be released into the reactor containment following a LOCA.

Regulatory Guide 1.82, "Water Sources for Long-Term Recirculation Cooling Following a Loss-of-Coolant Accident," Revision 0, dated June 1974, describes NRC-accepted criteria and methods for implementing NRC requirements 18

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes (including GDC 35 and GDC 38) relevant to the water source for emergency core cooling and containment heat removal. Consistent with this regulatory guide and the NRC GDC, the proposed changes provide sufficient water volume in the RWT to ensure that the water sources available for long term cooling and containment heat removal are adequate for all design basis accident conditions.

NRC Generic Letter 2008-01, "Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems," dated January 11, 2008, was issued to address several problems associated with gas accumulating in safety related systems that can compromise the system's operability. An example of this would be gas entering the suction line to an ESF pump from an emptying RWT of sufficient quantity to degrade or damage the pump. The proposed changes further enhance the prevention of air ingestion in ESF pump suction piping from an emptying RWT.

4.2. Precedent None.

4.3 No Significant Hazards Consideration Determination The proposed license amendment changes the licensing basis relative to isolation of the Refueling Water Tank (RWT) following a postulated Loss of Coolant Accident (LOCA) and changes the Recirculation Actuation Signal (RAS)

Allowable Value and the minimum operating level for the RWT, which support Emergency Core Cooling System (ECCS) and Containment Spray System (CSS) operation following a LOCA. These changes are being implemented to preclude the potential for air entrainment in the ECCS and Containment Spray (CS) pump suction piping from the RWT and to ensure that the pumps are not challenged in any LOCA scenario.

The RWT provides the borated water source for the ECCS and CS pumps during the ECCS injection mode following a LOCA. When the RWT inventory is depleted to the low level setpoint, a RAS is generated, which automatically opens isolation valves to align the suction of the ECCS and CS pumps to the Emergency Recirculation Sump in containment. After verifying that the suction transfer has occurred, the operators manually isolate the RWT by closing two motor operated valves (one per safety train) to complete the transfer from ECCS injection to ECCS recirculation.

The proposed amendment changes the PVNGS licensing basis to credit the existing manual operator action to isolate the RWT for precluding the potential for air entrainment from the RWT following a RAS. A time limit for RWT isolation is established to ensure the RWT is isolated before the level is depleted to a point where air could be entrained into the ECCS and CS pump suction piping from the RWT. The RAS setpoint is being increased to accommodate the credited operator action and closure of the isolation valves. The minimum required RWT 19

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes level is being increased accordingly to provide sufficient ECCS injection volume in the RWT at the higher RAS setpoint.

The proposed amendment also recognizes and evaluates a different single failure associated with the RWT drain down following a LOCA.

APS has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below.

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The RWT is a passive component of the Chemical and Volume Control System (CVCS) that supports ECCS and CSS operation to mitigate the consequences of an accident. A RAS is an active component of the Engineered Safety Features Actuation System (ESFAS) that actuates safety equipment to mitigate the consequences of a LOCA. Neither of these components initiates an accident previously evaluated. The RWT isolation valves are also components of the CVCS; however, their closure was not previously credited for RWT isolation following a RAS. The proposed amendment will credit closure of these valves following a RAS to preclude the potential for air entrainment in the ECCS and CS pump suction piping for any LOCA scenario. The required isolation is being performed as a time critical operator action, which is consistent with ANSI/ANS-58.8-1984, Time Response Design Criteria for Safety-Related Operator Actions, 1984 guidance. Although the change in the closure requirement and the operator action could introduce additional potential malfunctions, these malfunctions have been evaluated and found not to initiate or have a significant adverse affect on the mitigation or consequences of any accident previously evaluated.

The proposed changes do not alter or prevent the ability of structures, systems or components to perform their intended function to mitigate the consequences of an initiating event within the assumed acceptance limits.

The proposed changes will ensure continued performance of the ECCS and CS pumps following a LOCA by precluding the potential for air entrainment in the pump suction piping from the RWT after a RAS.

The effect of the proposed changes to the RAS Allowable Values and RWT minimum required level on the RWT structural design, containment post-LOCA flood level, post-LOCA boron precipitation, and containment sump pH remain within the limits assumed in the design and accident analyses. The proposed license amendment does not affect the source term, containment isolation, or radiological release assumptions used in evaluating the radiological consequences of an accident previously evaluated. Further, the 20

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes proposed changes do not increase the types or amounts of radioactive effluent that may be released offsite. The proposed license amendment is consistent with these analyses' assumptions and resultant consequences.

The proposed amendment also recognizes and evaluates a different single failure associated with the RWT drain down following a LOCA than previously evaluated. It was determined this failure was of low probability and did not adversely affect any previous bounding analysis or the capability of the associated systems to perform their design functions.

Therefore, the proposed license amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed license amendment does not involve or add any new or different components to the plant and does not change any accident initiators.

The proposed changes to the RAS Allowable Values and RWT minimum required level will not change the design function of the RWT to support ECCS and CSS operation following a LOCA. However, the closure of the RWT isolation valves following a LOCA was not previously credited. As a result, the credited RWT isolation valve design function has been changed, and closure of these valves is now credited to preclude the possibility of air entrainment in the ECCS and CS pump suction piping for any LOCA scenarios. The credited isolation is being performed as a time critical operator action, which is consistent with ANSI/ANS 58.8 guidance. Although changes to the valve closure requirement and the operator action introduce additional potential malfunctions, these malfunctions have been evaluated and found not to create the possibility of a new or different kind of accident from any accident previously evaluated.

The proposed amendment recognizes and evaluates a different single failure associated with the RWT drain down following a LOCA than previously evaluated. It was determined that this failure was of low probability and did not adversely affect any previous bounding analysis or create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed changes do not create the possibility of a new or different accident from any accident previously evaluated.

21

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed license amendment does not alter the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined or implemented. The safety analysis acceptance criteria are not affected by this amendment. The proposed changes in the credited design function of the RWT isolation valves, along with the change in the RAS Allowable Value and RWT minimum required levels, continue to ensure sufficient RWT water volume to enable the ECCS and CSS to satisfy required design functions for all postulated LOCA break sizes. Therefore, these changes do not impact the results of safety analyses.

The proposed changes to the RAS Allowable Values and minimum required RWT level include appropriate instrument uncertainties and are based on conservative analyses for establishing the required RWT volumes. The proposed amendment will not result in plant operation in a configuration outside of the design basis.

The proposed amendment recognizes and evaluates a different single failure associated with the RWT drain down following a LOCA than previously evaluated. It was determined this failure was of low probability and did not adversely affect any previous bounding analysis.

Therefore, the proposed changes do not involve a significant reduction in a margin of safety.

Based on the above, APS concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATIONS APS has evaluated the proposed amendment and has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does 22

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES 6.1 PVNGS Calculation 13-JC-CH-0209, Revision 9, "Refueling Water Tank Level Measurement," dated October 14, 2009 6.2 "Nine-Month Response to NRC Generic Letter 2008-01, 'Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems'." APS Letter Number 102-05910 to NRC, dated October 14, 2008 [ML082940032].

6.3 CRDR 2835132 - APS corrective action program documentation of NRC 95002 Inspection concern on RAS performance- Entered date October 6, 2005 6.4 PVNGS Calculation 13-MC-CH-201, Revision 7, "Refueling Water Tank (RWT)

Hold-Up Tank (HT) and Reactor Make-Up Water Tank (RMWT) Sizing," dated October 9, 2009 6.5 ANSI/ANS-58.8-1984, Time Response Design Criteria for Safety-Related Operator Actions, 1984 6.6 PVNGS Engineering Study 13-MS-B094, Revision 0, "Operator Action Time for RWT Isolation After RAS," dated October 9, 2009 6.7 NUREG 0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition" 6.8 NRC Information Notice (IN) 97-78, dated October 23, 1997, "Crediting of Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times" 6.9 PVNGS Procedure 40DP-9ZZ04, "Time Critical Action (TCA) Program" 6.10 PVNGS Calculation 13-MC-SI-0804, Revision 7, "Containment Building Water Level During LOCA," dated October 6, 2009 6.11 PVNGS Calculation 13-MC-SI-0016, Revision 5, "Tri-Sodium Phosphate Basis Calculation," dated October 14, 2008 6.12 PVNGS Calculation 13-CC-CT-001 5, Revision 11, "Misc. Site Facilities -

Refueling Water Tank," dated August 18, 2009 6.13 PVNGS Calculation 13-MC-CH-0321, Revision 0, "Refueling Water Tank Vent Line Sizing," dated August 17, 1990 23

Enclosure Evaluation of the Proposed Change to TS Table 3.3.5-1, Figure 3.5.5-1, and Supporting Changes 6.14 PVNGS Calculation 13-NC-ZY-0205, Revision 9, "Large Break LOCA Radiological Consequences," dated May 13, 2008 6.15 PVNGS SDOC N001-1501-00008, Revision 1, "Emergency Operating Procedure (EOP) Report to Support Early Termination of One Containment Spray Train,"

dated December 29, 2008 6.16 PVNGS Engineering Study 13-ES-A037, Revision 0, "Fault Tree Analysis and Reliability Evaluation for Low Pressure Safety Injection (LPSI) Pump Trip at the Recirculation Actuation Signal (RAS)," dated October 8, 2009 6.17 PVNGS Engineering Study 13-NS-C089, Revision 0, "PRA Evaluation of LPSI Pump Failing to Trip on RAS," dated October 1, 2009 24

Enclosure 1, Attachment I Proposed Technical Specification Changes (Mark-up)

Pages:

,3.3.5-4 (Table 3.3.5-1) (Pre RWT TS setpoint change) 3.3.5-5 (Table 3.3.5-1) (After RWT TS setpoint change) 3.5.5-3 (Figure 3.5.5-1) (Pre RWT TS setpoint change) 3.5.5-4 (Figure 3.5.5-1) (After RWT TS setpoint change)

ESFAS Instrumentation Pre-RWT TS Setpoint Change 3.3.5 Table 3.3.5-1 (page 1 of 1)

Engineered Safety Features Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED FUNCTION CONDITIONS ALLOWABLE VALUE

1. Safety Injection Actuation Signal

a. Containment Pressure - High 1.2.3 3.2 psig

b. Pressurizer Pressure - Low(a) ,31821 psia

2. Containment Spray Actuation Signal

a. Containment Pressure - High High 1.2.3 8B.9 psig

3. Containment Isolation Actuation Signal

a. Containment Pressure - High 1,2,3

• 3.2 psig

b. Pressurizer Pressure - Low(a) Ž 1821 psia

4. Main Steam Isolation Signal(c)

a. Steam Generator #1 Pressure-Low(b) 1.2.3 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: Ž 955 psia(d)

b. Steam Generator #2 Pressure-Low(b) 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: Ž 955 psia('ý

c. Steam Generator #1 Level-High < 91.5%

d. Steam Generator #2 Level-High < 91.5%

e. Containment Pressure-High < 3.2 psig

5. Recirculation Actuation Signal

a. Refueling Water Storage Tank Level-Low 1.2,3 > 6.9 and

• 7.9%

6. Auxiliary Febdwater Actuation Signal SG #1 (AFAS-1)

a. Steam Generator #1 Level-Low 1.2.3 Ž 25.3%

b. SG Pressure Difference-High

• 192 psid

7. Auxiliary Feedwater Actuation Signal SG #2 (AFAS-2)

a. Steam Generator #2 Level-Low 1,2,3 Ž 25.3%

b. SG Pressure Difference-High

• 192 psid (a) The setpoint may be decreased to a minimum value of 100 psia, as pressurizer pressure is reduced.

provided the margin between pressurizer pressure and the setpoint is maintained ! 400 psia or Ž 140 psia greater than the saturation pressure of the RCS cold leg when the RCS cold leg temperature is

Ž 4855F. Trips may be bypassed when pressurizer pressure is < 400 psia. Bypass shall be automatically removed when pressurizer pressure is Ž 500 psia. The setpoint shall be automatically increased to the normal setpoint as pressurizer pressure is increased.

(b) The setpoint may be decreased as steam pressure is reduced, provided the margin between steam pressure and the setpoint is maintained

• 200 psig. The setpoint shall be automatically increased to the normal setpoint as steam pressure is increased.

(c) The Main Steam Isolation Signal (MSIS) Function (Steam Generator Pressure - Low, Steam Generator Level-High and Containment Pressure - High signals) is not required to be OPERABLE when all associated valves isolated by the MSIS Function are closed.

(d) 1. If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predetermined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable.

2. The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the UFSAR Trip Setpoint, or within the as left tolerance of a setpoint that is more conservative than the UFSAR Trip Set Point; otherwise the channel shall be declared inoperable. The UFSAR Trip Setpoint and the methodology used to determine 1)the UFSAR Trip Setpoint, 2) the predetermined as found acceptance criteria band, and 3) the as-left setpoint tolerance band are specified in the UFSAR.

PALO VERDE UNITS 1 AND 3 AMENDMENT NO. 44-;, 157 PALO VERDE UNIT 2 3.3.5-4 AMENDMENT NO. 9, 157

ESFAS Instrumentation After RWT TS SetpoitCag ~3.3.5 Table 3.3.5-1 (page 1 of 1)

Engineered Safety Features Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED FUNCTION CONDITIONS ALLOWABLE VALUE

1. Safety Injection Actuation Signal

a. Containment Pressure - High 1,2,3

• 3.2 psig

b. Pressurizer Pressure - Low(a) > 1821 psia

2. Containment Spray Actuation Signal

a. Containment Pressure - High High 1.2.3 8B.9 psig

3. Containment Isolation Actuation Signal

a. Containment Pressure - High 1,2,3

• 3.2 psig

b. Pressurizer Pressure - Low(a) > 1821 psia

4. Main Steam Isolation Signal(c)

a. Steam Generator #1 Pressure-Low(b) 1,2,3 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: > 955 psial"

b. Steam Generator #2 Pressure-Low(b) 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: Ž 955 psia(d

c. Steam Generator #1 Level-High

• 91.5%

d. Steam Generator #2 Level-High  ! 91.5%

e. Containment Pressure-High < 3.2 psig

5. Recirculation Actuation Signal 95 d)

a. Refueling Water Storage Tank Level-Low 1.2.3 -&- and

• 4

6. Auxiliary Feedwater Actuation Signal SG #1 (AFAS-1)

a. Steam Generator #1 Level-Low 1,2,3 Ž 25.3%

b. SG Pressure Difference-High  ! 192 psid

7. Auxiliary Feedwater Actuation Signal SG #2 (AFAS-2)

a. Steam Generator #2 Level-Low 1,2,3 Ž 25.3%

b. SG Pressure Difference-High  ! 192 psid (a) The setpoint may be decreased to a minimum value of 100 psia, as pressurizer pressure is reduced, provided the margin between pressurizer pressure and the setpoint is maintained

• 400 psia or 2 140 psia greater than the saturation pressure of the RCS cold leg when the RCS cold leg temperature is

Ž 485'F. Trips may be bypassed when pressurizer pressure is < 400 psia. Bypass shall be automatically removed when pressurizer pressure is Ž 500 psia. The setpoint shall be automatically increased to the normal setpoint as pressurizer pressure is increased.

(b) The setpoint may be decreased as steam pressure is reduced, provided the margin between steam pressure and the setpoint is maintained

• 200 psig. The setpoint shall be automatically increased to the normal setpoint as steam pressure is increased.

(c) The Main Steam Isolation Signal (MSIS) Function (Steam Generator Pressure - Low, Steam Generator Level-High and Containment Pressure - High signals) is not required to be OPERABLE when all associated valves isolated by the MSIS Function are closed.

(d) 1. If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predetermined as-found acceptance criteria band. then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable.

2. The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the UFSAR Trip Setpoint, or within the as left tolerance of a setpoint that is more conservative than the UFSAR Trip Set Point: otherwise the channel shall be declared inoperable. The UFSAR Trip Setpoint and the methodology used to determine 1) the UFSAR Trip Setpoint, 2) the predetermined as found acceptance criteria band, and 3) the as-left setpoint tolerance band are specified in the UFSAR.

PALO VERDE UNITS 1 AND 3 AMENDMENT NO. 4-1-;, 157 PALO VERDE UNIT 2 3.3.5 AMENDMENT NO. 4-4-9, 157

RWT 3.5.5 Cag -r-WIT"eton 624,000 GAL / 83% (565-F) 601,000 GAL/_79.9% (210°F) --- I 625,000 600,000 575,000 Q 75%-

Z -.J 5 0 550,000 I-w wn-w 70%. 525,000 I.-

z 500,000 W 65%,

475,000 0

0 100 200 300 400 500 600 AVERAGE RCS TEMPERATURE (-F)

FIGURE 3.5.5-1 Minimum Required RWT Volume PALO VERDE UNITS 1,2,3 3.5.5-3 AMENDMENT NO. 4-69, 177

RWT Afer W T etintCag 3.5,5 100 200 300 400 500 AVERAGE RCS TEMPERATURE (.F)

FIGURE 3.5.5-1 Minimum Required RWT Volume 3.545-e PALO VERDE UNITS 1.2.3 AMENDMENT NO. 4.6-9.

Enclosure 1, Attachment 2 Revised (clean) Technical Specification Pages Pages:

3.3.5-4 (Table 3.3.5-1) (Pre RWT TS setpoint change) 3.3.5-5 (Table 3.3.5-1) (After RWT TS setpoint change) 3.5.5-3 (Figure 3.5.5-1) (Pre RWT TS setpoint change) 3.5.5-4 (Figure 3.5.5-1) (After RWT TS setpoint change)

ESFAS Instrumentation Pre-RWT TS Setpoint Change 3.3.5 Table 3.3.5-1 (page 1 of 1)

Engineered Safety Features Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED FUNCTION CONDITIONS ALLOWABLE VALUE

1. Safety Injection Actuation Signal

a. Containment Pressure - High 1.2,3 < 3.2 psig

b. Pressurizer Pressure 7 Low(a) >1821 psia

2. Containment Spray Actuation Signal

a. Containment Pressure - High High 1,2,3 _ 8.9 psig

3. Containment Isolation Actuation Signal

a. Containment Pressure - High 1.2,3 < 3.2 psig

b. Pressurizer Pressure - Low(a) ->1821 psia

4. Main Steam Isolation Signal(c)

a. Steam Generator #1 Pressure-Low(b) 1,2,3 3876 MWt RTP: > 890 psia 3990 MWt RTP: > 955 psia")

b. Steam Generator #2 Pressure-Low(b) 3876 MWt RTP: > 890 psia 3990 MWt RTP: Ž 955 psia(

c. Steam Generator #1 Level-High < 91.5%

d. Steam Generator #2 Level-High _ 91,5%

e. Containment Pressure-High _ 3.2 psig

5. Recirculation Actuation Signal

a. Refueling Water Storage Tank Level-Low 1.2,.3 > 6.9 and !57,9%

6. Auxiliary Feedwater Actuation Signal SG #1 (AFAS-1)

a. Steam Generator #1 Level-Low 1.2,3 > 25.3%

b. SG Pressure Difference-High _ 192 psid

7. Auxiliary Feedwater Actuation Signal SG #2

.(AFAS-2)

a. Steam Generator #2 Level-Low 1,2,3 > 25,3%

b. SG Pressure Difference-High _<192 psid (a) The setpoint may be decreased to a minimum value of 100 psia. as pressurizer pressure is reduced, provided the margin between pressurizer pressure and the setpoint is maintained _<400 psia or 2! 140 psia greater than.the saturation pressure of the RCS cold leg when the RCS cold leg temperature is

>_485°F. Trips may be bypassed when pressurizer pressure is < 400 psia. Bypass shall be automatically removed when pressurizer pressure is > 500 psia. The setpoint shall be automatically increased to the normal setpoint as pressurizer pressure is increased.

'(b) The setpoint may be decreased as steam pressure is reduced, provided the margin between steam pressure and the setpoint is maintained _ 200 psig. The setpoint shall be automatically increased to the normal setpoint as steam pressure is increased.

(c) The Main Steam Isolation Signal (MSIS) Function (Steam Generator Pressure - Low, Steam Generator Level-High and Containment Pressure - High signals) is not required to be OPERABLE when all associated valves isolated by the MSIS Function are closed.

(d) 1. If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predetermined as-found acceptance criteria band. then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoint is not conservative with respect to the Allowable Val'ue, the channel shall be declared inoperable.

2. The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the UFSAR Trip Setpoint, or within the as left tolerance of a setpoint that is more conservative than the UFSAR Trip Set Point; otherwise the channel shall be dec.lared inoperable. The UFSAR Trip Setpoint and the methodology used to determine 1) the UFSAR Trip Setpoint, 2) the predetermined as found acceptance criteria band, and 3) the as-left setpoint tolerance band are specified in the UFSAR.

PALO VERDE UNITS 1 AND 3 AMENDMENT NO. -,

PALO VERDE UNIT 2 3.3.5-4 AMENDMENT NO, 45-7;

ESFAS Instrumentation After RWT TS Setpoint Change 3.3.5 Table 3.3.5-1 (page I of 1)

Engineered Safety Features Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED FUNCTION CONDITIONS ALLOWABLE VALUE

1. Safety Injection Actuation Signal

a. Containment Pressure - High 1.2,3 5 3.2 psig

b. Pressurizer Pressure - Low(a) 3 1821 psia

2. Containment Spray Actuation Signal

a. Containment Pressure - High High 1,2,3

• 8.9 psig

3. Containment Isolation Actuation Signal

a. Containment Pressure - High 1,2.3 3.2 psig

b. Pressurizer Pressure - Low(a) 12 1821 psia 4, Main Steam Isolation Signal(c)

a. Steam Generator #1 Pressure-Low(b) 1,2,3 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: > 955 psiaV

b. Steam Generator #2 Pressure-Low(b) 3876 MWt RTP: Ž 890 psia 3990 MWt RTP: Ž 955 psia ()

c. Steam Generator #1 Level-High 5 91.5%

d. Steam Generator #2 Level-High

• 91.5%

e. Containment Pressure-High  ! 3.2 psig

5. Recirculation Actuation Signal

a. Refueling Water Storage Tank Level-Low 1,2,3 Ž 9.15 and 5 9 . 6 5 %d

6. Auxiliary Feedwater Actuation Signal SG #1 (AFAS-1)

a. Steam Generator #1 Level-Low 1,2,3 Ž 25.3%

b. SG Pressure Difference-High . 5 192 psid

7. Auxiliary Feedwater Actuation Signal SG #2 (AFAS-2)

a. Steam Generator #2 Level-Low 1,2,3 Ž 25.3%

b. SG Pressure Difference-High

• 192 psid (a) The setpoint may be decreased to a minimum value of 100 psia, as pressurizer pressure is reduced, provided the margin between pressurizer pressure and the setpoint is maintained 5 400 psia or Ž 140 psia greater than the saturation pressure of the RCS cold leg when the RCS cold leg temperature is

Ž 485°F. Trips may be bypassed when pressurizer pressure is < 400 psia. Bypass shall be automatically removed when pressurizer pressure is Ž 500 psia. The setpoint shall be automatically increased to the normal setpoint as pressurizer pressure is increased.

(b) The setpoint may be decreased as steam pressure is reduced, provided the margin between steam pressure and the setpoint is maintained

• 200 psig. The setpoint shall be automatically increased to the normal setpoint as steam pressure is increased.

(c) The Main Steam Isolation Signal (MSIS) Function (Steam Generator Pressure - Low, Steam Generator Level-High and Containment Pressure - High signals) is not required to be OPERABLE when all associated valves isolated by the MSIS Function are closed.

(d) 1. If the as-found channel setpoint is conservative with respect to the Allowable Value but outside its predetermined as-found acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable.

2. The instrument channel setpoint shall be reset to a value that is within the as-left tolerance of the UFSAR Trip Setpoint, or within the as left tolerance of a setpoint that is more conservative than the UFSAR Trip Set Point: otherwise the channel shall be declared inoperable. The UFSAR Trip Setpoint and the methodology used to determine 1) the UFSAR"Trip Setpoint, 2) the predetermined as found acceptance criteria band, and 3) the as-left setpoint tolerance band are specified in the UFSAR.

PALO VERDE UNITS 1 AND 3 AMENDMENT NO. --5-7, PALO VERDE UNIT 2 3.3.5-5 AMENDMENT NO. --5-,

RWT Pre-RWT TS Setpoint Change 3.5.5 85%1- 624,000 GAL /83% (565ý F) 601,000 GAL/79.9%(210-F) 625,000 80%. 600,000 575,000 w 0 75%"I-z w 550,000 I-w 2 70%. 525,000 LU 500,000 6J W 65%.

-J 475,000 Lv l II I II I no/- 0 0 100 200 300 400 500 600 AVERAGE RCS TEMPERATURE (OF)

FIGURE 3.5.5-1 Minimum Required RWT Volume PALO VERDE UNITS 1,2,3 3.5.5-3 AMENDMENT NO..I;-ý

RWT After RWT TS Setpoint Change 3.5.5 534,000 GAL /84.3% (565 0 F) 611,000 GALl8S1.2% (210F) 650,00 85%1" MS5,0=

UDON0 575,00 Ui 0 75%t zi 550,000 I-z 7M%. 525,000 U,

500,000 id j475,0=

I I IF7. - - 0 0 100 200 10w 400 Soo 61 AVERAGE RCS TEMPERATURE (OF)

FIGURE 3.5.5-1 Minimum Required RWT Volume PALO VERDE UNITS 1,2,3 3.5.5-4 AMENDMENT NO. ;4;

Enclosure 1, Attachment 3 Proposed Changes to Technical Specification Bases Pages (For information only)

Pages (Pre RWT TS setpoint change)

B 3.3.5-9 B 3.3.5-18 B 3.5.5-1 B 3.5.5-2 B 3.5.5-3 B 3.5.5-4 (After RWT TS setpoint changes)

B 3.3.5-9A B 3.3.5-18A B 3.5.5-1A B 3.5.5-2A B 3.5.5-3A B 3.5.5-4A

ESFAS Instrumentation B 3.3.5 (Pre-RWT TS Setpoint Change)

BASES APPLICABLE 4. Main Steam Isolation Signal (continued)

SAFETY. ANALYSES (continued) high level condition or if a high containment pressure condition exists. This prevents an excessive rate of heat extraction and subsequent cooldown of the RCS during these events.

5. Recirculation Actuation Signal At the end of the injection phase of a LOCA, the Refueling Water Tank (RWT) will be nearly empty.

Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the ECCS pumps is automatically switched to the containment recirculation sump. Switchover from RWT to containment sump must occur before the RWT empties to prevent damage to the ECCS pumps and a loss of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sump to support pump suction. Furthermore, early switchover must not occur to ensure suffic.ient borated water is injected from the-RWT to ensure the reactor remains shut down in the recirculation mode.

An RWT Level - Low signal initiates the RAS.

6, 7. Auxiliary Feedwater Actuation Signal AFAS consists of two steam generator (SG) specific signals (AFAS-1 and AFAS-2). AFAS-1 initiates auxiliary feed to SG #1, and AFAS-2 initiates auxiliary feed to SG #2.

AFAS maintains a steam generator heat sink during a steam generator tube rupture event and an MSLB or FWLB event either inside or outside containment.

Low steam generator water level initiates auxiliary feed to the affected steam generator, providing the generator is not identified (by the rupture detection circuitry) as faulted (a steam or FWLB).

AFAS logic includes steam generator specific inputs from the SG Pressure Difference - High (SG #1 > SG #2 or SG #2 > SG #1. bistable comparators) to determine if a fault in either generator has occurred.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.5-9 REVISION 0

ESFAS Instrumentation B 3.3.5 (Pre-RWT TS Setpoint Change)

BASES -Q LCO c. Steam Generator Level-High (continued) normal plant operation. The setting is low enough to prevent moisture damage to secondary plant components in the case of a steam generator overfill event.

5. Recirculation Actuation Signal

a. Refueling Water Tank Level - Low This LCO requires four channels of RWT Level - Low to be OPERABLE in MODES 1, 2, and 3.

The upper limit on the Allowable Value for this trip is set low enough to ensure RAS does hot initiate before sufficient water is transferred to the containment sump.

Premature recirculation could impair the reactivity control function of safety injection by limiting the amount of boron injection.

Premature recirculation could also damage or disable the recirculation system if recirculation begins before the sump has enough water to prevent air entrainment in the suction.

The lower limit on the RWT Level - Low trip Allowable Value is high enough to transfer suctionto the containment sump prior to emptying the RWT.

6, 7. Auxiliary Feedwater Actuation Signal SG #1 and SG #2 (AFAS-1 and AFAS-2)

AFAS-1 is initiated to SG #1 by either a low steam generator level coincident with no differential pressure trip present or by a low steam generator level coincident with a differential pressure between the two generators with the higher pressure in SG #1.

AFAS-2 is similarly configured to feed SG #2.

The steam generator secondary differential pressure is used, as an input of the AFAS logic where it is used to determine if a generator is intact. The AFAS logic inhibits feeding a steam generator if the pressure in that steam generator is less than the pressure in the other steam generator by the Steam Generator Pressure Difference (SGPD) - High setpoint.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.5ý18 REVISION 35

RWT B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Refueling Water Tank (RWT)

BASES a3(Pre-RVWýT TS Setpoint Change)

BACKGROUND The RWT supports the ECCS and the Containment Spray System by providing a source of borated water for Engineered Safety Feature (ESF) pump operation.

The RWT supplies two ECCS trains by separate, redundant supply headers. Each header also supplies one train of the Containment Spray System. A motor operated isolation valve is provided in each header to allow the operator to isolate the usable volume of the RWT from the ECCS after the ESF pump suction has been transferred to the containment sump following depletion of the RWT during a Loss of Coolant Accident (LOCA). A separate header is used to supply the Chemical and Volume Control System (CVCS) from the RWT. Use of a single RWT to supply both trains of the ECCS is acceptable since the RWT is a passive component, and passive failures are not assumed to occur coincidently with the Design Basis Event during the injection phase of an accident. Not all the water stored in the RWT is available for injection following a LOCA; the location of the ECCS suction piping in the RWT will result in some portion of the stored volume being unavailable.

The High Pressure Safety Injection (HPSI), Low Pressure Safety Injection (LPSI), and containment spray pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions. These lines discharge back to the RWT.

The RWT vents to the Fuel Building Ventilation System. When the suction for the HPSI and containment spray pumps is transferred to the containment sump, this flow path must be isolated to prevent a release of the containment sump contents to the RWT. If not isolated, this flow path could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ESF pumps.

This LCO ensures that:

a. The RWT contains sufficient borated water to support the ECCS during the injection phase; (continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-1 REVISION G

RWT B 3.5.5 BASES (r-W TSStoZtC hng e BACKGROUND b. Sufficient water volume exists in the containment sump (continued) to support continued operation of the ESF pumps at the time of transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a LOCA.

Insufficient water inventory in the RWT could result in (1) insufficient cooling capacity of the ECCS, or (2) insufficient water level to support continued ESF pump operation when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following a LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside containment.

The RWT also provides a source of borated water to the charging system for makeup to the RCS to compensate for contraction of the RCS coolant during plant cooldown while maintaining adequate shutdown margin. Although this charging system boration function is not required to be in a Technical Specification LCO per 10 CFR 50.36(c)(2)(ii) criteria, the RWT volume requirements of Figure 3.5.5-1 include this function in order to provide the plant operators with a single requirement for RWT volume.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-2 REVISION -

RWT B 3.5.5 BASES r(Pr~e-RýWT TýSSet~point ýChan~ge)

BACKGROUND The table below provides the required RWT level at selected (continued) RCS average temperature values, corresponding to Figure 3.5.5-1. The RWT volume is the total volume of water in the RWT above the vortex breaker. This volume includes the volumes required to be transferred, as discussed below, an allowance for instrument uncertainty, and the volume that will remain in the RWT after the switch over to the recirculation mode.

RWT Required Level at RCS Temperatures RCS Temperature (iF) RWT Required Level RWT Volume

• average (%) (Gallons) 210 79.9 601,000 250 80.1 603,000 300 80.4 605,000 350 80.8 608,000 400 81.2 611,000 450 81.6 614,000 500 82.1 618,000 565 83.0 624,000 600 83.0 624,000

• The volumes include instrument uncertainty and have been rounded up or down to the nearest 1,000 gallons.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-3 REVISION 1-5-4

ý

RWT B 3.5.'5 BASES (Pre-RWT TS SetpointýChange))

APPLICABLE During accident conditions, the RWT provides a source of SAFETY ANALYSES borated water to the HPSI, LPSI and containment spray pumps.

As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Bases B 3.5.3, "ECCS - Operating," and B 3.6.6, "Containment Spray." These analyses are used to assess changes to the RWT in order to evaluate their effects in relation to the acceptance limits.

The level limit of Figure 3.5.5-1 for the ESF function is based on the largest of the following four factors:

a. A volume of 476,338 gallons must be transferred to containment via the ESF pumps prior to reaching a low level switchover to the containment sump for recirculation. This ESF Reserve Volume ensures that the ESF pump suction will not be aligned to the containment sump until the point at which 75% of the minimum design flow of one HPSI pump is capable of meeting or exceeding the decay heat boil-off rate.

b. A volume of 543,200 gallons (at 600iF) must be transferred to the RCS and containment for flooding of sump strainers to prevent vortexing and to ensure adequate net positive suction head to support continued ESF pump operation after the switchover to recirculation occurs.

c. A volume of 400,000 gallons must be available for Containment Spray System operation as credited in the containment pressure and temperature analyses.

d. A volume of borated water is needed during ECCS functions to ensure shut down margin (SDM) is maintained. The volume required is similar to that needed for the charging system function of compensating for contraction of the RCS coolant during plant cooldown. The volume required will vary depending upon the event and is bounded by the volume (continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-4 REVISION 50

After RWT TS Setpoint Change ESFAS Instrumentation Once a RAS has Occurred, timely operator action is required to close the RWVT isolation B 3.3.5 valves (CH-531 and CH-530) to preclude air entrainment in the suction from the RWT during switchover to recirculation. The volume remaining in the RWIT after the RAS BASES provides enough time for this oporator action and closure ot the valves.

APPLICABLE 4. Main Steam Isolation Signal (continued)

SAFETY ANALYSES (continued) high level condition or if a high containment pressure condition exists. This prevents an excessive rate of heat extraction and subsequent cooldown of the RCS during these events, 5, Recirculation Actuation Signal At the end of the injection phase of a LOCA, the Refueling Water Tank (RWT) will be nearly empty.

Continued cooling must be provided by the ECCS to remove decay heat. The source.of water for the ECCS pumps is automatically switched to the containment recirculation sump. Switchover from RWT to containment sump must occur before the RWT empties to prevent damage to the ECCS pumps and a loss of core cooling capability, For similar reasons. switchover must not occur before there is sufficient water in the containment sump to support pump suction. Furthermore.

early switchover must not occur to ensure sufficient borated water is injected from the RWT to ensure the reactor remains shut down in the recirculatlon mode, An RWT Level - Low signal initiates the RAS. <-

6, 7. Auxiliary Feedwater Actuation Signal AFAS consists of two steam generator (SG) specific signals (AFAS-1 and AFAS-2). AFAS-1 initiates auxiliary feed to SG #I, and AFAS-2 initiates auxiliary feed to SG #2.

AFAS maintains a steam generator heat sink during a steam generator tube rupture event and an MSLB or FWLB event either inside or outside containment.

Low steam generator water level initiates auxiliary feed to the affected steam generator, providing the generator is not identified (by the rupture detection circuitry) as faulted (a steam or FWLB).

AFAS logic includes steam generator specific inputs from the SG Pressure Difference - High (SG #1 > SG #2 or SG #2 > SG #1, bistable comparators) to determine if a fault in either generator has occurred.

(continued)

PALO VERDE UNITS 1,2,3 L 3 REVISION 0

eoitCa e EAfter RWT TS ESFAS Instrumentation Once a RAS has occurred, timely operator action is required to close the RWT isolation b I M3.

valves (CH-531 and CH-30 to preclude air entrainment in the suction from the RWVT during switchover to recirculation. The volume remaining in the RWT after the RAS BASES provides enough time for this operator action and closure of the valves, LCD c. Steam Generator Level-High (continued) normal plant operation. The setting is low enough to prevent moisture damage to secondary plant components in the case of a steam generator overfill event.

5. Recirculation Actuation Signal

a. Refueling Water Tank Level - Low This LCO requires four channels of RWT Level - Low to be OPERABLE in MODES 1.2. and 3.

The upper limit on the Allowable Value for this trip is set low enough to ensure RAS does not initiate before sufficient water is transferred to the containment sump.

Premature recirculation could impair the reactivity control function of safety injection by limiting the amount of boron injection.

Premature recirculation could also damage or disable the recirculation system if recirculation begins before the sump has enough water to prevent air entrainment in the suction.

The lower limit on the RWT Level - Low trip Allowable Value is high enough to transfer suction to the containment sump prior to emptying the RWT. <

6. 7. Auxiliary Feedwater Actuation Signal SG #1 and SG #2 (AFAS-1 and AFAS-2)

AFAS-1 is initiated to SG #1 by either a low steam generator level coincident with no differential pressure trip present or by a low steam generator level coincident with a differential pressure between the two generators with the higher pressure in SG #1.

AFAS-2 is similarly configured to feed SG #2.

The steam generator secondary differential pressure is used, as an input of the AFAS logic where it is used to determine if a generator is intact. The AFAS logic inhibits feeding a steam generator if the pressure in that steam generator is less than the pressure in the other steam generator by the Steam qenerator Pressure Difference (SGPD) - High setpoint.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.5-1B REVISION 35

RWT B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Refueling Water Tank (RWT)

BASES (After-RWT TS Setpoint Change)

BACKGROUND The RWT supports the ECCS and the Containment Spray System by providing a source of borated water for Engineered Safety Feature (ESF) pump operation.

The RWT supplies two ECCS trains by separate, redundant supply headers. Each header also supplies one train of the Containment Spray System. A motor operated isolation valve is provided in each header to allow the operator to isolate the usable volume of the RWT from the ECCS after the ESF pump suction has been transferred to the containment sump following depletion of the RWT during a Loss of Coolant Accident (LOCA). A separate header is used to supply the Chemical and Volume Control System (CVCS) from the RWT. Use of a single RWT to supply both trains of the ECCS is acceptable since the RWT is a passive component, and passive failures are not assumed to occur coincidently with the Design Basis Event during the injection phase of an accident. Not all the water stored in the RWT is available for injection following a LOCA; the location of the ECCS suction piping in the RWT will result in some portion of the stored volume being unavailable.

The High Pressure Safety Injection (HPSI), Low Pressure Safety Injection (LPSI), and containment spray pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions. These lines discharge back to the RWT.

The RWT vents to the Fuel Building Ventilation System. When the suction for the HPSI and containment spray pumps is transferred to the containment sump, this flow path must be isolated to prevent a release of the containment sump contents to the RWT. If not isolated, this flow path could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ESF pumps.

This LCO ensures that:

a. The RWT c in . ." b w er to support the ECCS 2nC nment Spray Systemduring the in j ect ioYl (continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-s REVISION 5

RWT B 3.5.5 BASES ýýAftýer-RWT TS Setpoint Change)

BACKGROUND b. Sufficient water volume exists in the containment sump (continued) to support continued operation of the ESF pumps at the time of transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a LOCA.

Insufficient water inventory in the RWT co result Jn insuf* ccooling capacity of the ECC*_*nd ntaie (SpraySystem? or (2) insufficient water eve- o support c pump operation when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following a LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside containment.

The RWT also provides a source of'borated water to the charging system for makeup to the RCS to compensate for contraction of the RCS coolant during plant cooldown while maintaining adequate shutdown margin. Although this charging system boration function is not required to be in a Technical Specification LCO per 10 CFR 50.36(c)(2)(ii) criteria, the RWT volume requirements of Figure 3.5.5-1 include this function in order to provide the plant operators with a single requirement for RWT volume.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.5- REVISION -54 0

RWT B 3.5.5 BASES (After-RWýTTS Setpoýint Change)'

BACKGROUND The table below provides the required RWT level at selected (continued) RCS average temperature values, corresponding to Figure 3.5.5-1. The RWT volume is the total volume of water in the RWT above the vortex breaker. This volume includes the volumes required to be transferred, as discussed below, an allowance for instrument uncertainty, and the volume that will remain in the RWT after the switch over to the recirculation mode.

RWT Required Level at RCS Temperatures RCS Temperature (iF) RWT Required Indicated RWT Volume

• average Level7

(%) (Gallons) 210 7-")81.2249-,0610 250 84.481.4 653.00613,000 300 90481.8 400 ,61 000 350 809 82.1 6L-.G0"618,000 400 89-282.5 411,444621,000 450 94-.683.0 44404624,000 500 82-483.5 619,944L628,000 565 893084.3 42 n4--OD nn0 600 93-8084.3 y 2A nnn

• The volumes include instrument uncertainty and have been rounded up or down to the nearest 1,000 gallons.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-s REVISION 5,4

RWT B 3.5.5 BASES r (After-RWT TS Set~pointýChan~geej APPLICABLE During accident conditions, the RWT provides a source of SAFETY ANALYSES borated water to the HPSI, LPSI and containment spray pumps.

As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Bases B 3.5.3, "ECCS - Operating," and B 3.6.6, "Containment Spray." These analyses are used to assess changes to the RWT in order to evaluate their effects in relation to the acceptance limits.

The level limit of Figure 3.5.5-1 for the ESF function is based on the largest of the following four factors:

a: A volume 'of 71-"0 alsbrated water 'must be transferred ct e prior to reaching a low level switchover to the containment sump for recirculation. This ESF Reserve Volume ensures that the ESF pump suction will not be aligned to the containment sump until the point at which 75%

of the minimum design flow of one HPSI pump is capable of meeting or exceeding the decay heat boil-off rate.

b. A volume of oratedwater543.29O gallonS (at 6OQjF must be tra e o flooding of sump strainers to prevent vortexing and to ensure adequate net positive suction head to support continued ESF pump operation after the switchover to recirculation occurs.

c. A volume of borated water4O rO j-14 must be available fron ainmen pray ys em operation as credited in the containment pressure and temperature analyses.

d. A volume of borated water is needed during ECCS functions to ensure shut down margin (SDM) is maintained. The volume required is similar to that needed for the charging system function of compensating for contraction of the RCS coolant during plant cooldown. The volume required will vary depending upon the event and is bounded by the volume (continued)

A-1 PALO VERDE UNITS 1,2,3 B 3. 5. 5 -43(ý ý REVISION -54 Lýj