Text

Insertion Instructions Technical Specifications Bases, Revision 56, Summary of Changes
	ML12193A042
Person / Time
Site:	Palo Verde
Issue date:	05/25/2012
From:	Stephenson C; APS, Arizona Public Service Co
To:	; Office of Nuclear Reactor Regulation
References
	102-06538-TNW/RAS/CJS, Z05778
	Download: ML12193A042 (266)
	v • d • e

Insertion Instructions for Technical Specifications Bases Revision 56 Summary of Changes Technical Specification (TS) Bases Revision 56 incorporates LDCR 11-B002 related to the License Amendment (LA) 188 that was approved by the NRC staff on December 15, 2011. Specifically, this revision of the TS Bases implements changes related to LA 188 that relocates specific surveillance frequencies to a Iicensee-control/ed program, consistent with adoption of Technical Specification Task Force (TSTF) Traveler 425, Revision 3, Relocate SU/veillance Frequencies to Licensee Control - Risk Informed Technical Specification Task Force (RITSTF) Initiative 5b. The previous TS Bases information describing the reasons for the surveillance frequencies are relocated to the licensee-controlled surveillance frequency control program procedure 01 DP-ORS03, Surveillance Test Interval Control.

REMOVE PAGES INSERT PAGES Cover page Cover page List of Effective Pages List of Effective Pages 1/2 through 7/8 1/2 through 7/8 B 3.1.1-5/ B 3.1.1-6 B 3.1 .1-5 / B 3.1 .1-6 B 3.1.2-9 / Blank B 3.1.2-9 / Blank B 3.1.3-5 / B 3.1.3-6 B 3.1.3-5 / B 3.1.3-6 B 3.1.5-9/ B 3.1.5-10 B 3.1.5-9 / B 3.1.5-10 B 3.1 .5-11 / B 3.1 .5-12 B 3.1.5-11 / B 3.1.5-12 B 3.1.6-5 / B 3.1.6-6 B 3.1.6-5/ B 3.1.6-6 B 3.1.7-7 / B 3.1.7-8 B 3.1 .7-7 / B 3.1.7-8 B 3.1.7-9/ Blank B 3.1.7-9/ Blank B 3.1.8-5/ Blank B 3.1.8-5/ Blank B 3. 1.9-5 / B 3.1 .9-6 B 3.1 .9-5 / B 3.1 .9-6 B 3.1.10-5/ B 3.1.10-6 B 3.1.10-5 / B 3.1.10-6 B 3.2.1-7/ B 3.2.1-8 B 3.2.1-7/ B 3.2.1-8 B 3.2.2-7 / Blank B 3.2.2-7 / Blank B 3.2.3-7 / B 3.2.3-8 B 3.2.3-7 / B 3.2.3-8 B 3.2.3-9/ B 3.2.3-10 B 3.2.3-9/ B 3.2.3-10 Stephenson, Digitally signed by Stephenson, Carl J(Z05778)

DN: cn=Stephenson, Carl J(Z05778)

Carl J(Z05778)

Reason: I attest to the accuracy and integrity of this document Date: 2012.05.25 15:47:03 -07'00'

Insertion Instructions for Technical Specifications Bases Revision 56 B 3.2.4-7 1 B 3.2.4-8 B 3.2.4-7 1 B 3.2.4-8 B 3.2.4-91 Blank B 3.2.4-91 Blank B 3.2.5-51 B 3.2.5-6 B 3.2.5-51 B 3.2.5-6 B 3.3.1-391 B 3.3.1-40 B 3.3.1-39 1 B 3.3.1-40 through through B 3.3.1-491 B 3.3.1-50 B 3.3.1-491 B 3.3.1-50 B 3.3.2-131 B 3.3.2-14 B 3.3.2-131 B 3.3.2-14 B 3.3.2-151 B 3.3.2-16 B 3.3.2-151 B 3.3.2-16 B 3.3.2-171 B 3.3.2-18 B 3.3.2-17 1 B 3.3.2-18 B 3.3.3-91 B 3.3.3-10 B 3.3.3-91 B 3.3.3-10 B 3.3.3-11 1 B 3.3.3-12 B 3.3.3-11 1 B 3.3.3-12 B 3.3.4-131 B 3.3.4-14 B 3.3.4-13 1 B 3.3.4-14 B 3.3.4-151 Blank B 3.3.4-151 Blank B 3.3.5-251 B 3.3.5-26 B 3.3.5-251 B 3.3.5-26 B 3.3.5-27 1 B 3.3.5-28 B 3.3.5-27 1 B 3.3.5-28 B 3.3.5-29 1 B 3.3.5-30 B 3.3.5-291 B 3.3.5-30 B 3.3.6-191 B 3.3.6-20 B 3.3.6-191 B 3.3.6-20 B 3.3.6-211 B 3.3.6-22 B 3.3.6-21 1 B 3.3.6-22 B 3.3.7-71 B 3.3.7-8 B 3.3.7-7 1 B 3.3.7-8 B 3.3.7-91 Blank B 3.3.7-91 Blank B 3.3.8-51 B 3.3.8-6 B 3.3.8-51 B 3.3.8-6 B 3.3.8-71 B 3.3.8-8 B 3.3.8-7 1 B 3.3.8-8 B 3.3.9-51 B 3.3.9-6 B 3.3.9-5 1 B 3.3.9-6 B 3.3.9-71 Blank B 3.3.9-7 1 Blank B 3.3.10-191 B 3.3.10-20 B 3.3.10-191 B 3.3.10-20 B 3.3.11-51 B 3.3.11-6 B 3.3.11-51 B 3.3.11-6 B 3.3.11-71 Blank B 3.3.11-7 1 Blank B 3.3.12-5 1 B 3.3.12-6 B 3.3.12-5 1 B 3.3.12-6 B 3.4.1-5 1 Blank B 3.4.1-5 1 Blank B 3.4.2-1 1 B 3.4.2-2 B 3.4.2-1 1 B 3.4.2-2 2

Insertion Instructions for Technical Specifications Bases Revision 56 B 3.4.3-7 / B 3.4.3-8 B 3.4.3-7 / B 3.4.3-8 B 3.4.4-3 / B 3.4.4-4 B 3.4.4-3 / B 3.4.4-4 B 3.4.5-3 / B 3.4.5-4 B 3.4.5-3 / B 3.4.5-4 B 3.4.5-5 / Blank B 3.4.5-5 / Blank B 3.4.6-5 / Blank B 3.4.6-5 / Blank B 3.4.7-5 / B 3.4.7-6 B 3.4.7-5 / B 3.4.7-6 B 3.4.8-3 / Blank B 3.4.8-3 / Blank B 3.4.9-5 / B 3.4.9-6 B 3.4.9-5 / B 3.4.9-6 B 3.4.11-5 / B 3.4.11-6 B 3.4.11-5 / B 3.4.11-6 B 3.4.12-3 / B 3.4.12-4 B 3.4.12-3 / B 3.4.12-4 B 3.4.13-9 / B 3.4.13-10 B 3.4.13-9 / B 3.4.13-10 B 3.4.14-7 / B 3.4.14-8 B 3.4.14-7 / B 3.4.14-8 B 3.4.15-5 / B 3.4.15-6 B 3.4.15-5 / B 3.4.15-6 B 3.4.16-5 / B 3.4.16-6 B 3.4.16-5 / B 3.4.16-6 B 3.4.17-5 / B 3.4.17-6 B 3.4.17-5 / B 3.4.17-6 B 3.5.1-9 / B 3.5.1-10 B 3.5.1-9 / B 3.5.1-10 B 3.5.2-9 / B 3.5.2-10 B 3.5.2-9 / B 3.5.2-10 B 3.5.3-7 / B 3.5.3-8 B 3.5.3-7 / B 3.5.3-8 B 3.5.3-9 / B 3.5.3-10 B 3.5.3-9 / B 3.5.3-10 B 3.5.5-7 / B 3.5.5-8 B 3.5.5-7 / B 3.5.5-8 B 3.5.5-9 / Blank B 3.5.5-9 / Blank B 3.5.6-3 / B 3.5.6-4 B 3.5.6-3 / B 3.5.6-4 B 3.5.6-5 / Blank B 3.5.6-5 / Blank B 3.6.2-7 / B 3.6.2-8 B 3.6.2-7 / B 3.6.2-8 3

Insertion Instructions for Technical Specifications Bases Revision 56 B 3.6.3-15/ B 3.6.3-16 B 3.6.3-15/ B 3.6.3-16 B 3.6.3-17 / B 3.6.3-18 B 3.6.3-17 / B 3.6.3-18 B 3.6.3-19/ Blank B 3.6.3-19/ Blank B 3.6.4-3/ Blank B 3.6.4-3/ Blank B 3.6.5-3/ B 3.6.5-4 B 3.6.5-3 / B 3.6.5-4 B 3.6.6-5 / B 3.6.6-6 B 3.6.6-5/ B 3.6.6-6 B 3.6.6-7 / B 3.6.6-8 B 3.6.6-7 / B 3.6.6-8 B 3.7.4-5/ Blank B 3.7.4-5/ Blank B 3.7.5-7/ B 3.7.5-8 B 3.7.5-7 / B 3.7.5-8 B 3.7.5-9/ B 3.7.5-10 B 3.7.5-9/ B 3.7.5-10 B 3.7.6-3/ B 3.7.6-4 B 3.7.6-3/ B 3.7.6-4 B 3.7.7-3/ B 3.7.7-4 B 3.7.7-3/ B 3.7.7-4 B 3.7.7-5/ Blank B 3.7.7-5/ Blank B 3.7.8-3/ B 3.7.8-4 B 3.7.8-3/ B 3.7.8-4 B 3.7.9-3/ Blank B 3.7.9-3/ Blank B 3.7.1 0-3 / B 3.7.1 0-4 B 3.7.10-3/ B 3.7.10-4 B 3.7.11-7 / B 3.7.11-8 B 3.7.11-7/ B 3.7.11-8 B 3.7.12-3/ B 3.7.12-4 B 3.7.12-3/ B 3.7.12-4 B 3.7.13-3/ B 3.7.13-4 B 3.7.13-3/ B 3.7.13-4 B 3.7.13-5/ Blank B 3.7.13-5/ Blank B 3.7.14-3/ Blank B 3.7.14-3/ Blank B 3.7.15-1/ B 3.7.15-2 B 3.7.15-1 / B 3.7.15-2 B 3.7.16-3/ B 3.7.16-4 B 3.7.16-3/ B 3.7.16-4 B 3.8.1-23/ B 3.8.1-24 B 3.8.1-23/ B 3.8.1-24 through through B 3.8.1-45/ B 3.8.1-46 B 3.8.1-45/ B 3.8.1-46 4

Insertion Instructions for Technical Specifications Bases Revision 56 B 3.8.3-5/ B 3.8.3-6 B 3.8.3-5 / B 3.8.3-6 B 3.8.3-7/ B 3.8.3-8 B 3.8.3-7 / B 3.8.3-8 B 3.8.3-9 / B 3.8.3-10 B 3.8.3-9/ B 3.8.3-10 B 3.8.4-5 / B 3.8.4-6 B 3.8.4-5 / B 3.8.4-6 B 3.8.4-7 / B 3.8.4-8 B 3.8.4-7 / B 3.8.4-8 B 3.8.4-9/ B 3.8.4-10 B 3.8.4-9/ B 3.8.4-10 B 3.8.6-3/ B 3.8.6-4 B 3.8.6-3/ B 3.8.6-4 B 3.8.7-5/ Blank B 3.8.7-5/ Blank B 3.8.8-3/ B 3.8.8-4 B 3.8.8-3/ B 3.8.8-4 B 3.8.8-5 / Blank B 3.8.8-5 / Blank B 3.8.9-9/ B 3.8.9-10 B 3.8.9-9/ B 3.8.9-10 B 3.8.10-3 / B 3.8.10-4 B 3.8.10-3/ B 3.8.10-4 B 3.9.1-3/ B 3.9.1-4 B 3.9.1-3/ B 3.9.1-4 B 3.9.2-3/ B 3.9.2-4 B 3.9.2-3/ B 3.9.2-4 B 3.9.3-5/ B 3.9.3-6 B 3.9.3-5/ B 3.9.3-6 B 3.9.4-3/ B 3.9.4-4 B 3.9.4-3/ B 3.9.4-4 B 3.9.5-3/ B 3.9.5-4 B 3.9.5-3/ B 3.9.5-4 B 3.9.5-5/ Blank None B 3.9.6-3 / Blank B 3.9.6-3/ Blank B 3.9.7-3/ Blank B 3.9.7-3/ Blank 5

PVNGS Palo Verde Nuclear Generating Station Units 1, 2, and 3 Technical Specification Bases Revision 56 May 30, 2012 Ste Phenso n, Digitally signed by Stephenson, Ca,l JIZOS778)

" DN:cn=Stephenson, Ca,IJIZOS778)

, Reason: I attest to the accuracy and Integrity of Carl J(Z05778) ~~:e~~~~;~~t2415:15:27-07'OO

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _- - - 1

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 2.1.1-1 0 B 3.1.4-3 0 B 2.1.1-2 0 B 3.1.4-4 0 B 2.1.1-3 37 B 3.1.4-5 0 B 2.1.1-4 21 B 3.1.5-1 0 B 2.1.1-5 54 B 3.1.5-2 52 B 2.1.2-1 0 B 3.1.5-3 52 B 2.1.2-2 31 B 3.1.5-4 52 B 2.1.2-3 0 B 3.1.5-5 52 B 2.1.2-4 54 B 3.1.5-6 52 B 3.0-1 49 B 3.1.5-7 52 B 3.0-2 0 B 3.1.5-8 52 B 3.0-3 0 B 3.1.5-9 52 B 3.0-4 0 B 3.1.5-10 56 B 3.0-5 42 B 3.1.5-11 56 B 3.0-6 48 B 3.1.5-12 56 B 3.0-7 48 B 3.1.6-1 0 B 3.0-8 42 B 3.1.6-2 46 B 3.0-9 42 B 3.1.6-3 42 B 3.0-10 42 B 3.1. 6-4 42 B 3.0-11 42 B 3.1. 6-5 56 B 3.0-12 42 B 3.1.6-6 46 B 3.0-13 42 B 3.1.7-1 0 B 3.0-14 49 B 3.1.7-2 0 B 3.0-15 50 B 3.1.7-3 53 B 3.0-16 50 B 3.1.7-4 48 B 3.0-17 50 B 3.1.7-5 25 B 3.0-18 49 B 3.1.7-6 0 B 3.0-19 49 B 3.1.7-7 0 B 3.0-20 49 B 3.1.7-8 56 B 3.0-21 49 B 3.1.7-9 56 B 3.0-22 49 B 3.1.8-1 52 B 3.1.1-1 28 B 3.1.8-2 52 B 3.1.1-2 0 B 3.1.8-3 52 B 3.1.1-3 43 B 3.1.8-4 52 B 3.1.1-4 43 B 3.1.8-5 56 B 3.1.1-5 27 B 3.1.9-1 0 B 3.1.1-6 56 B 3.1.9-2 0 B 3.1.2-1 28 B 3.1.9-3 0 B 3.1.2-2 0 B 3.1.9-4 0 B 3.1.2-3 43 B 3.1.9-5 56 B 3.1.2-4 28 B 3.1.9-6 56 B 3.1.2-5 0 B 3.1.10-1 0 B 3.1.2-6 43 B 3.1.10-2 53 B 3.1.2-7 12 B 3.1.10-3 0 B 3.1.2-8 47 B 3.1.10-4 37 B 3.1.2-9 56 B 3.1.10-5 56 B 3.1.3-1 0 B 3.1.10-6 0 B 3.1.3-2 0 B 3.1.11-1 0 B 3.1.3-3 0 B 3.1.11-2 53 B 3.1.3-4 0 B 3.1.11-3 0 B 3.1.3-5 0 B 3.1.11-4 53 B 3.1.3-6 56 B 3.1.11-5 0 B 3.1.4-1 0 B 3.2.1-1 53 B 3.1.4-2 31 B 3.2.1-2 10 PALO VERDE UNITS 1, 2, AND 3 1 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.2.1-3 53 B 3.3.1-15 53 B 3.2.1-4 0 B 3.3.1-16 53 B 3.2.1-5 0 B 3.3.1-17 53 B 3.2.1-6 0 B 3.3.1-18 53 B 3.2.1-7 56 B 3.3.1-19 53 B 3.2.1-8 56 B 3.3.1-20 53 B 3.2.2-1 52 B 3.3.1-21 53 B 3.2.2-2 10 B 3.3.1-22 53 B 3.2.2-3 0 B 3.3.1-23 53 B 3.2.2-4 52 B 3.3.1-24 53 B 3.2.2-5 1 B 3.3.1-25 53 B 3.2.2-6 0 B 3.3.1-26 53 B 3.2.2-7 56 B 3.3.1-27 53 B 3.2.3-1 52 B 3.3.1-28 53 B 3.2.3-2 10 B 3.3.1-29 53 B 3.2.3-3 0 B 3.3.1-30 53 B 3.2.3-4 52 B 3.3.1-31 53 B 3.2.3-5 0 B 3.3.1-32 53 B 3.2.3-6 0 B 3.3.1-33 53 B 3.2.3-7 0 B 3.3.1-34 53 B 3.2.3-8 56 B 3.3.1-35 53 B 3.2.3-9 56 B 3.3.1-36 53 B 3.2.3-10 0 B 3.3.1-37 53 B 3.2.4-1 52 B 3.3.1-38 53 B 3.2.4-2 10 B 3.3.1-39 53 B 3.2.4-3 0 B 3.3.1-40 56 B 3.2.4-4 52 B 3.3.1-41 56 B 3.2.4-5 53 B 3.3.1-42 56 B 3.2.4-6 53 B 3.3.1-43 56 B 3.2.4-7 53 B 3.3.1-44 56 B 3.2.4-8 56 B 3.3.1-45 53 B 3.2.4-9 56 B 3.3.1-46 56 B 3.2.4-10 31 B 3.3.1-47 56 B 3.2.5-1 52 B 3.3.1-48 56 B 3.2.5-2 10 B 3.3.1-49 56 B 3.2.5-3 0 B 3.3.1-50 53 B 3.2.5-4 52 B 3.3.1-51 53 B 3.2.5-5 0 B 3.3.2-1 50 B 3.2.5-6 56 B 3.3.2-2 0 B 3.2.5-7 0 B 3.3.2-3 1 B 3.3.1-1 35 B 3.3.2-4 35 B 3.3.1-2 53 B 3.3.2-5 35 B 3.3.1-3 53 B 3.3.2-6 51 B 3.3.1-4 53 B 3.3.2-7 35 B 3.3.1-5 53 B 3.3.2-8 35 B 3.3.1-6 53 B 3.3.2-9 50 B 3.3.1-7 53 B 3.3.2-10 38 B 3.3.1-8 53 B 3.3.2-11 42 B 3.3.1-9 53 B 3.3.2-12 42 B 3.3.1-10 53 B 3.3.2-13 56 B 3.3.1-11 53 B 3.3.2-14 56 B 3.3.1-12 53 B 3.3.2-15 56 B 3.3.1-13 53 B 3.3.2-16 56 B 3.3.1-14 53 B 3.3.2-17 56 PALO VERDE UNITS 1, 2, AND 3 2 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.3.2-18 35 B 3.3.5-27 56 B 3.3.3-1 53 B 3.3.5-28 56 B 3.3.3-2 53 B 3.3.5-29 56 B 3.3.3-3 53 B 3.3.5-30 35 B 3.3.3-4 53 B 3.3.6-1 0 B 3.3.3-5 53 B 3.3.6-2 0 B 3.3.3-6 53 B 3.3.6-3 0 B 3.3.3-7 53 B 3.3.6-4 0 B 3.3.3-8 53 B 3.3.6-5 31 B 3.3.3-9 53 B 3.3.6-6 0 B 3.3.3-10 56 B 3.3.6-7 27 B 3.3.3-11 56 B 3.3.6-8 27 B 3.3.3-12 56 B 3.3.6-9 0 B 3.3.4-1 0 B 3.3.6-10 0 B 3.3.4-2 0 B 3.3.6-11 0 B 3.3.4-3 0 B 3.3.6-12 0 B 3.3.4-4 0 B 3.3.6-13 0 B 3.3.4-5 0 B 3.3.6-14 0 B 3.3.4-6 31 B 3.3.6-15 0 B 3.3.4-7 0 B 3.3.6-16 0 B 3.3.4-8 0 B 3.3.6-17 27 B 3.3.4-9 0 B 3.3.6-18 0 B 3.3.4-10 0 B 3.3.6-19 56 B 3.3.4-11 0 B 3.3.6-20 0 B 3.3.4-12 0 B 3.3.6-21 56 B 3.3.4-13 56 B 3.3.6-22 46 B 3.3.4-14 56 B 3.3.7-1 2 B 3.3.4-15 56 B 3.3.7-2 2 B 3.3.5-1 0 B 3.3.7-3 0 B 3.3.5-2 0 B 3.3.7-4 0 B 3.3.5-3 0 B 3.3.7-5 0 B 3.3.5-4 35 B 3.3.7-6 42 B 3.3.5-5 0 B 3.3.7-7 0 B 3.3.5-6 0 B 3.3.7-8 56 B 3.3.5-7 0 B 3.3.7-9 56 B 3.3.5-8 31 B 3.3.8-1 0 B 3.3.5-9 54 B 3.3.8-2 44 B 3.3.5-10 54 B 3.3.8-3 0 B 3.3.5-11 54 B 3.3.8-4 0 B 3.3.5-12 1 B 3.3.8-5 0 B 3.3.5-13 0 B 3.3.8-6 56 B 3.3.5-14 0 B 3.3.8-7 56 B 3.3.5-15 35 B 3.3.8-8 56 B 3.3.5-16 51 B 3.3.9-1 48 B 3.3.5-17 35 B 3.3.9-2 48 B 3.3.5-18 54 B 3.3.9-3 55 B 3.3.5-19 54 B 3.3.9-4 55 B 3.3.5-20 54 B 3.3.9-5 56 B 3.3.5-21 35 B 3.3.9-6 56 B 3.3.5-22 35 B 3.3.9-7 56 B 3.3.5-23 52 B 3.3.10-1 0 B 3.3.5-24 38 B 3.3.10-2 0 B 3.3.5-25 42 B 3.3.10-3 0 B 3.3.5-26 56 B 3.3.10-4 0 PALO VERDE UNITS 1, 2, AND 3 3 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.3.10-5 18 B 3.4.5-5 56 B 3.3.10-6 0 B 3.4.6-1 0 B 3.3.10-7 0 B 3.4.6-2 6 B 3.3.10-8 14 B 3.4.6-3 52 B 3.3.10-9 14 B 3.4.6-4 6 B 3.3.10-10 51 B 3.4.6-5 56 B 3.3.10-11 50 B 3.4.7-1 0 B 3.3.10-12 50 B 3.4.7-2 6 B 3.3.10-13 50 B 3.4.7-3 52 B 3.3.10-14 50 B 3.4.7-4 54 B 3.3.10-15 50 B 3.4.7-5 0 B 3.3.10-16 50 B 3.4.7-6 56 B 3.3.10-17 50 B 3.4.7-7 52 B 3.3.10-18 50 B 3.4.8-1 0 B 3.3.10-19 56 B 3.4.8-2 54 B 3.3.10-20 56 B 3.4.8-3 56 B 3.3.10-21 50 B 3.4.9-1 41 B 3.3.10-22 32 B 3.4.9-2 31 B 3.3.11-1 0 B 3.4.9-3 41 B 3.3.11-2 2 B 3.4.9-4 41 B 3.3.11-3 2 B 3.4.9-5 56 B 3.3.11-4 42 B 3.4.9-6 56 B 3.3.11-5 42 B 3.4.10-1 53 B 3.3.11-6 56 B 3.4.10-2 7 B 3.3.11-7 56 B 3.4.10-3 0 B 3.3.12-1 15 B 3.4.10-4 54 B 3.3.12-2 50 B 3.4.11-1 0 B 3.3.12-3 37 B 3.4.11-2 53 B 3.3.12-4 37 B 3.4.11-3 0 B 3.3.12-5 56 B 3.4.11-4 52 B 3.3.12-6 56 B 3.4.11-5 56 B 3.4.1-1 10 B 3.4.11-6 54 B 3.4.1-2 53 B 3.4.12-1 1 B 3.4.1-3 0 B 3.4.12-2 34 B 3.4.1-4 0 B 3.4.12-3 48 B 3.4.1-5 56 B 3.4.12-4 56 B 3.4.2-1 7 B 3.4.12-5 31 B 3.4.2-2 56 B 3.4.l3-1 0 B 3.4.3-1 52 B 3.4.l3-2 55 B 3.4.3-2 52 B 3.4.l3-3 55 B 3.4.3-3 0 B 3.4.l3-4 52 B 3.4.3-4 52 B 3.4.l3-5 55 B 3.4.3-5 52 B 3.4.13-6 55 B 3.4.3-6 0 B 3.4.13-7 52 B 3.4.3-7 56 B 3.4.13-8 52 B 3.4.3-8 52 B 3.4.13-9 56 B 3.4.4-1 0 B 3.4.13-10 59 B 3.4.4-2 50 B 3.4.13-11 55 B 3.4.4-3 7 B 3.4.14-1 0 B 3.4.4-4 56 B 3.4.14-2 34 B 3.4.5-1 0 B 3.4.14-3 34 B 3.4.5-2 38 B 3.4.14-4 38 B 3.4.5-3 38 B 3.4.14-5 38 B 3.4.5-4 56 B 3.4.14-6 38 PALO VERDE UNITS 1, 2, AND 3 4 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page, Rev. Page Rev No. No. No. No.

B 3.4.14-7 56 B 3.5.3-6 2 B.3.4.14-8 56 B 3.5.3-7 2 B 3.4.15-1 0 B 3.5.3-8 56 B 3.4.15-2 48 B 3.5.3-9 56 B 3.4.15-3 0 B 3.5.3-10 56 B 3.4.15-4 0 B 3.5.4-1 15 B 3.4.15-5 56 B 3.5.4-2 0 B 3.4.15-6 56 B 3.5.4-3 42 B 3.4.15-7 54 B 3.5.5-1 54 B 3.4.16-1 2 B 3.5.5-2 54 B 3.4.16-2 10 B 3.5.5-3 55 B 3.4.16-3 0 B 3.5.5-4 54 B 3.4.16-4 42 B 3.5.5-5 51 B 3.4.16-5 56 B 3.5.5-6 51 B 3.4.16-6 56 B 3.5.5-7 51 B 3.4.17-1 0 B 3.5.5-8 56 B 3.4.17-2 27 B 3.5.5-9 56 B 3.4.17-3 42 B 3.5.6-1 0 B 3.4.17-4 42 B 3.5.6-2 1 B 3.4.17-5 56 B 3.5.6-3 0 B 3.4.17-6 56 B 3.5.6-4 56 B 3.4.18-1 38 B 3.5.6-5 56 B 3.4.18-2 40 B 3.6.1-1 0 B 3.4.18-3 38 B 3.6.1-2 53 B 3.4.18-4 38 B 3.6.1-3 0 B 3.4.18-5 38 B 3.6.1-4 29 B 3.4.18-6 38 B 3.6.1-5 29 B 3.4.18-7 38 B 3.6.2-1 45 B 3.4.18-8 38 B 3.6.2-2 53 B 3.5.1-1 0 B 3.6.2-3 0 B 3.5.1-2 53 B 3.6.2-4 0 B 3.5.1-3 7 B 3.6.2-5 0 B 3.5.1-4 0 B 3.6.2-6 0 B 3.5.1-5 0 B 3.6.2-7 0 B 3.5.1-6 0 B 3.6.2-8 56 B 3.5.1-7 1 B 3.6.3-1 36 B 3.5.1-8 1 B 3.6.3-2 43 B 3.5.1-9 56 B 3.6.3-3 49 B 3.5.1-10 56 B 3.6.3-4 43 B 3.5.2-1 0 B 3.6.3-5 43 B 3.5.2-2 53 B 3.6.3-6 43 B 3.5.2-3 53 B 3.6.3-7 43 B 3.5.2-4 0 B 3.6.3-8 43 B 3.5.2-5 0 B 3.6.3-9 43 B 3.5.2-6 0 B 3.6.3-10 43 B 3.5.2-7 1 B 3.6.3-11 43 B 3.5.2-8 22 B 3.6.3-12 43 B 3.5.2-9 56 B 3.6.3-13 43 B 3.5.2-10 56 B 3.6.3-14 43 B 3.5.3-1 0 B 3.6.3-15 43 B 3.5.3-2 48 B 3.6.3-16 56 B 3.5.3-3 0 B 3.6.3-17 56 B 3.5.3-4 0 B 3.6.3-18 56 B 3.5.3-5 0 B 3.6.3-19 56 PALO VERDE UNITS 1, 2, AND 3 5 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.6.4-1 53 B 3.7.6-3 55 B 3.6.4-2 38 B 3.7.6-4 56 B 3.6.4-3 56 B 3.7.7-1 0 B 3.6.5-1 0 B 3.7.7-2 1 B 3.6.5-2 1 B 3.7.7-3 1 B 3.6.5-3 56 B 3.7.7-4 56 B 3.6.5-4 0 B 3.7.7-5 56 B 3.6.6-1 0 B 3.7.8-1 1 B 3.6.6-2 0 B 3.7.8-2 1 B 3.6.6-3 53 B 3.7.8-3 1 B 3.6.6-4 7 B 3.7.8-4 56 B 3.6.6-5 1 B 3.7.9-1 0 B 3.6.6-6 56 B 3.7.9-2 44 B 3.6.6-7 56 B 3.7.9-3 56 B 3.6.6-8 56 B 3.7.10-1 10 B 3.6.6-9 54 B 3.7.10-2 1 B 3.7.1-1 50 B 3.7.10-3 1 B 3.7.1-2 50 B 3.7.10-4 56 B 3.7.1-3 34 B 3.7.11-1 50 B 3.7.1-4 34 B 3.7.11-2 50 B 3.7.1-5 54 B 3.7.11-3 51 B 3.7.1-6 54 B 3.7.11-4 55 B 3.7.2-1 40 B 3.7.11-5 50 B 3.7.2-2 42 B 3.7.11-6 55 B 3.7.2-3 40 B 3.7.11-7 56 B 3.7.2-4 40 B 3.7.11-8 56 B 3.7.2-5 40 B 3.7.11-9 50 B 3.7.2-6 40 B 3.7.12-1 1 B 3.7.2-7 40 B 3.7.12-2 21 B 3.7.2-8 54 B 3.7.12-3 55 B 3.7.2-9 54 B 3.7.12-4 56 B 3.7.3-1 1 B 3.7.13-1 0 B 3.7.3-2 1 B 3.7.13-2 0 B 3.7.3-3 37 B 3.7.13-3 0 B 3.7.3-4 0 B 3.7.13-4 56 B 3.7.3-5 54 B 3.7.13-5 56 B 3.7.4-1 50 B 3.7.14-1 0 B 3.7.4-2 50 B 3.7.14-2 21 B 3.7.4-3 50 B 3.7.14-3 56 B 3.7.4-4 50 B 3.7.15-1 3 B 3.7.4-5 56 B 3.7.15-2 56 B 3.7.5-1 0 B 3.7.16-1 7 B 3.7.5-2 0 B 3.7.16-2 0 B 3.7.5-3 40 B 3.7.16-3 56 B 3.7.5-4 27 B 3.7.16-4 0 B 3.7.5-5 42 B 3.7.17-1 52 B 3.7.5-6 42 B 3.7.17-2 3 B 3.7.5-7 9 B 3.7.17-3 3 B 3.7.5-8 56 B 3.7.17-4 3 B 3.7.5-9 56 B 3.7.17-5 3 B 3.7.5-10 56 B 3.7.17-6 52 B 3.7.5-11 54 B 3.8.1-1 35 B 3.7.6-1 54 B 3.8.1-2 2 B 3.7.6-2 54 B 3.8.1-3 34 PALO VERDE UNITS 1, 2, AND 3 6 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.8.1-4 34 B 3.8.3-4 0 B 3.8.1-5 20 B 3.8.3-5 54 B 3.8.1-6 27 B 3.8.3-6 56 B 3.8.1-7 42 B 3.8.3-7 56 B 3.8.1-8 50 B 3.8.3-8 41 B 3.8.1-9 42 B 3.8.3-9 56 B 3.8.1-10 43 B 3.8.3-10 54 B 3.8.1-11 50 B 3.8.4-1 0 B 3.8.1-12 48 B 3.8.4-2 37 B 3.8.1-13 48 B 3.8.4-3 0 B 3.8.1-14 48 B 3.8.4-4 2 B 3.8.1-15 48 B 3.8.4-5 2 B 3.8.1-16 41 B 3.8.4-6 56 B 3.8.1-17 41 B 3.8.4-7 56 B 3.8.1-18 41 B 3.8.4-8 56 B 3.8.1-19 41 B 3.8.4-9 56 B 3.8.1-20 41 B 3.8.4-10 56 B 3.8.1-21 41 B 3.8.4-11 48 B 3.8.1-22 41 B 3.8.5-1 1 B 3.8.1-23 56 B 3.8.5-2 1 B 3.8.1-24 50 B 3.8.5-3 21 B 3.8.1-25 56 B 3.8.5-4 21 B 3.8.1-26 56 B 3.8.5-5 2 B 3.8.1-27 56 ' B 3.8.5-6 2 B 3.8.1-28 56 B 3.8.6-1 0 B 3.8.1-29 53 B 3.8.6-2 0 B 3.8.1-30 56 B 3.8.6-3 56 B 3.8.1-31 50 B 3.8.6-4 56 B 3.8.1-32 56 B 3.8.6-5 37 B 3.8.1-33 56 B 3.8.6-6 37 B 3.8.1-34 56 B 3.8.6-7 48 B 3.8.1-35 50 B 3.8.7-1 48 B 3.8.1-36 56 B 3.8.7-2 48 B 3.8.1-37 45 B 3.8.7-3 53 B 3.8.1-38 56 B 3.8.7-4 53 B 3.8.1-39 56 B 3.8.7-5 56 B 3.8.1-40 56 B 3.8.8-1 1 B 3.8.1-41 56 B 3.8.8-2 1 B 3.8.1-42 56 B 3.8.8-3 21 B 3.8.1-43 56 B 3.8.8-4 56 B 3.8.1-44 56 B 3.8.8-5 56 B 3.8.1-45 56 B 3.8.9-1 51 B.3.8.1-46 56 B 3.8.9-2 0 B.3.8.1-47 45 B 3.8.9-3 51 B.3.8.1-48 53 B 3.8.9-4 0 B 3.8.2-1 0 B 3.8.9-5 0 B 3.8.2-2 0 B 3.8.9-6 0 B 3.8.2-3 0 B 3.8.9-7 0 B 3.8.2-4 21 B 3.8.9-8 0 B 3.8.2-5 21 B 3.8.9-9 0 B 3.8.2-6 0 B 3.8.9-10 56 B 3.8.3-1 0 B 3.8.9-11 51 B 3.8.3-2 0 B 3.8.10-1 0 B 3.8.3-3 50 B 3.8.10-2 21

,PALO VERDE UNITS 1, 2, AND 3 7 Revision 56 May 30, 2012

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.8.10-3 48 B 3.8.10-4 56 B 3.9.1-1 34 Corrected B 3.9;1-2 o B 3.9.1-3 o B 3.9.1-4 56 B 3.9.2-1 48 B 3.9.2-2 15 B 3.9.2-3 56 B 3.9.2-4 56 B 3.9.3-1 18 B 3.9.3-2 19 B 3.9.3-3 27 B 3.9.3-4 19 B 3.9.3-5 56 B.3.9.3-6 56 B 3.9.4-1 o B 3.9.4-2 54 B 3.9.4-3 o B 3.9.4-4 56 B 3.9.5-1 o B 3.9.5-2 54 B 3.9.5-3 27 B 3.9.5-4 56 B 3.9.6-1 o B 3.9.6-2 o B 3.9.6-3 56 B 3.9.7-1 o B 3.9.7-2 o B 3.9.7-3 56 PALO VERDE UNITS 1, 2, AND 3 8 Revision 56 May 30, 2012

SDM - Reactor Trip Breakers Open B 3.1.1 BASES (continued)

ACTIONS A.l (continued) possible. the boron concentration should be a highly concentrated solution. such as that normally found in the refueling water tank. The operator should borate with the best source available for the plant conditions.

In determining the boration flow rate. the time in core life must be considered. For instance. the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle. when boron concentration may approach or exceed 2000 ppm. Assuming that a value of 1%

~k/k must be recovered and a boration flow rate of 26 gpm.

it is possible to increase the boron concentration of the RCS by 100 ppm in less than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months with a 4000 ppm source.

If a boron worth of 10 pcm/ppm is assumed. this combination of parameters will increase the SDM by 1% ~k/k. These boration parameters of 26 gpm and 4000 ppm represent typical values and are provided for the purpose of offering a specific example.

SURVEILLANCE SR 3.1.1.1 REQUIREMENTS SDM is verified by performing a reactivity balance calculation. considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration;

f. Samarium concentration; and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because the reactor is subcritical. and the fuel temperature will be changing at the same rate as the ReS.

(continued)

PALO VERDE UNITS 1.2.3 B 3.1.1-5 REVISION 27

SDM - Reactor Trip Breakers Open B3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 26.

2. UFSAR. Secti on 15.1.

3. UFSAR. Section 15.4.

4. 10 CFR 100.

PALO VERDE UNITS 1.2.3 B 3.1.1-6 REVISION 56

SDM - Reactor Trip Breakers Closed B 3.1.2 BASES SURVEILLANCE SR 3.1.2.1. 3.1.2.2 and 3.1.2.3 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendi x A. GDC 26.

2. UFSAR. Secti on 15.1.

3. UFSAR. Section 15.4.

4. 10 CFR 100 PALO VERDE UNITS 1.2.3 B 3.1.2-9 REVISION 56

This page intentionally blank Reactivity Balance B 3.1.3 BASES ACTIONS A.1 and A.2 (continued) resolved. If the cause of the reactivity anomaly is a mismatch in core conditions at the time of RCS boron concentration sampling. then a recalculation of the RCS boron concentration requirements may be performed to demonstrate that core reactivity is behaving as expected.

If an unexpected physical change in the condition of the core has occurred. it must be evaluated and corrected. if possible. If the cause of the reactivity anomaly is in the calculation technique. then the calculational models must be revised to provide more accurate predictions. If any of these results are demonstrated and it is concluded that the reactor core is acceptable for continued operation. then the boron letdown curve may be renormalized. and power operation may continue. If operational restrictions or additional SRs are necessary to ensure the reactor core is acceptable for continued operation. then they must be defined.

The required Completion Time of 7 days is adequate for preparing whatever operating restrictions or Surveillances that may be required to allow continued reactor operation.

B.1 If the core reactivity cannot be restored to within the 1% ~k/k. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time is reasonable. based on operating experience. for reaching MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.3.1 REQUIREMENTS Core reactivity is verified by periodic comparisons of measured and predicted RCS boron concentrations. The comparison is made considering that other core conditions are fixed or stable including CEA position. moderator temperature. fuel temperature. fuel depletion. xenon concentration. and samarium concentration. The Surveillance (continued)

PALO VERDE UNITS 1.2.3 B 3.1.3-5 REVISION 0

Reactivity Balance B 3.1.3 BASES SURVEILLANCE SR 3.1.3.1 (continued)

REQUIREMENTS is performed prior to entering MODE 1 as an initial check on core conditions and design calculations at 80C. The SR is modified by three Notes. The first Note indicates that the normalization of predicted core reactivity to the measured value may take place within the first 60 effective full power days (EFPD) after each fuel loading. This allows sufficient time for core conditions to reach steady state.

but prevents operation for a large fraction of the fuel cycle without establishing a benchmark for the design calculations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. A Note.

"only required after 60 EFPD." is added to the Frequency column to allow this.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 26. GDC 28. and GDC 29.

2. UFSAR. Section 15.

PALO VERDE UNITS 1.2.3 B 3.1.3-6 REVISION 56

CEA Alignment B 3.1.5 BASES ACTIONS C.1 If a Required Action or associated Completion Time of Condition A or Condition B is not met. or if one or more regulating or shutdown CEAs are untrippable (immovable as a result of excessive friction or mechanical interference or known to be untrippable). the unit is required to be brought to MODE 3. By being brought to MODE 3. the unit is brought outside its MODE of applicability.

When a Required Action cannot be completed within the required Completion Time. a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

If a full strength CEA is untrippable. it is not available for reactivity insertion during a reactor trip. With an untrippable CEA. meeting the insertion limits of LCO 3.1.6.

"Shutdown Control Element Assembly (CEA) Insertion Limits."

and LCO 3.1.7. "Regulating Control Element Assembly (CEA)

Insertion Limits." does not ensure that adequate SDM exists.

Therefore. the plant must be shut down in order to evaluate the SDM required boron concentration and power level for critical operation. Continued operation is allowed with untrippable part strength CEAs if the alignment and insertion limits are met.

Continued operation is not allowed with one or more full length CEAs untrippable. This is because these cases are indicative of a loss of SDM and power distribution. and a loss of safety function. respectively.

0.1 Continued operation is not allowed in the case of more than one CEA misaligned from any other CEA in its group by

> 9.9 inches. For example. two CEAs in a group misaligned from any other CEA in that group by > 9.9. inches. or more than one CEA group that has a least one CEA misaligned from any other CEA in that group by > 9.9 inches. This is indicative of a loss of power distribution and a loss of safety function. respectively. Multiple CEA misalignments should result in automatic protective action. Therefore.

with two or more CEAs misaligned more than 9.9 inches. this (continued)

PALO VERDE UNITS 1.2.3 B 3.1.5-9 REVISION 52

CEA Ali gnment B 3.1.5 BASES ACTIONS 0.1 (continued) could result in a situation outside the design basis and immediate action would be required to prevent any potential fuel damage. Immediately opening the reactor trip breakers minimizes these effects.

SURVEILLANCE SR 3.1. 5 .1 REQUIREMENTS Verification that individual CEA positions are within 6.6 inches (indicated reed switch positions) of all other CEAs in the group allows the operator to detect a CEA that is beginning to deviate from its expected position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1. 5.2 OPERABILITY of at least two CEA position indicator channels is required to determine CEA positions, and thereby ensure compliance with the CEA alignment and insertion limits. The CEA full in and full out limits provide an additional independent means for determining the CEA positions when the CEAs are at either their fully inserted or fully withdrawn positions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1. 5 .3 Verifying each full strength CEA is trippable would require that each CEA be tripped. In MODES 1 and 2 tripping each full strength CEA would result in radial or axial power tilts, or oscillations. Therefore individual full strength CEAs are exercised to provide increased confidence that all full strength CEAs continue to be trippable, even if they are not regularly tripped. A movement of 5 inches is adequate to demonstrate motion without exceeding the alignment limit when only one full strength CEA is being moved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Between required (continued)

PALO VERDE UNITS 1,2,3 B 3.1.5-10 REVISION 56

CEA Alignment B 3.1.5 BASES SURVEILLANCE SR 3.1.5.3 (continued)

REQUIREMENTS performances of SR 3.1.5.3, if a CEA(s) is discovered to be immovable but remains trippable and aligned, the CEA is considered to be OPERABLE. At anytime, if a CEA(s) is immovable, a determination of the trippability (OPERABILITY) of that CEA(s) must be made, and appropriate action taken.

SR 3.1. 5.4 Performance of a CHANNEL FUNCTIONAL TEST of each reed switch position transmitter channel ensures the channel is OPERABLE and capable of indicating CEA position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1. 5.5 Verification of full strength CEA drop times determines that the maximum CEA drop time permitted is consistent with the assumed drop time used in the safety analysis (Ref. 3).

Measuring drop times prior to reactor criticality, after reactor vessel head removal, ensures the reactor internals and CEOM will not interfere with CEA motion or drop time, and that no degradation in these systems has occurred that would adversely affect CEA motion or drop time. Individual CEAs whose drop times are greater than safety analysis assumptions are not OPERABLE. This SR is performed prior to criticality due to the plant conditions needed to perform the SR and the potential for an unplanned plant transient if the Surveillance were performed with the reactor at power.

The 4 second CEA drop time is the maximum time it takes for a fully withdrawn individual full strength CEA to reach its 90% insertion position when electrical power is interrupted to the CEA dri ve mechani sm wi th RCS Tcold greater than or equal to 550°F and all reactor coolant pumps operating.

The CEA drop time of full strength CEAs shall also be demonstrated through measurement prior to reactor criticality for specifically affected individual CEAs following any maintenance on or modification to the CEA drive system which could affect the drop time of those specifi c CEAs.

(continued)

PALO VERDE UNITS 1,2,3 B 3.1.5-11 REVISION 56

CEA Alignment B 3.1.5 BASES (continued)

REFERENCES 1. 10 CFR 50. Appendix A. GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. UFSAR. Section 15.4.

4. UFSAR. Section 7.7.1.3.2.3.

5. UFSAR. Section 7.5.1.1.4.

PALO VERDE UNITS 1.2.3 B 3.1.5-12 REVISION 56

Shutdown CEA Insertion Limits B 3.1.6 BASES SURVEILLANCE SR 3.1.6.1 (continued)

REQUIREMENTS Shutdown CEAs are considered fully withdrawn when each shutdown CEA is positioned to meet one of the following conditions:

Condition 1:

Pulse Counter ~ 147.75 inches.

and

At least one Reed Switch Position Transmitter (RSPT) ~ 145.25 inches.

OR Condition 2:

Upper Electrical Limit (UEL) position.

Condition 1 necessitates that the Pulse Counter and at least one of the two Reed Switch Position Transmitters (RSPTs) be available to verify the position of each shutdown CEA. The Pulse Counter is a very accurate position indication system but is not as reliable (i .e .. slip rod) as the other position indicating systems. The RSPTs are very reliable but are not as accurate as the Pulse Counter indicating system. Therefore. requiring these two systems together will account for instrument inaccuracies and reliability issues associated with these position indicators (instrument inaccuracies and the acceptability of these indicator limits are detailed in Reference 4).

Additionally. a CEA at its UEL (Upper Electrical Limit) position alone provides an acceptable indication (accounting for inaccuracies) of CEA position to satisfy the condition for a CEA to be considered fully withdrawn. A CEA at its UEL position will be ~ 147.75 inches withdrawn.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)"

PALO VERDE UNITS 1.2.3 B 3.1.6-5 REVISION 56

Shutdown CEA Insertion Limits B 3.1.6 BASES (continued)

REFERENCES 1. 10 CFR 50. Appendix A. GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. UFSAR. Section 15.4.

4. Calculation 13-JC-SF-0202.

PALO VERDE UNITS 1.2.3 B 3.1.6-6 REVISION 46

Regulating CEA Insertion Limits B 3.1.7 BASES ACTIONS B.1 (continued)

Additionally. since the CEAs can be in this condition without misalignment. penalty factors are not inserted in the core protection calculators to compensate for the developing peaking factors.

Experience has shown that rapid power increases in areas of the core. in which the flux has been depressed. can result in fuel damage as the LHR in those areas rapidly increases.

Restricting the rate of THERMAL POWER increases to ~ 5% RTP per hour. following CEA insertion beyond the short term steady state insertion limits. ensures the power transients experienced by the fuel will not result in fuel failure (Ref. 4). The restriction on THERMAL POWER increases shall remain in effect until the Regulating CEA groups are inserted between short term steady state limit and the transient insertion limit for ~ 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months per 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval. The 15 minute Completion Time ensures that prompt action shall be taken to restrict THERMAL POWER increases.

C.1 With the regulating CEAs inserted between the long term steady state insertion limit and the transient insertion limit. and with the core approaching the 5 effective full power days (EFPO) per 30 EFPO. or 14 EFPO per 365 EFPO limits. the core approaches the acceptable limits placed on operation with flux patterns outside those assumed in the long term burn up assumptions. In this case. the CEAs must be returned to within the long term steady state insertion limits. or the core must be placed in a condition in which the abnormal fuel burnup cannot continue. A Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is a reasonable time to return the CEAs to within the long term steady state insertion limits.

The required Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months from initial discovery of a regulating CEA group outside the limits until its restoration to within the long term steady state limits.

shown on the figures in the COLR. allows sufficient time for borated water to enter the Reactor Coolant System from the chemical addition and makeup systems. and to cause the regulating CEAs to withdraw to the acceptable region. It is reasonable to continue operation for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after it is (continued)

PALO VEROE UNITS 1.2.3 B 3.1.7-7 REVISION 0

Regulating CEA Insertion limits B 3.1.7 BASES ACTIONS C.1 (continued) discovered that the 5 day or 14 day EFPD limit has been exceeded. This Completion Time is based on limiting the potential xenon redistribution. the low probability of an accident. and the steps required to complete the action.

0.1 With the POll circuit inoperable. performing SR 3.1.7.1 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months thereafter ensures improper CEA alignments are identified before unacceptable flux distributions occur.

E.1 When a Required Action cannot be completed within the required Completion Time. a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEIllANCE SR 3.1.7.1 REQUIREMENTS With the POll alarm circuit OPERABLE. verification of each regulating CEA group position is sufficient to detect CEA positions that may approach the acceptable limits. and provides the operator with time to undertake the Required Action(s) should the sequence or insertion limits be found to be exceeded. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. POll alarms are received on both the Plant Computer (PC) and the Core Monitoring Computer (CMC)/Core Operating limit Supervisory System (COlSS) after the CMCICOlSS Upgrade.

SR 3.1.7.1 is modified by a Note indicating that entry is allowed into MODE 2 without having performed the SR. This is necessary. since the unit must be in the applicable MODES in order to perform Surveillances that demonstrate the lCO limits are met.

(continued)

PALO VERDE UNITS 1.2.3 B 3.1.7-8 REVISION 56

Regulating CEA Insertion Limits B 3.1.7 BASES SURVEILLANCE SR 3.1. 7.2 REQUIREMENTS (continued) Verification of the accumulated time of CEA group insertion between the long term steady state insertion limits and the transient insertion limits ensures the cumulative time limits are not exceeded. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1. 7.3 Demonstrating the POll alarm circuit OPERABLE verifies that the POll alarm circuit is functional. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. Regulatory Guide 1.77. Rev. O. May 1974.

4. UFSAR. Section 15.4.

PALO VERDE UNITS 1.2.3 B 3.1.7-9 REVISION 56

This page intentionally blank Part Strength CEA Insertion Limits B 3.1.8 BASES (continued)

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS Verification of each part strength CEA group position is sufficient to detect CEA positions that may approach the limits, and provide the operator with time to undertake the Required Action(s), should insertion limits be found to be exceeded. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. Regulatory Guide 1.77, Rev. 0, May 1974.

4. UFSAR, Section 15.4.

PALO VERDE UNITS 1,2,3 B 3.1.8-5 REVISION 56

This page intentionally blank STE-SDM B 3.1.9 BASES (continued)

ACTIONS A.1 With any CEA not fully inserted and less than the minimum required reactivity equivalent available for insertion. or with all CEAs inserted and the reactor subcritical by less than the reactivity equivalent of the highest worth withdrawn CEA. restoration of the minimum shutdown reactivity requirements must be accomplished by increasing the RCS boron concentration. The required Completion Time of 15 minutes for initiating boration allows the operator sufficient time to align the valves and start the boric acid pumps and is consistent with the Completion Time of LCO 3.1.2.

In the determination of the required combination of boration flow rate and boron concentration. there is no unique requirement that must be satisfied. Since it is imperative to raise the boron concentration of the RCS as soon as possible. the boron concentration should be a highly concentrated solution. such as that normally found in the refueling water tank. The operator should borate with the best source available for the plant conditions.

In determining the boration flow rate the time in core life must be considered. For instance. the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle. when boron concentration may approach or exceed 2000 ppm. Assuming that a value of 1%

~k/k must be recovered and a boration flow rate of 26 gpm.

it is possible to increase the boron concentration of the RCS by 100 ppm in less than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months with a 4000 ppm source.

If a boron worth of 10 pcm/ppm is assumed. this combination of parameters will increase the SDM by 1% ~k/k. These boration parameters of 26 gpm and 4000 ppm represent typical values and are provided for the purpose of offering a specific example.

SURVEILLANCE SR 3.1.9.1 REQUIREMENTS Verification of the position of each partially or fully withdrawn full strength. or part strength CEA is necessary to ensure that the minimum negative reactivity requirements for insertion on a trip are preserved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.1.9-5 REVISION 56

STE-SDM B 3.l.9 BASES SURVEILLANCE SR 3.l. 9.2 REQUIREMENTS (continued) Prior demonstration that each CEA to be withdrawn from the core during PHYSICS TESTS is capable of full insertion. when tripped from at least a 50% withdrawn position. ensures that the' CEA wi 11 insert on a tri p si gnal, The 7 day Frequency ensures that the CEAs are OPERABLE prior to reducing SDM requirements to less than the limits of LCO 3.1.2.

SR 3.l. 9.3 During MODE 3. verification that the reactor is subcritical by at least the reactivity equivalent of the highest estimated CEA worth ensures that the minimum negative reactivity requirements are preserved. The negative reactivity requirements are verified by performing a reactivity balance calculation. considering the listed reactivity effects:

a. RCS boron concentrati on;

b. CEA positi ons;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentrati on; and

f. Samarium concentration.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix B. Secti on XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68. Revi sion 2. August 1978.

4. ANSI/ANS-19.6.1-1985. December 13. 1985.

5. UFSAR. Chapter 14.

6. 10 CFR 50.46.

7. UFSAR. Chapter 15.

PALO VERDE UNITS 1.2.3 B 3.1.9-6 REVISION 56

STE-MODES 1 and 2 B 3.1.10 BASES (continued)

ACTIONS A.1 If THERMAL POWER exceeds the test power plateau in MODE 1, THERMAL POWER must be reduced to restore the additional thermal margin provided by the reduction. The 15 minute Completion Time ensures that prompt action shall be taken to reduce THERMAL POWER to within acceptable limits.

B.1 and B.2 If Required Action A.1 cannot be completed within the required Completion Time, PHYSICS TESTS must be suspended within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Allowing 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for suspending PHYSICS TESTS allows the operator sufficient time to change any abnormal CEA configuration back to within the limits of LCO 3.1.5, LCO 3.1.6, and LCO 3.1.7. Suspension of PHYSICS TESTS exceptions requires restoration of each of the applicable LCOs to within specification.

SURVEILLANCE SR 3.1.10.1 REQUIREMENTS Verifying that THERMAL POWER is equal to or less than that allowed by the test power plateau, as specified in the PHYSICS TEST procedure and required by the safety analysis, ensures that adequate LHR and departure from nucleate boiling ratio margins are maintained while LCOs are suspended. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.10.2 Verification of the position of each partially or fully withdrawn full strength or part strength CEA is necessary to ensure that the minimum negative reactivity requirements for insertion on a trip are preserved. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program, (continued)

PALO VERDE UNITS 1,2,3 B 3.1.10-5 REVISION 56

STE-MODES 1 and 2 B3.1.10 BASES (continued)

REFERENCES 1. 10 CFR 50. Appendix B. Secti on XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68. Revision 2. August 1978.

4. ANSI/ANS-19.6.1-1985. December 13. 1985.

5. UFSAR. Chapter 14.

6. UFSAR. Section 15.3.

7. 10 CFR 50.46.

PALO VERDE UNITS 1.2.3 B 3.1.10-6 REVISION 0

LHR B 3.2.1 BASES ACTIONS C.1 (continued)

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. to reach 20% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS With the COLSS out of service. the operator must monitor the LHR with any OPERABLE local power density channel. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that states that the SR is applicable only when the COLSS is out of service.

Continuous monitoring of the LHR is provided by the COLSS.

which calculates core power and core power operating limits based on the LHR and continuously displays these limits to the operator. A COLSS margin alarm is annunciated in the event that the THERMAL POWER exceeds the core power operating limit based on LHR. This SR is also modified by a Note that states that the SR is not required to be performed until 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after MODE 1 with THERMAL POWER> 20% RTP.

During plant startup (increase from 15-18% RTP). the plant dynamics associated with the downcomer to economizer swapover may result in a temporary power increase above 20%

RTP. The 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after reaching 20% RTP is required for plant stabilization.

SR 3.2.1.2 Verification that the COLSS margin alarm actuates at a THERMAL POWER level equal to or less than the core power operating limit based on the LHR in units of kilowatts per foot ensures the operator is alerted when conditions approach the LHR operating limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.1-7 REVISION 56

LHR B 3.2.1 BASES (continued)

REFERENCES 1. UFSAR. Section 15.

2. UFSAR. Section 6.

3. CE-1 Correlation for DNBR.

4. 10 CFR 50. Appendix A. GDC 10.

5. 10 CFR 50.46.

6. Regulatory Guide 1.77. Rev. O. May 1974.

7. 10 CFR 50. Appendix A. GDC 26.

PALO VERDE UNITS 1.2.3 B 3.2.1-8 REVISION 56

F B 3.2.2 BASES (continued)

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS This periodic Surveillance is for determining. using the Incore Detector System. that F~ values are ~ [~ values used in the COLSS and CPCs. It ensures that the Fx values used remain valid throughout the fuel cycle. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. Determining the F~ values after each fuel loading when THERMAL POWER is > 40% RTP. but prior to its exceeding 70% RTP. ensures that the core is properly loaded.

REFERENCES 1. UFSAR. Section 15.

2. UFSAR. Section 6.

3. CE-1 Correlation for DNBR.

4. 10 CFR 50. Appendix A. GDC 10.

5. 10 CFR 50.46.

6. Regulatory Guide 1.77. Rev. O. May 1974.

7. 10 CFR 50. Appendix A. GDC 26.

PALO VERDE UNITS 1.2.3 B 3.2.2-7 REVISION 56

This page intentionally blank T9 B 3.2.3 BASES ACTIONS B.1. B.2. B.3. B.4. and B.5 (continued)

Also in the case of a tilt generated by a CEA misalignment.

the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allows recovery of the CEA misalignment. because a measured Tq not within the limit in the COLR with COLSS in service or > 0.03 with COLSS out of service is not expected.

If it occurs. continued operation of the reactor may be necessary to discover the cause of the tilt. Operation then is restricted to only those conditions required to identify the cause of the tilt. It is necessary to explicitly account for power asymmetries because the radial power peaking factors used in the core power distribution calculation are based on an untilted power distribution.

If the measured Tq is not restored to within its specified limits. the reactor continues to operate with an axial power distribution mismatch. Continued operation in this configuration may induce an axial xenon oscillation. which results in increased LHGRs when the xenon redistributes. If the measured Tq cannot be restored to within its limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . reactor power must be reduced. Reducing THERMAL POWER to < 50% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months provides an acceptable level of protection from increased power peaking due to potential xenon redistribution while maintaining a power level sufficiently high enough to allow the tilt to be analyzed.

The Variable Overpower trip setpoints are reduced to

~ 55% RTP to ensure that the assumptions of the accident analysis regarding power peaking are maintained. After power has been reduced to .~ 50% RTP. the rate and magnitude of changes in the core flux are greatly reduced. Therefore.

16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months is an acceptable time period to allow for reduction of the Variable Overpower trip setpoints. Required Action B.2. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time allowed to reduce the Variable Overpower trip setpoints is required to perform the actions necessary to reset the trip setpoints.

THERMAL POWER is restricted to 50% RTP until the measured Tq is restored to within its specified limit by correcting the out of limit condition. This action prevents the operator from increasing THERMAL POWER above the conservative limit when a significant Tq has existed. but allows the unit to continue operation for diagnostic purposes.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.3-7 REVISION 0

Tg B 3.2.3 BASES ACTIONS B.1. B.2. B.3. B.4. and B.5 (continued)

If Tq is restored prior to identifying and correcting the cause. the plant corrective action program will continue to evaluate the cause of the out of limit condition.

After a THERMAL POWER increase following restoration of Tq.

operation may proceed provided the measured Tq is determined to remain within its specified limit at the increased THERMAL POWER level.

The provision to allow discontinuation of the Surveillance after verifying that Tq is within its specified limit at least once per hour for 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or until T is verified to be within its specified limit at a THERMAL POWER ~ 95% RTP provides an acceptable exit from this action after the measured Tq has been returned to an acceptable value.

C.1 If the measured Tq cannot be restored or determined within its specified limlt. core power must be reduced. Reduction of core power to ~ 20% RTP ensures that the core is operating within its thermal limits and places the core in a conservative condition based on the trip setpoints generated by the CPCs. which assume a minimum core power of 20% RTP.

Six hours is a reasonable time to reach 20% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.3.1 REQUIREMENTS Continuous monitoring of the measured Tg by the incore nuclear detectors is provided by the COLSS. A COLSS alarm is annunciated in the event that the measured Tq exceeds the value used in the CPCs.

With the COLSS out of service. the operator must calculate Tq and verify that it is within its specified limits. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.3-8 REVISION 56

Tg B 3.2.3 BASES SURVEILLANCE SR 3.2.3.1 (continued)

REQUIREMENTS This SR is also modified by a Note that states that the SR is not required to be performed until 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after MODE 1 with THERMAL POWER> 20% RTP. During plant startup (increase from 15-18% RTP). the plant dynamics associated with the downcomer to economizer swapover may result in a temporary power increase above 20% RTP. The 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after reaching 20% RTP is required for plant stabilization.

SR 3.2.3.2 Verification that the COLSS Tg alarm actuates at a value less than the value used in the CPCs ensures that the operator is alerted if Tq approaches its operating limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.2.3.3 Independent confirmation of the validity of the COLSS calculated Tq ensures that the COLSS accurately identifies Tq's. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.3-9 REVISION 56

Tg B 3.2.3 BASES REFERENCES 1. UFSAR. Section 15.

2. UFSAR. Section 6.

3. CE-1 Correlation for DNBR.

4. 10 CFR 50. Appendix A. GDC 10.

5. 10 CFR 50.46.

6. Regulatory Guide 1.77. Rev. D. May 1974.

7. 10 CFR 50. Appendix A. GDC 26.

PALO VERDE UNITS 1.2.3 B 3.2.3-10 REVISION 0

DNBR B 3.2.4 BASES ACTIONS B.1. B.2.1. and B.2.2 (continued)

If the COLSS is not available the OPERABLE DNBR channels are monitored to ensure that the DNBR is not exceeded.

Maintaining the DNBR within this specified range ensures that no postulated accident results in consequences more severe than those described in the UFSAR. Chapter 15. A 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Frequency is allowed to restore the DNBR limit to within the region of acceptable operation. This Frequency is reasonable because the COLSS allows the plant to operate with less DNBR margin (closer to the DNBR limit) than when monitoring with the CPCs.

When operating with the COLSS out of service and DNBR outside the region of acceptable operation. there is a possibility of a slow undetectable transient that degrades the DNBR slowly over the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months period and is then followed by an anticipated operational occurrence or an accident. To remedy this. the CPC calculated values of DNBR are monitored every 15 minutes when the COLSS is out of service and DNBR outside the region of acceptable operation. The 15 minute frequency is adequate to allow the operator to identify an adverse trend in conditions that could result in an approach to the DNBR limit. Also. a maximum allowable change in the CPC calculated DNBR ensures that further degradation requires the operators to take immediate action to restore DNBR to within limits or reduce reactor power to comply with the Technical Specifications (TS). With an adverse trend. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed for restoring DNBR to within limits if the COLSS is not restored to OPERABLE status. Implementation of this requirement ensures that reductions in core thermal margin are quickly detected and. if necessary. results in a decrease in reactor power and subsequent compliance with the existing COLSS out of service TS limits. If DNBR cannot be monitored every 15 minutes. assume that there is an adverse trend.

With no adverse trend. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is allowed for restoring the DNBR to within limits if the COLSS is not restored to OPERABLE status. This duration is reasonable because the Frequency of the CPC determination of DNBR has been increased. and. if operation is maintained steady. the likelihood of exceeding the DNBR limit during this period is not increased. The likelihood of induced reactor transients from an early power reduction is also decreased.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.4-7 REVISION 53

DNBR B 3.2.4 BASES ACTIONS C.1 (continued)

If the DNBR cannot be restored or determined within the allowed times of Conditions A and B. core power must be reduced. Reduction of core power to ~ 20% RTP ensures that the core is operating within its thermal limits and places the core in a conservative condition based on trip setpoints generated by the CPCs. which assume a minimum core power of 20% RTP.

The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. to reach 20% RTP from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.4.1 REQUIREMENTS With the COLSS out of service. the operator must monitor the DNBR as indicated on all of the OPERABLE DNBR channels of the CPCs to verify that the DNBR is within the specified limits shown in the COLR. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that states that the SR is only applicable when the COLSS is out of service.

Continuous monitoring of the DNBR is provided by the COLSS.

which calculates core power and core power operating limits based on the DNBR and continuously displays these limits to the operator. A COLSS margin alarm is annunciated in the event that the THERMAL POWER exceeds the core power operating limit based on the DNBR. This SR is also modified by a Note that states that the SR is not required to be performed until 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after MODE 1 with THERMAL POWER>

20% RTP. During plant startup (increase from 15-18% RTP).

the plant dynamics associated with the downcomer to economizer swapover may result in a temporary power increase above 20% RTP. The 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after reaching 20% RTP is required for plant stabilization.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.4-8 REVISION 56

DNBR B 3.2.4 BASES SURVEILLANCE SR 3.2.4.2 REQUIREMENTS (continued) Verification that the COLSS margin alarm actuates at a power level equal to or less than the core power operating limit, as calculated by the COLSS, based on the DNBR, ensures that the operator is alerted when operating conditions approach the DNBR operating limit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 15.

2. UFSAR, Chapter 6.

3. CE-1 Correlation for DNBR.

4. 10 CFR 50, Appendix A, GDC 10.

5. 10 CFR 50.46.

6. Regulatory Guide 1.77. Rev. O. May 1974.

7. 10 CFR 50, Appendix A, GDC 26.

PALO VERDE UNITS 1,2,3 B 3.2.4-9 REVISION 56

This Page Intentionally Left Blank ASI B 3.2.5 BASES APPLICABLE SAFETY ANALYSES (continued) The ASI satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCO The power distribution LCO limits are based on correlations between power peaking and certain measured variables used as inputs to LHR and DNBR operating limits. The power distribution LCO limits are provided in the COLR. The COLR provides separate limits that are based on different combinations of COLSS and CEACs being in and out of service.

The limitation on ASI ensures that the actual ASI value is maintained within the range of values used in the accident analyses. The ASI limits ensure that with Tq at its maximum upper limit, the DNBR does not drop below the DNBR Safety Limit for AOOs.

APPLICABILITY Power distribution is a concern any time the reactor is critical. The power distribution LCOs, however, are only applicable in MODE 1 above 20% RTP. The reasons these LCOs are not applicable below 20% RTP are:

a. The incore neutron detectors that provide input to the COLSS, which then calculates the operating limits, are inaccurate due to the poor signal to noise ratio that they experience at relatively low core power levels.

b. As a result of this inaccuracy, the CPCs assume a minimum core power of 20% RTP when generating the LPD and DNBR trip signals. When the core power is below this level, the core is operating well below the thermal limits and the resultant CPC calculated LPD and DNBR trips are strongly conservative.

(continued)

PALO VERDE UNITS 1,2,3 B 3.2.5-5 REVISION 0

ASI B 3.2.5 BASES (continued)

ACTIONS A.1 The ASI limits specified in the COLR ensure that the LOCA and loss of flow accident criteria assumed in the accident analyses remain valid. If the ASI exceeds its limit. a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is allowed to restore the ASI to within its specified limit. This duration gives the operator sufficient time to reposition the regulating or part strength CEAs to reduce the axial power imbalance. The magnitude of any potential xenon oscillation is significantly reduced if the condition is not allowed to persist for more than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

B.1 If the ASI is not restored to within its specified limits within the required Completion Time. the reactor continues to operate with an axial power distribution mismatch.

Continued operation in this configuration induces an axial xenon oscillation. and results in increased LHGRs when the xenon redistributes. Reducing thermal power to ~ 20% RTP reduces the maximum LHR to a value that does not exceed the fuel design limits if a design basis event occurs. The allowed Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable. based on operating experience. to reduce power in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.5.1 REQUIREMENTS The ASI can be monitored by both the incore (COLSS) and excore (CPC) neutron detector systems. The COLSS provides the operator with an alarm if an ASI limit is approached.

Verification of the ASI ensures that the operator is aware of changes in the ASI as they develop. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.2.5-6 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS C.1. C.2.1. and C.2.2 (con~inued)

Condition C applies to one automatic bypass removal channel inoperable. If the inoperable operating bypass removal channel for any operating bypass channel cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise. the affected RPS channel must be declared inoperable. as in Condition A. and the affected automatic trip channel placed in maintenance (trip channel) bypass or trip. The operating bypass removal channel and the automatic trip channel must be repaired prior to entering MODE 2 following the next MODE 5 entry. The Bases for the Required Actions and required Completion Times are consistent with Condition A.

0.1 and 0.2 Condition 0 applies to two inoperable automatic operating bypass removal channels. If the operating bypass removal channels for two operating bypasses cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise. the affected RPS channels must be declared inoperable. as in Condition B. and the operating bypass either removed or one automatic trip channel placed in maintenance (trip channel) bypass and the other in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST. or the plant must shut down per LCO 3.0.3 as explained in Condition B.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-39 REVISION 53

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS E.1 (continued)

Condition E is entered when the Required Action and associated Completion Time of Condition A. B. C. or Dare not met.

If the Required Actions associated with these Conditions cannot be completed within the required Completion Time.

the reactor must be brought to a MODE where the Required Actions do not apply. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR REQUIREMENTS column of Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK. CHANNEL FUNCTIONAL TEST.

CHANNEL CALIBRATION. and response time testing.

SR 3.3.1.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-40 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties.

including indication and readability. If a channel is outside the criteria. it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument's behavior.

Where possible. a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

In the case of RPS trips with multiple inputs. such as the DNBR and LPD inputs to the CPCs. a CHANNEL CHECK must be performed on all inputs.

SR 3.3.1.2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 70% RTP is for plant stabilization. data taking.

and flow verification. This check (and if necessary. the adjustment of the CPC addressable constant flow coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications. as determined by the Core Operating Limits Supervisory System (COLSS).

The flow measurement uncertainty may be included in the BERR1 term in the CPC and is equal to or greater than 4%.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-41 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 REQUIREMENTS (continued) The CPC System Event Log is checked to monitor the CPC channel performance. including redundant features not required for the CPC to perform its safety related trip function. The system event log provides a historical record of the last thirty detected CPC channel error conditions. A detected error condition may not render a channel inoperable. unless it is accompanied by a CPC Fail indication.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.4 A daily calibration (heat balance) is performed when THERMAL POWER is ~ 20%. The Linear Power Level signal and the CPC addressable constant multipliers are adjusted to make the CPC dT power and nuclear power calculations agree with the calorimetric calculation if the absolute difference is ~ 2% when THERMAL POWER is ~ 80% RTP. and -

0.5% to 10% when THERMAL POWER is between 20% and 80%. The value of 2% when THERMAL POWER is ~ 80% RTP. and -0.5% to 10% when THERMAL POWER is between 20% and 80% is adequate because this value is assumed in the safety analysis.

These checks (and. if necessary. the adjustment of the Linear Power Level signal and the CPC addressable constant coefficients) are adequate to ensure that the accuracy of these CPC calculations is maintained within the analyzed error margins. The power level must be > 20% RTP to obtain accurate data. At lower power levels. the accuracy of calorimetric data is questionable.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-42 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS The tolerance between 20% and 80% RTP is +10% to reduce the number of adjustments required as the power level increases.

The -0.5% tolerance between 20% and 80% RTP is based on the reduced accuracy of the calorimetric data inputs at low power levels. Performing a calorimetric calibration with a -0.5%

tolerance at low power levels ensures the difference will remain within -2.0% when power is increased above 80% RTP.

If a calorimetric calculation is performed above 80% RTP. it will use accurate inputs to the calorimetric calculation available at higher power levels. When the power level is decreased below 80% RTP an additional performance of the SR to the -0.5% to 10% tolerance is not required if the SR has been performed above 80% RTP. During any power ascension from below 80% to above 80% RTP. the calibration requirements of ITS SR 3.3.1.4 must be met (except during PHYSICS TESTS.

as allowed by the Note in SR 3.3.1.4). This is accomplished by performing SR 3.3.1.4 between 75% and 80% RTP during power ascension with an acceptance criteria of -0.5% to <2% to bound the requirements for both below and above 80% RTP.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Frequency is modified by a Note indicating this Surveillance need only be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP.

The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP is required for plant stabilization. data taking. and flow verification. The secondary calorimetric is inaccurate at lower power levels.

A second Note in the SR indicates the SR may be suspended during PHYSICS TESTS. The conditional suspension of the daily calibrations under strict administrative control is necessary to allow special testing to occur.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-43 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.5 REQUIREMENTS (continued) The RCS flow rate indicated by each CPC is verified to be less than or equal to the RCS total flow rate. The Note indicates the Surveillance is performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is ~ 70% RTP. This check (and. if necessary. the adjustment of the CPC addressable flow constant coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications as determined either using the reactor coolant pump differential pressure instrumentation and the ultrasonic flow meter adjusted pump curves or by a calorimetric calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.6 The three vertically mounted excore nuclear instrumentation detectors in each channel are used to determine APD for use in the DNBR and LPD calculations. Because the detectors are mounted outside the reactor vessel. a portion of the signal from each detector is from core sections not adjacent to the detector. This is termed shape annealing and is compensated for after every refueling by performing SR 3.3.1.11. which adjusts the gains of the three detector amplifiers for shape annealing. SR 3.3.1.6 ensures that the preassigned gains are still proper. When power is < 15% the CPCs do not use the excore generated signals for axial flux shape information. The Note allowing 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 15%

RTP is required for plant stabilization and testing. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on each channel is performed to ensure the entire channel will perform its intended function when needed. The SR is modified by two Notes. Note 1 is a requirement to verify the correct CPC addressable constant values are installed in the CPCs when the CPC CHANNEL FUNCTIONAL TEST is performed. Note 2 allows the CHANNEL FUNCTIONAL TEST for the Logarithmic Power Level - High channels to be performed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after logarithmic power drops below 1E-4% NRTP.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-44 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.7 (continued)

REQUIREMENTS The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 8. These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs. They include:

Bistable Tests A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS channel trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis.

The requirements for this review are outlined in Reference 9.

Matrix Logic Tests Matrix Logic tests are addressed in LCD 3.3.4. This test is performed one matrix at a time. It verifies that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state. This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path Tests Trip path (Initiation Logic) tests are addressed in LCD 3.3.4. These tests are similar to the Matrix Logic tests, except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, thereby opening the affected RTCB. The RTCB must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-45 REVISION 53

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE Trip Path Tests (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CPC and CEAC channels and excore nuclear instrumentation channels are tested separately.

The excore channels use preassigned test signals to verify proper channel alignment. The excore logarithmic channel test signal is inserted into the preamplifier input, so as to test the first active element downstream of the detector.

The power range excore test signal is inserted at the drawer input, since there is no preamplifier.

The quarterly CPC CHANNEL FUNCTIONAL TEST is performed using software. This software includes preassigned addressable constant values that may differ from the current values.

Provisions are made to store the addressable constant values on a computer disk prior to testing and to reload them after testing. A Note is added to the Surveillance Requirements to verify that the CPC CHANNEL FUNCTIONAL TEST includes the correct values of addressable constants.

SR 3.3.1.8 A Note indicates that neutron detectors are excluded from CHANNEL CALIBRATION. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests.

CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

Operating experience has shown this Frequency to be satisfactory. The detectors are excluded from CHANNEL (continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-46 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 (continued)

REQUIREMENTS CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.4) and the linear subchannel gain check (SR 3.3.1.6). In addition. the associated control room indications are monitored by the operators.

SR 3.3.1. 9 SR 3.3.1.9 is the performance of a CHANNEL CALIBRATION.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4) and the monthly linear subchannel gain check (SR 3.3.1.6).

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-47 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.10 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on the CPCs. The CHANNEL FUNCTIONAL TEST shall include the injection of a signal as close to the sensors as practicable to verify OPERABILITY including alarm and trip Functions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.11 The three excore detectors used by each CPC channel for axial flux distribution information are far enough from the core to be exposed to flux from all heights in the core.

although it is desired that they only read their particular level. The CPCs adjust for this flux overlap by using the predetermined shape annealing matrix elements in the CPC software.

After refueling. it is necessary to re-establish or verify the shape annealing matrix elements for the excore detectors based on more accurate incore detector readings.

This is necessary because refueling could possibly produce a significant change in the shape annealing matrix coefficients.

Incore detectors are inaccurate at low power levels.

THERMAL POWER should be significant but < 70% to perform an accurate axial shape calculation used to derive the shape annealing matrix elements.

By restricting power to ~ 70% until shape annealing matrix elements are verified. excessive local power peaks within the fuel are avoided. Operating experience has shown this Frequency to be acceptable.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-48 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.12 REQUIREMENTS (continued) SR 3.3.1.12 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.1.7. except SR 3.3.1.12 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate pOints during power ascent to enable certain reactor trips. Consequently. the appropriate time to verify operating bypass removal function OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327.

"RPS/ESFAS Extended Test Interval Evaluation° (Ref. 9).

Once the operating bypasses are removed. the bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST. SR 3.3.1.7.

Therefore. further testing of the operating bypass function after startup is unnecessary.

SR 3.3.1.13 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time. from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-49 REVISION 56

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.13 (continued)

REQUIREMENTS Response time may be verified by any series of sequential.

overlapping or total channel measurements. including allocated sensor response time. such that the response time is verified. Allocations for sensor response times may be obtained from the records of test results. vendor test data. or vendor engineering specifications. Topical Report CE NPSD-1l67-A. "Elimination of Pressure Sensor Response Time Testing Requirements." (Ref. 12) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4)

REFERENCES 1. 10 CFR 50. Appendix A. GDC 21

2. 10 CFR 100.

3. NRC Safety Evaluation Report. July 15. 1994.

4. UFSAR. Chapter 7

5. UFSAR. Chapters 6 and 15.

6. 10 CFR 50.49.

7. "Calculation of Trip Setpoint Values. Plant Protection System". CEN-2S6(v). or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip function.

S. UFSAR. Section 7.2. Tables 7.2-1 and 7.3-11A.

PALO VERDE UNITS 1.2.3 B 3.3.1-50 REVISION 53

RPS Instrumentation - Shutdown B 3.3.2 BASES ACTIONS E.1 (continued)

If Required Actions associated with these Conditions cannot be completed within the required Completion Time. all RTCBs must be opened. placing the plant in a condition where the RPS trip channels are not required to be OPERABLE. A Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is a reasonable time to perform the Required Action. which maintains the risk at an acceptable level while having one or two channels inoperable.

SURVEILLANCE The SR's for any particular RPS function are found in the SR REQUIREMENTS column of Table 3.3.2-1 for that function. The SRs are an extension of those listed in LCO 3.3.1. listed here because of their Applicability in these MODES.

SR 3.3.2.1 SR 3.3.2.1 is the performance of a CHANNEL CHECK of each RPS channel. This SR is identical to SR 3.3.1.1. Only the Applicability differs.

Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is

,based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties.

including indication and readability. If a channel is outside the criteria. it may be an indication that the sensor or the signal processing equipment has drifted outside its limits. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible. a numerical comparison between like instrument channels should (continued)

PALO VERDE UNITS 1.2.3 B 3.3.2-13 REVISION 56

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.1 (continued)

REQUIREMENTS be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.2 A CHANNEL FUNCTIONAL TEST on each channel. except power range neutron flux. is performed to ensure the entire channel will perform its intended function when needed. This SR is identical to SR 3.3.1.7. Only the Applicability differs.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in the UFSAR. Section 7.2 (Ref. 3). These tests verify that the RPS is capable of performing its intended function. from bistable input through the RTCBs.

They include:

Bistable Tests A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS channel trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 6.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.2-14 REVISION 56

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE Matrix Logic Tests REQUIREMENTS (continued) Matrix Logic Tests are addressed in LCO 3.3.4. This test is performed one matrix at a time. It verifies that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state.

This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path Test Trip path (Initiation Logic) tests are addressed in LCO 3.3.4. These tests are similar to the Matrix Logic tests except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, opening the affected set of RTCBs. The RTCBs must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.3 SR 3.3.2.3 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.2.2, except SR 3.3.2.3 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. This SR is identical to SR 3.3.1.12. Only the Applicability differs.

Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate pOints during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify operating bypass removal function (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-15 REVISION 56

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.3 (continued)

REQUIREMENTS OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327. "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 6). Once the operating bypasses are removed. the operating bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST. SR 3.3.2.2. Therefore. further testing of the operating bypass function after startup is unnecessary.

SR 3.3.2.4 This SR is identical to SR 3.3.1.9. Only the Applicability differs.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (the sensor is excluded for the Logarithmic Power Level Function). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 6.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and (continued)

PALO VERDE UNITS 1.2.3 B 3.3.2-16 REVISION 56

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.4 (continued)

REQUIREMENTS because of the difficulty of simulating a meaningful signal.

Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

SR 3.3.2.5 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the pOint at which the parameter exceeds the trip setpoint value at the sensor to the pOint at which the RTCBs open. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements," (Ref. 7) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-17 REVISION 56

RPS Instrumentation - Shutdown B 3.3.2 BASES A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

REFERENCES 1. 10 CFR 50.

2. 10 CFR 100.

3. UFSAR. Section 7.2 Tables 7.2-1 and 7.3-11A.

4. "Calculation of Trip Setpoint Values Plant Protection System. CEN-286(v)". or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

5. NRC Safety Evaluation Report. July 15. 1994.

6. CEN-327. June 2.1986. including Supplement 1.

March 3. 1989. and Calculation 13-JC-SB-200.

7. CEOG Topical Report CE NPSD-1167-A. "Elimination of Pressure Sensor Response Time Testing Requirements."

PALO VERDE UNITS 1.2.3 B 3.3.2-18 REVISION 35

CEACs B 3.3.3 BASES ACTIONS B.2.2 (continued)

This Action requires that the CEAs are maintained fully withdrawn (all CEAs meet the requirements of LCO 3.1.6 and 3.1.7). except as required for specified testing or flux control via group #5. This verification ensures that undesired perturbations in local fuel burnup are prevented.

The Upper Electrical Limit (UEL) CEA reed switches provide an acceptable indication of CEA position.

B.2.3 The "RSPT/CEAC Inoperable" addressable constant in each of the OPERABLE CPCs is set to indicate that both CEACs are inoperable. This provides a conservative penalty factor to ensure that a conservative effective margin is maintained by the CPCs in the computation of DNBR and LPD trips.

B.2.4 The CEDMCS is placed and maintained in "STANDBY MODE." except during CEA motion permitted by Required Action B.2. to prevent inadvertent motion and possible misalignment of the CEAs.

B.2.5 A comprehensive set of comparison checks on individual CEAs within groups must be made within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Verification that each CEA is within 6.6 inches of other CEAs in its group provides a check that no CEA has deviated from its proper position within the group.

B.2.6 The Reactor Power Cutback (RPCB) System must be disabled.

This ensures that CEA position will not be affected by RPCB operation.

C.1 Condition C is entered when the Required Action and associated Completion Time of Condition B is not met.

If the Required Actions associated with this Condition cannot be completed within the required Completion Time. the reactor must be brought to a MODE where the Required Actions do not apply. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. for reaching the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.3-9 REVISION 53

CEACs B 3.3.3 BASES (continued)

SURVEILLANCE SR 3.3.3.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff. based on a combination of the channel instrument uncertainties.

including indication and readability. If a channel is outside the criteria. it may be an indication that the sensor or the signal processing equipment has drifted outside its limits. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible. a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2 Deleted (continued)

PALO VERDE UNITS 1.2.3 B 3.3.3-10 REVISION 56

CEACs B 3.3.3 BASES SURVEILLANCE SR 3.3.3.3 REQUIREMENTS (continued) CHANNEL FUNCTIONAL TEST on each CEAC channel is performed to ensure the entire channel will perform its intended function when needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.4 SR 3.3.3.4 is the performance of a CHANNEL CALIBRATION.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillance. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 5.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.5 A CHANNEL FUNCTIONAL TEST is performed on the CEACs. The CHANNEL FUNCTIONAL TEST shall include the injection of a signal as close to the sensors as practicable to verify OPERABILITY. including alarm and trip Functions.

continued)

PALO VERDE UNITS 1.2.3 B 3.3.3-11 REVISION 56

CEACs B 3.3.3 BASES SURVEILLANCE SR 3.3.3.5 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50.

2. 10 CFR 100.

3. UFSAR. Section 7.2.

4. NRC Safety Evaluation Report. July 15. 1994

5. CEN-327. June 2. 1986. including Supplement 1.

March 3. 1989. and Calculation 13-JC-SB-200.

PALO VERDE UNITS 1.2.3 B 3.3.3-12 REVISION 56

RPS Logic and Trip Initiation B 3.3.4 BASES ACTIONS E.1 and E.2 (continued)

If the RTCB associated with the inoperable channel. or the redundant RTCB in the affected Trip Leg cannot be opened.

the reactor must be shut down within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and all the RTCBs opened. A Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable.

based on operating experience. for reaching the required plant conditions from full power conditions in an orderly manner and without challenging plant systems and for opening RTCBs. All RTCBs should then be opened. placing the plant in a MODE where the LCO does not apply and ensuring no CEA withdrawal occurs.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST on each RPS Logic channel and Manual Trip channel is performed to ensure the entire channel will perform its intended function when needed.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 3. These tests verify that the RPS is capable of performing its intended function. from bistable input through the RTCBs. The first test. the bistable test. is addressed by SR 3.3.1.7 in LCO 3.3.1.

This SR addresses the two tests associated with the RPS Logic: Matrix Logic and Trip Path.

Matrix Logic Tests These tests are performed one matrix at a time. They verify that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing. power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state. The Matrix Logic tests will detect any short circuits around the bistable contacts in the coincidence logic such as may be caused by faulty bistable relay or trip channel bypass contacts.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.4-13 REVISION 56

RPS Logic and Trip Initiation B 3.3.4 BASES SURVEILLANCE Trip Path Tests REQUIREMENTS (continued) These tests are similar to the Matrix Logic tests, except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, opening the affected RTCB. The RTCB must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

During the Matrix Logic and Initiation Logic tests, power is applied to the Matrix relay tests coils. The test coils prevent an actuation during testing by preventing the Matrix relay contacts in the Initiation Logic from changing state during the test. This does not affect the Operability of the Initiation Logic since only one of the six logic combinations that are available to trip the Initiation Logic are affected during the test because only one Matrix Logic combination can be tested at any time. The remaining five matrix combinations available ensure that a trip in any three channels will de-energize all four Initiation paths.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2 Each RTCB is actuated by an undervoltage coil and a shunt trip coil. The system is designed so that either de-energizing the undervoltage coil or energizing the shunt trip coil will cause the circuit breaker to open. When an RTCB is opened, either during an automatic reactor trip or by using the manual push buttons in the control room, the undervoltage coil is de-energized and the shunt trip coil is energized. This makes it impossible to determine if one of the coils or associated circuitry is defective.

Therefore, following maintenance or adjustment of the reactor trip breakers, a CHANNEL FUNCTIONAL TEST is performed that individually tests all four undervoltage coils and all four shunt trip coils. During undervoltage coil testing, the shunt trip coils must remain de-energized, preventing their operation. Conversely, during shunt trip coil testing, the undervoltage coils must remain energized, preventing their operation.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.4-14 REVISION 56

RPS Logic and Trip Initiation B 3.3.4 BASES SURVEILLANCE SR 3.3.4.2 (continued)

REQUIREMENTS This Surveillance ensures that every undervoltage coil and every shunt trip coil is capable of performing its intended function and that no single active failure of any RTCB component will prevent a reactor trip. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.3 A CHANNEL FUNCTIONAL TEST on each RTCB is performed to verify proper operation of each RTCB. The RTCB must then be closed prior to testing the other three initiation circuits.

or a Reactor Trip may result. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendi x A.

2. 10 CFR 100.

3. UFSAR. Section 7.2.

4. NRC Safety Evaluation Report. July 15. 1994.

5. CEN-327. June 2. 1986. including Supplement 1.

March 3. 1989. and Calculation 13-JC-SB-200.

PALO VERDE UNITS 1.2.3 B 3.3.4-15 REVISION 56

This page intentionally blank ESFAS Instrumentation B 3.3.5 BASES ACTIONS C.1. C.2.1. and C.2.2 (continued)

Condition C applies to one automatic operating bypass removal channel inoperable. The only automatic operating bypass removal on an ESFAS is on the Pressurizer Pressure - Low signal. This operating bypass removal is shared with the RPS Pressurizer Pressure - Low bypass removal.

If the bypass removal channel for any operating bypass cannot be restored to OPERABLE status. the associated ESFAS channel may be considered OPERABLE only if the bypass is not in effect. Otherwise. the affected ESFAS channel must be declared inoperable. as in Condition A. and the operating bypass either removed or the bypass removal channel repaired. The Bases for the Required Actions and required Completion Times are consistent with Condition A.

0.1 and 0.2 Condition 0 applies to two inoperable automatic operating bypass removal channels. If the operating bypass removal channels for two operating bypasses cannot be restored to OPERABLE status. the associated ESFAS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise. the affected ESFAS channels must be declared inoperable. as in Condition B. and either the operating bypass removed or the bypass removal channel repaired. The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST or the plant must shut down per LCO 3.0.3. as explained in Condition B. Completion Times are consistent with Condition B.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.5-25 REVISION 42

ESFAS Instrumentation B 3.3.5 BASES ACTIONS (continued) E.1 and E.2 If the Required Actions and associated Completion Times of Condition A, B, C, or D cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.5.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. For clarification, a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible, a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.5-26 REVISION 56

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2 A CHANNEL FUNCTIONAL TEST is performed to ensure the entire channel will perform its intended function when needed.

The CHANNEL FUNCTIONAL TEST is part of an overlapping test sequence s i mil ar to that employed in the RPS. Thi s sequence. consisting of SR 3.3.5.2. SR 3.3.6.1. and SR 3.3.6.2. tests the entire ESFAS from the bistable input through the actuation of the individual subgroup relays.

These overlapping tests are described in Reference 1. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.3.6.2 verifies that the subgroup relays are capable of actuating their respective ESF components when de-energized.

These tests verify that the ESFAS is capable of performing its intended function. from bistable input through the actuated components. SRs 3.3.6.1 and 3.3.6.2 are addressed in LCD 3.3.6. SR 3.3.5.2 includes bistable tests.

A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.5-27 REVISION 56

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.3 REQUIREMENTS (continued) CHANNEL CALIBRATION is a complete check of the instrument channel including the detector and the bypass removal functions. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.4 This Surveillance ensures that the train actuation response times are within the maximum values assumed in the safety analyses.

Response time testing acceptance criteria are included in Reference 1.

Response time may be verified by any series of sequential.

overlapping or total channel measurements. including allocated sensor response time. such that the response time is verified. Allocations for sensor response times may be obtained from records of test results. vendor test data. or vendor engineering specifications. Topical Report CE NPSD-1167-A. "Elimination of Pressure Sensor Response Time (continued)

PALO VERDE UNITS 1.2.3 B 3.3.5-28 REVISION 56

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.4 (continued)

REQUIREMENTS Testing Requirements." (Ref. 10) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and re-verified after maintenance that may adversely affect the sensor response time.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.5 SR 3.3.5.5 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.5.2. except SR 3.3.5.5 is performed within 92 days prior to startup and is only applicable to operating bypass functions. Since the Pressurizer Pressure - Low operating bypass is identical for both the RPS and ESFAS. this is the same Surveillance performed for the RPS in SR 3.3.1.13.

The CHANNEL FUNCTIONAL TEST for proper operation of the operating bypass permissives is critical during plant heatups because the bypasses may be in place prior to entering MODE 3 but must be removed at the appropriate points during plant startup to enable the ESFAS Function.

Consequently. just prior to startup is the appropriate time to verify operating bypass function OPERABILITY. Once the operating bypasses are removed. the bypasses must not fail in such a way that the associated ESFAS Function is inappropriately bypassed. This feature is verified by SR 3.3.5.2.

The allowance to conduct this test with 92 days of startup is based on the reliability analysis presented in topical report CEN-327. "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.5-29 REVISION 56

ESFAS Instrumentation B 3.3.5 BASES REFERENCES 1. UFSAR, Section 7.3.

2. 10 CFR 50, Appendix A.

3. NRC Safety Evaluation Report, July 15, 1994

4. IEEE Standard 279-1971.

5. UFSAR, Chapter 15.

6. 10 CFR 50.49.

7. "Calculation of Trip Setpoint Valves Plant Protection System", CEN-286(v), or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

8. UFSAR, Section 7.2, Tables 7.2-1 and 7.3-11A

9. CEN-327, May 1986, including Supplement 1, March 1989, and Calculation 13-JC-SB-200.

10. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

11. UFSAR Section 1.8, "Regulatory Guide 1.105: Instrument Setpoints (Revision 1, November 1976)U PALO VERDE UNITS 1,2,3 B 3.3.5-30 REVISION 35

ESFAS Logic and Manual Trip B 3.3.6 BASES ACTIONS F.1 and F.2 (continued)

If the Required Actions and associated Completion Times for SIAS. CIAS. or RAS are not met. the plant must be brought to a MODE in which the LCD does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . If the Required Actions and associated Completion Times for SIAS. CIAS. or RAS Matrix Logic are not met this Action may be exited when the plant is brought to MODE 4 since the LCD does not apply in MODE 4. The allowed Completion Times are reasonable.

based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.6.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed to ensure the entire channel will perform its intended function when needed.

The CHANNEL FUNCTIONAL TEST is part of an overlapping test sequence similar to that employed in the RPS. This sequence. consisting of SR 3.3.5.2. SR 3.3.6.1. and SR 3.3.6.2. tests the entire ESFAS from the bistable input through the actuation of the individual subgroup relays.

These overlapping tests are described in Reference 1.

SR 3.3.5.2 and SR 3.3.6.1 are normally performed together and in conjunction with ESFAS testing. SR 3.3.6.2 verifies that the subgroup relays are capable of actuating their respective ESF components when de-energized.

These tests verify that the ESFAS is capable of performing its intended function. from bistable input through the actuated components. SR 3.3.5.2 is addressed in LCD 3.3.5.

SR 3.3.6.1 includes Matrix Logic tests and trip path (Initiation Logic) tests. and Manual Actuation Tests.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.6-19 REVISION 56

ESFAS Logic and Manual Trip B 3.3.6 BASES SURVEILLANCE Matrix Logic Tests REQUIREMENTS (continued) These tests are performed one matrix at a time. They verify that a coincidence in the two input channels for each function removes power to the matrix relays. During testing. power is applied to the matrix relay test coils.

preventing the matrix relay contacts from assuming their de-energized state. The Matrix Logic tests will detect any short circuits around the bistable contacts in the coincidence logic. such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path (Initiation Logic) Tests These tests are similar to the Matrix Logic tests. except that test power is withheld from one matrix relay at a time. allowing the initiation circuit to de-energize.

opening one contact in each Actuation Logic channel.

The initiation circuit lockout relay must be reset (except for AFAS. which lacks initiation circuit lockout relays) prior to testing the other three initiatiDn circuits. or an ESFAS actuation may result.

Automatic Actuation Logic operation is verified during Initiation Logic testing by verifying that current is interrupted in each trip leg in the selective two-out-of-four actuation circuit logic whenever the initiation relay is de-energized. A Note is added to indicate that testing of Actuation Logic shall include verification of the proper operation of each initiation relay.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.6-20 REVISION 0

ESFAS Logic and Manual Trip B 3.3.6 BASES SURVEILLANCE Trip Path (Initiation Logic) Tests (continued)

During the Matrix Logic and Initiation Logic test. power is applied to the Matrix relay test coils. The test coils prevent an actuation during testing by preventing the Matrix relay contacts in the Initiation Logic from changing state during the test. This does not affect the Operability of the Initiation Logic since only one of the six logic combinations that are available to trip the Initiation Logic are affected during the test because only one Matrix Logic combination can be tested at any time.

The remaining five matrix combinations available ensure that a trip in any three channels will de-energize all four Initiation paths.

Manual Trip Tests This test verifies that the manual trip handswitches are capable of opening contacts in the Actuation Logic as designed.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2 Individual ESFAS subgroup relays must also be tested. one at a time. to verify the individual ESFAS components will actuate when required. Proper operation of the individual subgroup relays is verified by de-energizing these relays one at a time using an ARC mounted test circuit. Proper operation of each component actuated by the individual relays is thus verified without the need to actuate the entire ESFAS function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

If two or more ESFAS subgroup relays fail per Unit in a 12-month period. an evaluation should be performed to determine the adequacy of the surveillance interval. The evaluation should consider the design. maintenance. and (continued)

PALO VERDE UNITS 1.2.3 B 3.3.6-21 REVISION 56

ESFAS Logic and Manual Trip B 3.3.6 BASES SURVEILLANCE SR 3.3.6.2 (continued)

REQUIREMENTS testing of all ESFAS subgroup relays. If it is determined that the surveillance interval is inadequate for detecting a single relay failure. the surveillance interval should be decreased. The revised surveillance interval should be such that an ESFAS subgroup relay failure can be detected prior to the occurrence of a second failure.

Some components cannot be tested at power since their actuation might lead to a plant transient. equipment damage.

unjustifiable exposure or an unnecessary burden on plant personnel relative to the safety significance of the surveillance. Reference 1 lists similar criteria. from reference 4. for those relays and actuated equipment exempted from testing at power. Relays not tested at power must be tested in accordance with the Note to this SR.

The above guidance for reevaluating ESFAS subgroup relay surveillance test intervals is based on the Safety Evaluation by the Office of Nuclear Reactor Regulation.

"Review of CE Owners Group Topical Report CEN-403. Rev. 1.

'ESFAS Subgroup Relay Test Interval Extension'" (Ref. 4).

CEN-403. Rev. 1 was later replaced with Rev. I-A which contains the NRC safety evaluation. It should be noted that this report (CEN-403) identifies that Palo Verde Units 1. 2.

and 3 replaced the pre-1990 ESFAS subgroup relays with a newer prototype model. CEN-403 states that the failure rates for the new model relays will be comparable to the rates for the new style relays pioneered and installed at Palo Verde in late 1989 to resolve the failure mode of the older style relays. Therefore. the ESFAS subgroup relays identified as being replaced at the end of 1989 are acceptable.

REFERENCES 1. UFSAR. Section 7.3.

2. CEN-327. May 1986. including Supplement 1. March 1989.

and Calculation 13-JC-SB-200.

3. CEN-403. "ESFAS Subgroup Relay Test Interval Extension. Revision 1".

4. Safety Evaluation by the Office of Nuclear Reactor Regulation. Review of CE Owners Group Topical Report CEN-403. Rev. 1, "ESFAS Subgroup Relay Test Interval Extension". February 27. 1996.

PALO VERDE UNITS 1.2.3 B 3.3.6-22 REVISION 46

DG - LOVS B 3.3.7 BASES ACTIONS B.1 and B.2 (continued)

One of the two inoperable channels will need to be restored to OPERABLE status prior to the next required CHANNEL FUNCTIONAL TEST because channel surveillance testing on an OPERABLE channel requires that the OPERABLE channel be placed in bypass. However. it is not permitted to bypass more than one DG-LOVS channel. and placing a second channel in trip will result in a loss of voltage diesel start signal.

After one channel is restored to OPERABLE status. the provisions of Condition A still apply to the remaining inoperable channel.

C.1 Condition C.1 applies when more than two channels on a single bus are inoperable.

Required Action C.1 requires all but two channels to be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With more than two channels inoperable. the logic is not capable of providing the DG - LOVS signal for valid Loss of Voltage or degraded voltage condition. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is reasonable to evaluate and take action to correct the degraded condition in an orderly manner and takes into account the low probability of an event requiring LOVS occurring during this interval.

D.1 Condition D.1 applies if the Required Actions and associated Completion Times are not met.

Required Action D.1 ensures that Required Actions for the affected DG inoperabilities are initiated. Depending upon plant MODE. the ACTIONS specified in LCO 3.8.1. "AC Sources - Operating." or LCO 3.8.2 are required immediately.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.7-7 REVISION 0

DG - LOVS B 3.3.7 BASES (continued)

SURVEILLANCE The following SRs apply to each DG - LOVS Function.

REQUIREMENTS SR 3.3.7.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a qualitative assessment. by observation.

of channel behavior during operation. This determination shall include. where possible. comparison of the channel indication and status to other indications or status derived from independent instrument channels measuring the same parameter. A CHANNEL CHECK consists of verifying all relay status lights on the control board are lit. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continu~s to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff. If the channels are within the criteria. it is an indication that the channels are OPERABLE. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument*s behavior. Where possible. a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.7.2 A CHANNEL FUNCTIONAL TEST is performed to ensure that the entire channel will perform its intended function when needed.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The as found and as left values must also be recorded and reviewed for consistency.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.7-8 REVISION 56

DG - LOVS B 3.3.7 BASES SURVEILLANCE SR 3.3.7.3 REQUIREMENTS (continued) SR 3.3.7.3 is the performance of a CHANNEL CALIBRATION. The CHANNEL CALIBRATION verifies the accuracy of each component within the instrument channel. This includes calibration of the Loss of Voltage and Degraded Voltage relays and demonstrates that the equipment falls within the specified operating characteristics defined by the manufacturer. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive surveillances to ensure the instrument channel remains operational. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency.

The setpoints. as well as the response to a Loss of Voltage and Degraded Voltage test. shall include a single point verification that the trip occurs within the required delay time. as shown in Reference 1. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 8.3

2. UFSAR. Chapter 15.

3. Controlled Dwg. Relay Setpoint Sheets.

4. 10 CFR 50. Appendix A. GDC 21.

5. Calculation 13-EC-PB-202

6. Calculations 01. 02. 03-EC-MA-221 PALO VERDE UNITS 1.2.3 B 3.3.7-9 REVISION 56

This page intentionally blank CPIAS B 3.3.8 BASES ACTIONS B.1 (continued)

Condition B applies when the Required Action and associated Completion Time of Condition A are not met in MODES 1. 2. 3.

or 4. If Required Action A cannot be met within the required Completion Time. entry into LCO 3.6.3 "Containment Isolation Valves" is required. The Completion Time accounts for the fact that the inability to close and maintain the purge and exhaust valves closed may affect the ability of the valves to automatically close on a Containment Isolation Actuation Signal (CIAS)

C.1. C.2.1. and C.2.2.

Condition C applies to two channels of radiation monitor.

Manual Trip. or Actuation Logic inoperable. the applicability is during CORE ALTERATIONS or during the movement of irradiated fuel assemblies within containment.

Required Action C.1 is to place the containment purge and exhaust isolation valves in the closed position. The Required Action immediately performs the isolation function of the CPIAS. Required Actions C.2.1 and C.2.2 may be performed in lieu of Required Action C.1. Required Action C.2.1 requires the suspension of CORE ALTERATIONS and Required Action C.2.2 requires suspension of movement of irradiated fuel in containment immediately. The Completion Time accounts for the fact that the automatic capability to isolate containment on valid power access and refueling purge exhaust duct high radiation signals is degraded during conditions in which a fuel handling accident is possible and CPIAS provides the only automatic mitigation of radiation release.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.8-5 REVISION 0

CPIAS B 3.3.8 BASES (continued)

SURVEILLANCE SR 3.3.8.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred on the required radiation monitor channels used in the CPIAS. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure: thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. For clarification, a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible, a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.2 A CHANNEL FUNCTIONAL TEST is performed on each required containment radiation monitoring channel (RU-37 and RU-38) to ensure the entire channel will perform its intended function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.8-6 REVISION 56

CPIAS B 3.3.8 BASES SURVEILLANCE SR 3.3.8.3 REQUIREMENTS (continued) Proper operation of the individual actuation relays is verified by actuating these relays during the CHANNEL FUNCTIONAL TEST of the Actuation Logic. This will actuate the Function. operating all associated equipment. Proper operation of the equipment actuated by each train is thus verified. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. A Note to the SR indicates that this surveillance includes verification of operation for each actuation relay.

SR 3.3.8.4 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.8-7 REVISION 56

CPIAS B 3.3.8 BASES SURVEILLANCE SR 3.3.8.5 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on the CPIAS Manual Trip channel.

This test verifies that the trip handswitches are capable of opening contacts in the Actuation Logic as designed.

de-energizing the initiation relays and providing manual actuation of the Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 15.

2. 10 CFR 100.

3. "Standard Revi ew Pl an for the Revi ew of Safety Ana lys is Reports for Nuclear Power Plants." NUREG-75/087.

Revision 1. 1978. Section 6.2.4. Branch Technical Position CSB 6-4. "Containment Purging During Normal Plant Operation."

PALO VERDE UNITS 1.2.3 B 3.3.8-8 REVISION 56

CREFAS B 3.3.9 BASES (continued)

SURVEILLANCE SR 3.3.9.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure: thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit. For clarification, a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible, a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.9.2 A CHANNEL FUNCTIONAL TEST is performed on each required control room radiation monitoring channel (RU-29 and RU-30) to ensure the entire channel will perform its intended function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.9-5 REVISION 56

CREFAS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.3 REQUIREMENTS (continued) Proper operation of the individual actuation relays is verified by de-energizing these relays during the CHANNEL FUNCTIONAL TEST of the Actuation Logic. This will actuate the Function. operating all associated equipment. Proper operation of the equipment actuated by each train is thus verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Note 1 indicates this Surveillance includes verification of operation for each actuation relay.

Note 2 indicates that relays that cannot be tested at power are excepted from the Surveillance Requirement while at power. These relays must. however. be tested during each entry into MODE 5 exceeding 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months unless they have been tested within the previous 6 months. At PVNGS all of the actuation relays can be tested at power.

SR 3.3.9.4 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.9-6 REVISION 56

CREFAS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.5 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on the manual CREFAS actuation circuitry. This test verifies that the trip handswitches are capable of opening contacts in the Actuation Logic as designed. de-energizing the actuation relays and providing Manual Trip of the function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.9.6 This Surveillance ensures that the train actuation response times are less than the maximum times assumed in the analyses. Response time testing criteria are included in Reference 3. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 15.

2. 10 CFR 50. Appendix A. GDC 19.

3. UFSAR. Chapter 7.

PALO VERDE UNITS 1.2.3 B 3.3.9-7 REVISION 56

This page intentionally blank PAM Instrumentation B 3.3.10 BASES ACTIONS F.l (continued)

Alternate means of monitoring Reactor Vessel Water Level, RCS Activity, and Containment Area Radiation have been developed and tested. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. If these alternate means are used, the Required Action is not to shut down the plant, but rather to follow the directions of Specification 5.6.6. The report provided to the NRC should discuss whether the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels.

SURVEILLANCE A Note at the beginning of the SR table specifies that REQUIREMENTS the following SRs apply to each PAM instrumentation Function found in Table 3.3.10-1.

SR 3.3.10.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. For clarification, a CHANNEL CHECK is a qualitative assessment of an instrument's behavior.

Where possible, a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.10-19 REVISION 56

PAM Instrumentation B 3.3.10 BASES SURVEILLANCE SR 3.3.10.1 (continued)

REQUIREMENTS If the channels are normally off scale during times when surveillance is required. the CHANNEL CHECK will only verify that they are off scale in the same direction.

Current loop channels are verified to be reading at the bottom of the range and not failed downscale.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.10.2 A CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies the channel responds to the measured parameter within the necessary range and accuracy. A Note excludes the neutron detectors from the CHANNEL CALIBRATION.

For the Containment Area Radiation instrumentation. a CHANNEL CALIBRATION as described in UFSAR Sections 18.II.F.1.3 and 11.5.2.1.6.2 will be performed.

The calibration of the Containment Isolation Valve (CIV) position indication channels will consist of verification that the position indication changes from not-closed to closed when the valve is actuated to its isolation position by SR 3.6.3.7. The position switch is the sensor for the CIV position indication channels.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.10-20 REVISION 56

Remote Shutdown System B 3.3.11 BASES ACTIONS A Note has been added in the ACTIONS to clarify the (continued) application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in Table 3.3.11-1. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A addresses the situation where one or more instrumentation channels of the Remote Shutdown System are inoperable. This includes any Function listed in Table 3.3.11-1.

The Required Action is to restore the channels to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

B.1 and B.2 Condition Baddresses the situation where one or more disconnect or control circuits of the Remote Shutdown System are inoperable. The required disconnect and control circuits are listed in PVNGS controlled documents.

The required Action is to restore the required switch(s)/circuit(s) to OPERABLE status or issue procedure changes that identify alternate disconnect methods or control circuits. The Completion Time for either of the two Actions is 30 days.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.11-5 REVISION 42

Remote Shutdown System B3.3.11 BASES ACTIONS C.1 and C.2 (continued)

If the Required Action and associated Completion Time of Condition A are not met. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.11.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION. Agreement criteria are determined by the plant staff. based on a combination of the channel instrument uncertainties. including indication and readability. If a channel is outside the criteria. it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance. a CHANNEL CHECK is only required for those channels that are normally energized. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible. a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

If the channels are normally off scale during times when surveillance is required. the CHANNEL CHECK will only verify that they are offscale in the same direction. Current loop channels are verified to be reading at the bottom of the range and not failed downscale.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.11-6 REVISION 56

Remote Shutdown System B 3.3.11 BASES SURVEILLANCE SR 3.3.11.2 REQUIREMENTS (continued) SR 3.3.11.2 verifies that each required Remote Shutdown System transfer switch and control circuit performs its intended function. The intended functions are:

1) To isolate the circuit from the control room.

2) To provide the capability to operate the equipment from the remote shutdown location.

This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel is not necessary.

The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the. plant can be brought to and maintained in MODE 3 from the remote shutdown panel and the local control stations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.11.3 CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to the measured parameter within the necessary range and accuracy.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

2. 10 CFR 50, Appendix R.

PALO VERDE UNITS 1,2,3 B 3.3.11-7 REVISION 56

This page intentionally blank Boron Dilution Alarm System (BDAS)

B 3.3.12 BASES (continued)

SURVEILLANCE SR 3.3.12.1 REQUIREMENTS A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based upon the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more .serious. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff and should be based on a combination of the channel instrument uncertainties. If a channel is outside of the criteria. it may be an indication that the transmitter or the signal processing equipment has drifted outside of its limits. If the channels are within the criteria. it is an indication that the channels are OPERABLE. For clarification. a CHANNEL CHECK is a qualitative assessment of an instrument's behavior. Where possible. a numerical comparison between like instrument channels should be included but is not required for an acceptable CHANNEL CHECK performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that states the CHANNEL CHECK is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after neutron flux is within the startup range. Neutron flux is defined to be within the startup range following a reactor shutdown when reactor power is 2E-6% NRTP or less.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.12-5 REVISION 56

Boron Dilution Alarm System (BOAS)

B 3.3.12 BASES SURVEILLANCE SR 3.3.12.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed to ensure that the BOAS is capable of properly alerting the operator to a boron dilution event. Internal excore startup channel test circuitry is used to feed preadjusted test signals into the excore startup channel to verify the proper neutron flux indication is received at the BOAS.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after neutron flux is within the startup range. The 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on allowing a reasonable time to perform the testing following a plant shutdown. Neutron flux is defined to be within the startup range following a reactor shutdown when reactor power is 2E-6% NRTP o~ less.

The CHANNEL FUNCTIONAL TEST of the BOAS consists of online tests including verification of the control room alarm.

SR 3.3.12.3 SR 3.3.12.3 is the performance of a CHANNEL CALIBRATION.

The Surveillance is a complete check and readjustment of the excore startup channel from the input through to the BOAS. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational.

This SR is modified by a Note to indicate that it is not necessary to test the detector. because generating a meaningful test signal is difficult; the detectors are of simple construction. and any failures in the detectors will be apparent as a change in channel output. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 7 and Chapter 15.

PALO VERDE UNITS 1.2.3 B 3.3.12-6 REVISION 56

RCS Pressure. Temperature. and Flow DNB Limits B 3.4.1 BASES (continued)

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.1. 2 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.1. 3 The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that only requires performance of this SR in MODE 1. The Note is necessary to allow measurement of RCS flow rate at normal operating conditions at power with all RCPs running.

REFERENCES 1. UFSAR. Section 15.

PALO VERDE UNITS 1.2.3 B 3.4.1-5 REVISION 56

This page intentionally blank RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND Establishing the value for the minimum temperature for reactor criticality is based upon considerations for:

a. Operation within the existing instrumentation ranges and accuracies;

b. Operation within the bounds of the existing accident analyses; and

c. Operation with the reactor vessel above its minimum nil ductility reference temperature when the reactor is critical.

The reactor coolant moderator temperature coefficient used in core operating and accident analysis is typically defined for the normal operating temperature range (550°F to 611°F).

Nominal TCOld for making the reactor critical is 565°F.

Safety and operating analyses for lower temperature have not been made.

APPLICABLE There are no accident analyses that dictate the minimum SAFETY ANALYSES temperature for criticality.

The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of the LCO is to prevent criticality below the minimum normal operating temperature (550°F) and to prevent operation in an unanalyzed condition.

The LCO is only applicable in MODES 1 and 2 with Keff ~ 1.0 and provides a reasonable distance to the limit of 545°F.

This allows adequate time to trend its approach and take corrective actions prior to exceeding the limit.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.2-1 REVISION 7

RCS Minimum Temperature for Criticality B 3.4.2 BASES (continued)

APPLICABILITY The reactor has been designed and analyzed to be critical in MODES 1 and 2 only and in accordance with this specification. Criticality is not permitted in any other MODE. Therefore. this LCO is applicable in MODE 1. and MODE 2 when Keff ~ 1.0. Monitoring is required at or below a Tcold of 550°F. The no load temperature of 565°F is maintained by the Steam Bypass Control System.

ACTIONS A.1 If Tcold is below 545°F. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status.

the plant must be brought to MODE 3 within 30 minutes.

Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time reflects the ability to perform this action and to maintain the plant within the analyzed range.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS Tcold is required to be verified ~ 545°F once within 30 mi nutes after any RCS loop Tcold < 550°F and peri odi cally thereafter. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. A Note states the Surveillance is required whenever the reactor is critical and temperature is below 550°F. A second Frequency requi res Tcold to be veri fi ed wi thi n 30 mi nutes of reachi ng criticality. This will require repeated performance of SR 3.4.2.1 since a reactor startup takes longer than 30 minutes. The 30 minute time period is frequent enough to prevent inadvertent violation of the LCD.

REFERENCES 1. UFSAR. Section 15.

PALO VERDE UNITS 1.2.3 B 3.4.2-2 REVISION 56

RCS PIT Limits B 3.4.3 BASES ACTIONS C.1 and C.2 (continued)

Besides restoring operation to within limits. an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used. including comparison with pre-analyzed transients in the stress analyses. new analyses. or inspection of the components.

ASME Code.Section XI. Appendix E (Ref. 6). may be used to support the evaluation. However. its use is restricted to evaluation of the vessel beltline.

The Completion Time of prior to entering MODE 4 forces the evaluation prior to entering a MODE where temperature and pressure can be significantly increased. The evaluation for a mild violation is possible within several days. but more severe violations may require special. event specific stress analyses or inspections.

Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within the PTLR limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Surveillance for heatup. cooldown. or ISLH testing may be discontinued when the definition given in the relevant plant procedure for ending the activity is satisfied.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.3-7 REVISION 56

RCS PIT Limits B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)

REQUIREMENTS This SR is modified by a Note that requires this SR be performed only during RCS system heatup. cooldown. and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.

REFERENCES 1. TRM Appendix TA. Reactor Coolant System Pressure and Temperature Limits Report (PTLR); .(limits determined using methods described in Topical Report CE NPSD-683-A. Revision 6. Development of aRCS Pressure and Temperature Limits Report for the Removal of P-T Limits and LTOP Requirements from the Technical Specifications. April 2001).

2. 10 CFR 50. Appendix G.

3. ASME. Boiler and Pressure Vessel Code.Section III.

Appendix G.

4. ASTM E 185-82. July 1982.

5. 10 CFR 50. Appendix H.

6. ASME. Boiler and Pressure Vessel Code.Section XI.

Appendix E.

PALO VERDE UNITS 1.2.3 B 3.4.3-8 REVISION 52

RCS Loops - MODES 1 and 2 B 3.4.4 BASES APPLICABILITY In MODES 1 and 2. the reactor is critical and thus has the potential to produce maximum THERMAL POWER. Thus. to ensure that the assumptions of the accident analyses remain valid.

all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.

The decay heat production rate is much lower than the full power heat rate. As such. the forced circulation flow and heat sink requirements are reduced for lower. noncritical MODES as indicated by the LCOs for MODES 3. 4. 5. and 6.

Operation in other MODES is covered by:

LCO 3.4.5. "RCS Loops - MODE 3";

LCO 3.4.6. "RCS Loops - MODE 4";

LCO 3.4.7. "RCS Loops - MODE 5. Loops Filled";

LCO 3.4.8. "RCS Loops - MODE 5. Loops Not Filled";

LCO 3.9.4. "Shutdown Cooling (SOC) and Coolant Circulation - High Water Level" (MODE 6); and LCO 3.9.5. "Shutdown Cooling (SOC) and Coolant Circulation - Low Water Level" (MODE 6).

ACTIONS A.1 If the requirements of the LCO are not met. the Required Action is to reduce power and bring the plant to MODE 3.

This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNB limits. It should be noted that the reactor will trip and place the plant in MODE 3 as soon as the RPS senses less than four RCPs operating.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.4-3 REVISION 7

RCS Loops - MODES 1 and 2 B 3.4.4 BASES (continued)

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This SR requires verification that the required number of RCS loops are in operation and circulating reactor coolant.

Verification includes flow rate. temperature. or pump status monitoring. which help to ensure that forced flow is providing heat removal while maintaining the margin to DNB.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 15.

PALO VERDE UNITS 1.2.3 B 3.4.4-4 REVISION 56

RCS Loops - MODE 3 B 3.4.5 BASES LCO An RCP is OPERABLE if it is capable of being powered and is (continued) able to provide forced flow if required.

APPLICABILITY In MODE 3. the heat load is lower than at power; therefore.

one RCS loop in operation is adequate for transport and heat removal. A second RCS loop is required to be OPERABLE but not in operation for redundant heat removal capability.

Operation in other MODES is covered by:

LCO 3.4.4 "RCS Loops-MODES 1 and 2";

LCO 3.4.6. "RCS Loops - MODE 4";

LCO 3.4.7. "RCS Loops - MODE 5. Loops Filled";

LCO 3.4.8. "RCS Loops - MODE 5. Loops Not Fi 11 ed" ;

LCO 3.9.4. "Shutdown Cooling (SOC) and Coolant Circulation - High Water Level" (MODE 6); and LCO 3.9.5. "Shutdown Cool i ng (SOC) and Coolant Circulation - Low Water Level" (MODE 6).

ACTIONS A.1 If one required RCS loop is inoperable. redundancy for forced flow heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within a Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This time allowance is a justified period to be without the redundant.

nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core.

B.1 If restoration is not possible within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . the unit must be placed in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In MODE 4. the plant may be placed on the SOC System. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is compatible with required operation to achieve cooldown and depressurization from the existing plant conditions in an orderly manner and without challenging plant systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.5-3 REVISION 38

RCS Loops - MODE 3 B 3.4.5 BASES ACTIONS C.1 and C.2 (continued)

If no RCS loop is OPERABLE or in operation. all operations involving a reduction of RCS boron concentration must be immediately suspended. This is necessary because boron dilution requires forced circulation for proper homogenization. Action to restore one RCS loop to OPERABLE status and operation shall be initiated immediately and continued until one RCS loop is restored to OPERABLE status and operation. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR requires verification that the required number of RCS loops are in operation and circulating Reactor Coolant.

Verification includes flow rate. temperature. or pump status monitoring. which help ensure that forced flow is providing heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.5.2 This SR requires verification that the secondary side water level in each SG is ~ 25% wide range. An adequate SG water level is required in order to have a heat sink for removal of the core decay heat from the reactor coolant. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.5-4 REVISION 56

RCS Loops - MODE 3 B 3.4.5 BASES SURVEILLANCE SR 3.4.5.3 REQUIREMENTS (continued) Verification that the required number of RCPs are OPERABLE ensures that the single failure criterion is met and that an additional RCS loop can be placed in operation. if needed.

to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to the required RCPs. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES PVNGS Calculation 13-JC-SH-0200. Section 2.9 PALO VERDE UNITS 1.2.3 B 3.4.5-5 REVISION 56

This page intentionally blank RCS Loops - MODE 4 B 3.4.6 BASES (continued)

SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification that one required loop or train is in operation and circulating reactor coolant at a flow rate of greater than or equal to 4000 gpm. This ensures forced flow is providing heat removal. Verification includes flow rate. temperature. or pump status monitoring.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.6.2 This SR requires verification of secondary side water level in the required SG(s) ~ 25% wide range. An adequate SG water level is required in order to have a heat sink for removal of the core decay heat from the reactor coolant.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.6.3 Verification that the required pump is OPERABLE ensures that an additional RCS loop or SOC train can be placed in operation. if needed to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pumps. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. PVNGS Operating License Amendments 52. 38 and 24 for Units 1. 2 and 3. respectively. and associated NRC Safety Evaluation dated July 25. 1990.

2. Not used.

3. PVNGS Calculation 13-JC-SH-0200. Section 2.9.

PALO VERDE UNITS 1.2.3 B 3.4.6-5 REVISION 56

This page intentionally blank RCS Loops - MODE 5. Loops Filled B 3.4.7 BASES (continued)

APPL ICAB ILITY In MODE 5 with RCS loops filled. this LCD requires forced circulation to remove decay heat from the core and to provide proper boron mixing. One SOC train provides sufficient circulation for these purposes.

Operation in other MODES is covered by:

LCD 3.4.4. "RCS Loops-MODES 1 and 2";

LCD 3.4.5. "RCS Loops - MODE 3";

LCD 3.4.6. "RCS Loops - MODE 4";

LCD 3.4.8. "RCS Loops - MODE 5. Loops Not Filled";

LCD 3.9.4. "Shutdown Cool i ng (SOC) and Coolant Circulation - High Water Level" (MODE 6); and LCD 3.9.5. "Shutdown Cooling (SOC) and Coolant Circulation - Low Water Level" (MODE 6).

ACTIONS A.I and A.2 If a SOC train is inoperable and any SGs have secondary side water levels < 25% wide range. redundancy for heat removal is lost. Action must be initiated immediately to restore a second SOC train to OPERABLE status or to restore the water level in the required SGs. Either Required Action A.1 or Required Action A.2 will restore redundant decay heat removal paths. The immediate Completion Times reflect the importance of maintaining the availability of two paths for decay heat removal.

B.1 and B.2 If the required SOC train is not OPERABLE or no SOC train is in operation. all operations involving the reduction of RCS boron concentration must be suspended. Action to restore one SOC train to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing and the margin to criticality must not be reduced in this type of operation. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.7-5 REVISION 0

RCS Loops - MODE 5. Loops Filled B 3.4.7 BASES (continued)

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification that one SOC train is in operation and circulating reactor coolant at a flow rate of greater than or equal to 3780 gpm. Verification includes flow rate. temperature. or pump status monitoring. which help ensure that forced flow is providing decay heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SOC flow is established to ensure that core outlet temperature is maintained sufficiently below saturation to allow time for swapover to the standby SOC train should the operating train be lost.

SR 3.4.7.2 Verifying the SGs are OPERABLE by ensuring their secondary side water levels are ~ 25% wide range level ensures that redundant heat removal paths are available if the second SOC train is inoperable. The Surveillance is required to be performed when the LCO requirement is being met by use of the SGs. If both SOC trains are OPERABLE. this SR is not needed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.7.3 Verification that the second SOC train is OPERABLE ensures that redundant paths for decay heat removal are available.

The requirement also ensures that the additional train can be placed in operation. if needed. to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pumps. The Surveillance is required to be performed when the LCO requirement is being met by one of two SOC trains. e.g .. both SGs have < 25% wide range water level. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.7-6 REVISION 56

RCS Loops - MODE 5. Loops Not Filled B 3.4.8 BASES (continued)

ACTIONS A.1 If a SOC train is inoperable. redundancy for heat removal is lost. Action must be initiated immediately to restore a second train to OPERABLE status. The Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

B.1 and B.2 If no SOC train-is OPERABLE or in operation. except as provided in NOTE 1. all operations involving the reduction of RCS boron concentration must be suspended. Action to restore one SOC train to OPERABLE status and operation must be initiated immediately. Boron dilution requires forced circulation for proper mixing and the margin to criticality must not be reduced in this type of operation. The immediate Completion Time reflects the importance of maintaining operation for decay heat removal.

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires verification that one SOC train is in operation and circulating reactor coolant at a flow rate of greater than or equal to 3780 gpm. Verification includes flow rate. temperature. or pump status monitoring. which help ensure that forced flow is providing decay heat removal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.8.2 Verification that the required number of trains are OPERABLE ensures that redundant paths for heat removal are available and that an additional train can be placed in operation. if needed. to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and indicated power available to the required pumps. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES PVNGS Calculation 13-JC-SH-0200. Section 2.9.

PALO VERDE UNITS 1.2.3 B 3.4.8-3 REVISION 56

This page intentionally blank Pressurizer B 3.4.9 BASES ACTIONS B.1 (continued)

If one required group of pressurizer heaters is inoperable.

restoration is required within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using normal station powered heaters.

C.1 and C.2 If one required group of pressurizer heaters is inoperable and cannot be restored within the allowed Completion Time of Required Action B.1. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. to reach MODE 3 from full power in an orderly manner and without challenging safety systems. Similarly. the Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable. based on operating experience. to reach MODE 4 from full power in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This Surveillance ensures that during steady state operation. pressurizer water level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.9-5 REVISION 56

Pressuri zer B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 REQUIREMENTS (continued) The Surveillance is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their design rating. (This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance.) The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NUREG-0737. November 1980.

PALO VERDE UNITS 1.2.3 B 3.4.9-6 REVISION 56

Pressurizer Safety Valves-MODE 4 B 3.4.11 BASES (continued)

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS SRs are specified in the Inservice Testing Program.

Pressurizer safety valves are to be tested in accordance with the requirements of the ASME OM Code (Ref. 2). which provides the activities and the Frequency necessary to satisfy the SRs. No additional requirements are specified.

The pressurizer safety valve setpoint is +3%. -1% for OPERABILITY; however. the valves are reset to +/- 1% during the Surveillance to allow for drift (Ref. 3). The lift setting pressure shall correspond to ambient conditions of the valve at nominal operating temperature and pressure.

SR 3.4.11.2 SR 3.4.11.2 requires that the required Shutdown Cooling System suction line relief valve is OPERABLE by verifying its open pathway condition.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR has been modified by a Note that requires performance only if a Shutdown Cooling System suction line relief valve is being used for overpressure protection. The Frequencies consider operating experience with mispositioning of unlocked and locked pathway vent valves.

SR 3.4.11.3 SRs are specified in the Inservice Testing Program.

Shutdown Cooling System suction line relief valves are to be tested in accordance with the requirements of the ASME OM Code (Ref. 2). which provides the activities and the Frequency necessary to satisfy the SRs. The Shutdown Cooling System suction line relief valve setpoint is 467 psig.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.11-5 REVISION 56

Pressurizer Safety Valves-MODE 4 B3.4.11 BASES (continued)

REFERENCES 1. ASME. Boiler and Pressure Vessel Code.Section III.

2. ASME Code for Operations and Maintenance of Nuclear Power Plants.

3. PVNGS Operating License Amendment Nos. 75. 61. and 47 for Units 1. 2. and 3 respectively. and associated NRC Safety Evaluation dated May 16. 1994.

PALO VERDE UNITS 1.2.3 B 3.4.11-6 REVISION 54

Pressurizer Vents B 3.4.12 BASES LCO A vent path is flow capability from the pressurizer to the (continued) ROT or from the pressurizer to containment atmosphere.

Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable. A pressurizer vent path is required to depressurize the RCS in a SGTR design basis event which assumes LOP and APSS unavailable.

APPLICABILITY In MODES 1. 2. 3. and MODE 4 with RCS pressure ~ 385 pSia the four pressurizer vent paths are required to be OPERABLE.

The safety analysis for the SGTR with LOP and a Single Failure (loss of APSS) credits a pressurizer vent path to reduce RCS pressure.

In MODES 1. 2. 3. and MODE 4 with RCS pressure ~ 385 pSia the SGs are the primary means of heat removal in the RCS.

until shutdown cooling can be initiated. In MODES 1. 2. 3.

and MODE 4 with RCS pressure ~ 385 psia. assuming the APSS is not available. the pressurizer vent paths are the credited means to depressurize the RCS to Shutdown Cooling*

System entry conditions. Further depressurization into MODE 5 requires use of the pressurizer vent paths. In MODE 5 with the reactor vessel head in place. temperature requirements of MODE 5 << 210°F) ensure the RCS remains depressurized.

In MODE 6 the RCS is depressurized.

ACTIONS A.l If two or three pressurizer vent paths are inoperable. they must be restored to OPERABLE status. Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable. Any vent path that provides flow capability from the pressurizer to the ROT or to the containment atmosphere. independent of which train is powering the valves in the flow path. can be considered an operable vent path. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable because there is at least one pressurizer vent path that remains OPERABLE.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.12-3 REVISION 48

Pressurizer Vents B 3.4.12 BASES ACTIONS B.1 (continued)

If all pressurizer vent paths are inoperable. then restore at least one pressurizer vent path to OPERABLE status. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to allow time to correct the situation. yet emphasize the importance of restoring at least one pressurizer vent path. If at least one pressurizer vent path is not restored to OPERABLE within the Completion Time. then Action C is entered.

C.1 If the required Actions. A and B. cannot be met within the associated Completion Times. the plant must be brought to a MODE in which the requirement does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and to MODE 4 with RCS pressure < 385 psia within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS SR 3.4.12.1 requires complete cycling of each pressurizer vent path valve. The vent valves must be cycled from the control room to demonstrate their operability. Pressurizer vent path valve cycling demonstrates its function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6. In any Mode. partial surveillance tests can be performed for post-maintenance testing under site procedural controls that ensure the valve being tested is isolated from RCS pressure.

SR 3.4.12.2 SR 3.4.12.2 requires verification of flow through each pressurizer vent path. Verification of pressurizer vent path flow demonstrates its function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.12-4 REVISION 56

LTOP System B 3.4.13 BASES ACTIONS B.1 (continued)

Cooling System suction line relief valve failures without exposure to a lengthy period with only one Shutdown Cooling System suction line relief valve OPERABLE to protect against overpressure events.

C.1 If two required Shutdown Cooling System suction line relief valves are inoperable. or if a Required Action and the associated Completion Time of Condition A or B are not met.

the RCS must be depressurized and a vent established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The vent must be sized at least 16 square inches to ensure the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action protects the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel. For personnel safety considerations. the RCS cold leg temperature must be reduced to less than 200°F prior to venting.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to depressurize and vent the RCS is based on the time required to place the plant in this condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE SR 3.4.13.1 and 3.4.13.2 REQUIREMENTS SR 3.4.13.1 and SR 3.4.13.2 require verifying that the RCS vent is open ~ 16 square inches or that the Shutdown Cooling System suction line relief valves be aligned to provide overpressure protection for the RCS is proven OPERABLE by verifying its open pathway condition.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.13-9 REVISION 56

LTOP System B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 and 3.4.13.2 (continued)

REQUIREMENTS For an RCS vent to meet the specifi ed fl ow capacity. it requires removing all pressurizer safety valves. or similarly establishing a vent by opening the pressurizer manway (Ref. 10). The vent path(s) must be above the level of reactor coolant. so as not to drain the RCS when open.

The passive vent arrangement must only be open (vent pathway exists) to be OPERABLE. These Surveillances need only be performed if the vent or the Shutdown Cooling System suction line relief valves are being used to satisfy the requirements of this LCD. The Frequencies consider operating experience with mispositioning of unlocked and locked pathway vent valves. and passive pathway obstructions.

SR 3.4.13.3 SRs are specified in the Inservice Testing Program.

Shutdown Cooling System suction line relief valves are to be tested in accordance with the requirements of the ASME OM Code (Ref. 9). which provides the activities and the Frequency necessary to satisfy the SRs. The Shutdown Cooling System suction line relief valve set point is 467 psig.

REFERENCES 1. 10 CFR 50. Appendix G.

2. Generic Letter 88-11.

3. UFSAR. Section 15.

4. 10 CFR 50.46.

5. 10 CFR 50. Appendix K.

6. Generic Letter 90-06.

7. UFSAR. Section 5.2.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.13-10 REVISION 56

RCS Operational LEAKAGE B 3.4.14 BASES SURVEILLANCE SR 3.4.14.1 (continued)

REQUIREMENTS An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level. These leakage detection systems are specified in LCD 3.4.16. "RCS Leakage Detection Instrumentation. "

Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAKAGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.14.2 This SR verifies that primary to secondary LEAKAGE is less than or equal to 150 gallons per day through anyone SG.

Satisfying the primary to secondary LEAKAGE limit ensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met.

compliance with LCD 3.4.18. "Steam Generator Tube Integrity." should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 8. The operational LEAKAGE rate limit applies to LEAKAGE through anyone SG. If it is not practical to assign the LEAKAGE to an individual SG. all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishment of steady state operation. This means that once steady state operating conditions are established. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is allowed for completing the Surveillance. When required by the Frequency. and after steady state operating conditions are established. the surveillance must be completed prior to the end of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of steady state operation. If steady state operating conditions have not been established for 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . this surveillance is not required until steady state operation is established for 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This SR is not required to be completed prior to changing MODES if steady state operation (continued)

PALO VERDE UNITS 1.2.3 B 3.4.14-7 REVISION 56

RCS Operational LEAKAGE B 3.4.14 BASES SURVEILLANCE SR 3.4.14.2 (continued)

REQUIREMENTS has not been established for 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established. Further discussion of SR note format is found in Section 1.4. Frequency.

The Note allows for SR 3.4.14.2 nonperformance due to planned or unplanned transients. This Note is not intended to allow transients solely for the purpose of avoiding SR 3.4.14.2 performance. For RCS primary to secondary LEAKAGE determination. steady state is defined as stable RCS pressure. temperature. power level. pressurizer and makeup tank levels. makeup and letdown. and RCP seal injection and return flows.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 30.

2. Regulatory Guide 1.45. May 1973.

3. UFSAR. Section 15.6.

4. UFSAR. Section 6.4.

5. 10 CFR Part 100.

6. 10 CFR 50. Appendix A. GDC19.

7. NEI 97-06. "Steam Generator Program Guidelines."

8. EPRI. "Pressurized Water Reactor Primary-to-Secondary Leak Guidelines."

PALO VERDE UNITS 1.2.3 B 3.4.14-8 REVISION 56

RCS PIV Leakage B 3.4.15 BASES SURVEILLANCE SR 3.4.15.1 (continued)

REQUIREMENTS For the two PIVs in series. the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested. one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation. the protection provided by redundant valves would be lost.

Testing is to be performed every 9 months. but may be extended if the plant does not go into MODE 5 for at least 7 days. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

In addition. testing must be performed once after the valve has been opened by flow or exercised to ensure tight reseating. PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the valve has been reseated. Within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable and practical time limit for performing this test after opening or reseating a valve.

The SOC PIVs excepted in two of the three FREQUENCIES are UV-651. UV-652. UV-653. and UV-654. due to position indication of the valves in the control room.

Although not explicitly required by SR 3.4.15.1. performance of leakage testing to verify leakage is below the specified limit must be performed prior to returning a valve to service following maintenance. repair or replacement work on the valve in order to demonstrate operability.

The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditibns not possible in the MODES with lower pressures.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.15-5 REVISION 56

RCS PIV Leakage B 3.4.15 BASES SURVEILLANCE SR 3.4.15.1 (continued)

REQUIREMENTS Entry into MODES 3 and 4 is allowed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance. The Note that allows this provision is complimentary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more. if leakage testing has not been performed in the previous 9 months. In addition. this Surveillance is not required to be performed on the SDC System when the SDC System is aligned to the RCS in the shutdown cooling mode of operation. PIVs contained in the SOC shutdown cooling flow path must be leakage rate tested after SOC is secured and stable unit conditions and the necessary differential pressures are established.

SR 3.4.15.2 Verifying that the SOC open permissive interlocks are OPERABLE. when tested as described in Reference 10. ensures that RCS pressure will not pressurize the SOC system beyond 125% of its design pressure of 485 psig. The interlock setpoint that prevents the valves from being opened is set so the actual RCS pressure must be <410 psia to open the valves. This setpoint ensures the SOC design pressure will not be exceeded and the SOC relief valves (Reference 9) will not lift. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.15-6 REVISION 56

RCS Leakage Detection Instrumentation B 3.4.16 BASES ACTIONS C.1 (continued)

If any Required Action of Condition A or B cannot be met within the required Completion Time. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

0.1 If all required monitors are inoperable. no automatic means of monitoring leakage are available and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEI LLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitors.

The check gives reasonable confidence the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.16.2 SR 3.4.16.2 requires the performance of a CHANNEL FUNCTIONAL TEST of the required containment atmosphere radioactivity monitors. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The alarm setpoints for the containment building atmosphere monitor (RU-1) are:

particulate : : ; 2.3 X 10- 26 jJCi/cc CS-137 gaseous : : ; 6.6 x 10- jJCi/cc Xe-133 (continued)

PALO VERDE UNITS 1.2.3 B 3.4.16-5 REVISION 56

RCS Leakage Detection Instrumentation B 3.4.16 BASES SURVEILLANCE SR 3.4.16.3. SR 3.4.16.4 REQUIREMENTS (continued) These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string. including the instruments located inside containment. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A.Section IV. GDC 30.

2. Regul atory Gui de 1.45.

3. UFSAR. Section 5.2.5.

PALO VERDE UNITS 1.2.3 B 3.4.16-6 REVISION 56

RCS Specific Activity B 3.4.17 BASES (continued)

SURVEILLANCE SR 3.4.17.1 REQUIREMENTS The Surveillance requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes.

excluding iodines. this measurement is the sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2. and in MODE 3 with RCS cold leg temperature at least 500°F. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.17.2 This Surveillance is performed to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The 14 day surveillance frequency is modified by the Note "Only required to be performed in MODE 1." This is acceptable because the level of fission products generated in MODES 2 and 3 is much less than in MODE 1. The Frequency. between 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change of ~15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period. is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results. One sample is sufficient if the plant has gone through a shutdown or if the transient is complete in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

SR 3.4.17.2 14 day Frequency is modified by a Note which requires the Surveillance to only be performed in MODE 1.

This is required because the level of fission products generated in other MODES is much less. Also. fuel failures associated with fast power changes is more apt to occur in MODE 1 than in MODES 2 or 3.

(continued)

PALO VERDE UNITS 1.2.3 B 3.4.17-5 REVISION 56

RCS Specific Activity B 3.4.17 BASES SURVEILLANCE SR 3.4.17.3 REQUIREMENTS (continued) A radiochemical analysis for E determination is required with the plant operating in MODE 1 equilibrium conditions.

The E determination directly relates to the LCD and is required to verify plant operation within th~ specified gross activity LCD limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 15 minutes. excluding iodines. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for ~ 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months should the 184 day Frequency interval be exceeded. Further discussion of SR Note format is found in Section 1.4.

Frequency. This ensures the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

REFERENCES 1. 10 CFR 100.11. 1973.

2. UFSAR. Section 15.6.3.

PALO VERDE UNITS 1.2.3 B 3.4.17-6 REVISION 56

SITs-Operating B 3.5.1 BASES (continued)

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Verification that each SIT isolation valve is fully open. as indicated in the control room. ensures that SITs are available for injection and ensures timely discovery if a valve should be partially closed. If an isolation valve is not fully open. the rate of injection to the RCS would be reduced. Although a motor operated valve should not change position with power removed. a closed valve could result in not meeting accident analysis assumptions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.2 and SR 3.5.1.3 SIT borated water volume and nitrogen cover pressure should be verified to be within specified limits in order to ensure adequate injection during a LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.4 Thirty-one days is reasonable for verification to determine that each SIT's boron concentration is within the required limits. because the static design of the SITs limits the ways in which the concentration can be changed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.1-9 REVISION 56

SITs-Operati ng B 3.5.1 BASES SURVEILLANCE SR 3.5.1. 5 REQUIREMENTS (continued) Verification that power is removed from each SIT isolation valve operator ensures that an active failure could not result in the undetected closure of a SIT motor operated isolation valve. If this were to occur. only two SITs would be available for injection. given a single failure coincident with a LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.5 allows power to be supplied to the motor operated isolation valves when RCS pressure is < 1500 psia. thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves.

inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA. At RCS pressures above the valve auto-open interlock. the maximum pressure at which the SIAS open signal will open the valves is limited by the valve' operator differential pressure design capability.

REFERENCES 1. IEEE Standard 279-1971.

2. UFSAR. Section 6.

3. 10 CFR 50.46.

4. UFSAR. Chapter 15.

5. NUREG-1366. "Improvements to Technical Specifications Surveillance Requirements." December 1992.

6. CE NPSD-994. "CEOG Joi nt App 1i cati ons Report for Safety Injection Tank AOT/STI Extension." May 1995.

7. UFSAR Secti on 7.6.2.2.2.

8. TRM T3.5 (ECCS); TSR 3.5.200.4 PALO VERDE UNITS 1.2.3 B 3.5.1-10 REVISION 56

SITs - Shutdown B 3.5.2 BASES (continued)

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification that each required SIT isolation valve is fully open when pressurizer pressure is ~ 430 psia as indicated in the control room. ensures that the required SITs are available for injection and ensures timely discovery if a valve should be partially closed. If a required isolation valve is not fully open. the rate of injection to the RCS would be reduced. Although a motor operated valve should not change position with power removed. a closed valve could result in not meeting accident analysis assumptions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.2 and SR 3.5.2.3 Borated water volume and nitrogen cover pressure for the required SITs should be verified to be within specified limits in order to ensure adequate injection during a LOCA.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.4 Thirty-one days is reasonable for verification to determine that each required SIT's boron concentration is within the required limits. because the static design of the SITs limits the ways in which the concentration can be changed.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.2-9 REVISION 56

SITs - Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 REQUIREMENTS (continued) Verification that power is removed from each required SIT isolation valve operator when the pressurizer pressure is

~ 1500 pSia ensures that an active failure could not result in the undetected closure of a SIT motor operated isolation valve. If this were to occur. two less than the required SITs would be available for injection. given a single failure coincident with a LOCA.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 1500 psia.

thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves. inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock. the SI signal provided to the valves would open a closed valve in the event of a LOCA. At RCS pressures above the valve auto-open interlock. the maximum pressure at which the SIAS open signal will open the valves is limited by the valve operator differential pressure design capability.

REFERENCES 1. IEEE Standard 279-1971.

2. 10 CFR 50.46.

3. UFSAR. Chapter 15.

4. NUREG-1366. "Improvements to Technical Specifications Surveillance Requirements." December 1992.

5. CE NPSD-994. "CEGG Joint Applications Report for Safety Injection Tank AOT/STI Extension." May 1995.

6. UFSAR Section 7.6.2.2.2

7. TRM T3.5 (ECCS); TSR 3.5.200.4 PALO VERDE UNITS 1.2.3 B 3.5.2-10 REVISION 56

ECCS - Operating B 3.5.3 BASES ACTIONS B.1 (continued)

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems. the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components. each in a different train. necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of OPERABLE equipment such that 100% of the ECCS flow equivalent to 100%

of a single OPERABLE train remains available. This allows increased flexibility in plant operations when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an emergency DG can disable one ECCS train until power is restored. A reliability analysis (Ref. 4) has shown that the impact with one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

With one or more components inoperable. such that 100% of the equivalent flow to a single OPERABLE ECCS train is not available. the facility is in a condition outside the accident analyses. Therefore. LCO 3.0.3 must be immediately entered.

C.1. C.2. and C.2 If the inoperable train cannot be restored to OPERABLE status within the associated Completion Time. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to

< 1837 pSia and RCS Tc reduced to < 485°F within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power in an orderly manner and without challenging unit systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.3-7 REVISION 2

ECCS - Operating B 3.5.3 BASES (continued)

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS Verifying the correct alignment for manual. power operated.

and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked. sealed. or otherwise secured in position. since these valves were verified to be in the correct position prior to locking. sealing. or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather. it involves verification that those valves capable of being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.2 With the exception of systems in operation. the ECCS pumps are normally in a standby. nonoperating mode. As such. flow path piping has the potential to develop voids and pockets of entrained gases. The method of ensuring that any voids or pockets of gases are removed from the ECCS piping is to vent the accessible discharge piping high pOints. which is controlled by PVNGS procedures. Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly. injecting its full capacity into the RCS upon demand. This will also prevent water hammer. pump cavitation. and pumping of noncondensible gas (e.g .. air. nitrogen. or hydrogen) into the reactor vessel following an SIAS or during SOC. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.3-8 REVISION 56

ECCS - Operating B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 REQUIREMENTS (continued) Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the unit safety analysis. SRs are specified in the Inservice Testing Program. which encompasses the ASME OM Code (Ref. 7). The frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.5.3.4. SR 3.5.3.5. and SR 3.5.3.6 These SRs demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SIAS and on an RAS. that each ECCS pump starts on receipt of an actual or simulated SIAS. and that the LPSI pumps stop on receipt of an actual or simulated RAS. This Surveillance is not required for valves that are locked. sealed. or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The following valve actuations must be verified:

on an actual or simulated recirculation actuation signal. the containment sump isolation valves open.

and the HPSI. LPSI and CS minimum bypass recirculation flow line isolation valves and combined SI mini flow valve close.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.3-9 REVISION 56

ECCS - Operating B 3.5.3 BASES SURVEILLANCE SR 3.5.3.7 REQUIREMENTS (continued) Realignment of valves in the flow path on an SIAS is necessary for proper ECCS performance. The safety injection valves have stops to position them properly so that flow is restricted to a ruptured cold leg. ensuring that the other cold legs receive at least the required minimum flow. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. These valves are also monitored in accordance with the requirements of 10 CFR 50.65 (Ref.

5) .

SR 3.5.3.8 Periodic inspection of the containment sump ensures that it is unrestricted and stays in proper operating condition.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 35.

2. 10 CFR 50.46.

3. UFSAR. Chapter 6.

4. NRC Memorandum to V. Stello. Jr .. from R. L. Baer.

"Recommended Interim Revisions to LCOs for ECCS Components." December 1. 1975.

5. 10 CFR 50.65.

6. Combustion Engineering Owners Group Joint Applications Report for Low Pressure Safety Injection System AOT Extension. CE NPSD-995. dated May 1995. as submitted to NRC in APS letter no. 102-03392. dated June 13.

1995. with updates described in letter no. 102-04250 dated February 26. 1999. Also see TS amendment no. 124 dated February 1. 2000.

7. ASME Code for Operation and Maintenance of Nuclear Power Plants.

PALO VERDE UNITS 1.2.3 B 3.5.3-10 REVISION 56

RWT B 3.5.5 BASES LCO The RWT ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA) and to cool and cover the core in the event of a LOCA. that the reactor remains subcritical following a DBA. and that an adequate level exists in the containment sump to support ESF pump operation in the recirculation mode.

To be considered OPERABLE. the RWT must meet the limits established in the SRs for water volume. boron concentration. and temperature.

APPLICABILITY In MODES 1. 2. 3. and 4. the RWT OPERABILITY requirements are dictated by the ECCS and Containment Spray System OPERABILITY requirements. Since both the ECCS and the Containment Spray System must be OPERABLE in MODES 1. 2. 3.

and 4. the RWT must be OPERABLE to support their operation.

Core cooling requirements in MODE 5 are addressed by LCO 3.4.7. "RCS Loops - MODE 5. Loops Filled." and LCO 3.4.8.

"RCS Loops - MODE 5. Loops Not Fill ed." MODE 6 core cool i ng requirements are addressed by LCO 3.9.4. "Shutdown Cooling (SOC) and Coolant Circulation - High Water Level." and LCO 3.9.5. "Shutdown Cooling (SOC) and Coolant Circulation - Low Water Level."

ACTIONS A.l With RWT boron concentration or borated water temperature not within limits. it must be returned to within limits withi n 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In thi s conditi on neither the ECCS nor the Containment Spray System can perform their design functions; therefore. prompt action must be taken to restore the tank to OPERABLE condition. The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore the RWT to within limits was developed considering the time required to change boron concentration or temperature and that the contents of the tank are still available for injection and core cooling.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.5-7 REVISION 51

RWT B 3.5.5 BASES ACTIONS B.1 (continued)

With RWT borated water volume not within limits. it must be returned to within limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition.

neither the ECCS nor Containment Spray System can perform their design functions; therefore. prompt action must be taken to restore the tank to OPERABLE status or to place the unit in a MODE in which these systems are not required. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWT to OPERABLE status is based on this condition since the contents of the tank are not available for injection and core cooling.

C.1 and C.2 If the RWT cannot be restored to OPERABLE status within the associated Completion Time. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.5.1 REQUIREMENTS RWT borated water temperature shall be verified to be within the limits assumed in the accident analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures are within the operating temperature limits of the RWT. With ambient temperatures within this range. the RWT temperature should not exceed the limits.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.5-8 REVISION 56

RWT B 3.5.5 BASES SURVEILLANCE SR 3.5.5.2 REQUIREMENTS (continued) The RWT water volume level shall be verified in accordance with Figure 3.5.5-1. This Frequency ensures that a sufficient initial water supply is available for injection and to support continued ESF pump operation on recirculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.5.3 Boron concentration of the RWT shall be verified to be within the required range. This Frequency ensures that the reactor will remain subcritical following a LOCA and the boron precipitation in the core will not occur earlier than predicted. Further. it ensures that the resulting sump pH will be maintained in an acceptable range such that the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 6 and Chapter 15.

2. Engineering Calculation 13-JC-CH-0209 PALO VERDE UNITS 1.2.3 B 3.5.5-9 REVISION 56

This page intentionally blank TSP B 3.5.6 BASES LCO The required amount of TSP is based upon the extreme cases (continued) of water volume and pH possible in the containment sump after a large break LOCA. The minimum required volume is the volume of TSP that will achieve a sump solution pH of

~ 7.0 when taking into consideration the maximum possible sump water volume and the minimum possible pH. The amount of TSP needed in the containment building is based on the mass of TSP required to achieve the desired pH. However. a required volume is specified. rather than mass. since it is not feasible to weigh the entire amount of TSP in containment. The minimum required volume is based on the design basis value for density of anhydrous TSP. Since TSP can have a tendency to agglomerate from high humidity in the containment building. the density may increase and the volume decrease during normal plant operation. Due to possible agglomeration and increase in density. estimating the minimum volume of TSP in containment is conservative with respect to achieving a minimum required pH.

APPL ICAB ILITY In MODES 1. 2. and 3. the RCS is at elevated temperature and pressure. providing an energy potential for a LOCA. The potential for a LOCA results in a need for the ability to control the pH of the recirculated coolant.

In MODES 4. 5. and 6. the potential for a LOCA is reduced and TSP is not required.

ACTIONS A.l If it is discovered that the TSP in the containment building is not within limits. action must be taken to restore the TSP to within limits.

The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed for restoring the TSP within limits. where possible. because 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is the same time allowed for restoration of other ECCS components.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.6-3 REVISION 0

TSP B 3.5.6 BASES ACTIONS B.1 and B.2 (continued)

If the TSP cannot be restored within limits within the Completion Time of Required Action A.1. the plant must be brought to a MODE in which the LCO does not apply. The specified Completion Times for reaching MODES 3 and 4 are those used throughout the Technical Specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.6.1 REQUIREMENTS Periodic determination of the volume of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. A verification is required to determine visually that a minimum of 524 cubic feet is contained in the TSP baskets (Ref. 1). This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value ~ 7.0.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.6.2 Testing ensures that the solubility and buffering ability of the TSP is not degraded after exposure to the containment environment. A representative sample of 3.36 grams +/- 0.005 grams of anhydrous TSP (corrected for moisture content) is collected from one or more of the baskets in containment.

The sample is submerged in 1.0 +/- 0.005 liter (total volume) of 4280 to 4400 ppm boric acid solution at a temperature of 135°F +/- gOF. Without agitation. the solution pH should rise to greater than or equal to 7.0 within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Solution pH is measured at 77°F +/- gOF and rounded to the nearest tenth of a pH unit.

(continued)

PALO VERDE UNITS 1.2.3 B 3.5.6-4 REVISION 56

TSP B 3.5.6 BASES SURVEILLANCE SR 3.5.6.2 (continued)

REQUIREMENTS The sample weight and volume correspond to the design minimum concentration of TSP expected post LOCA in the containment sump. The limiting concentration occurs when the LCD minimum TSP volume of 524 cubic feet. weighing about 25.325 pounds at the installed bulk density. is dissolved into the maximum recirculation fluid mass of approximately 7.690.750 pounds. which is about 920.000 gallons at room temperature. The boron concentration of the test water is the highest possible with the maximum expected recirculation sump volume.

Agitation of the test solution is prohibited since an adequate standard for the agitation intensity cannot be specified. The test time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is necessary to allow time for the dissolved TSP to naturally diffuse through the sample solution. In the post LOCA containment sump. rapid mixing would occur. significantly decreasing the actual amount of time before the required pH is achieved. This ensures compliance with UFSAR Section 6.1.1.2 which requires containment sump pH to be greater than or equal to 7.0 and less than or equal to 8.5 within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after a Recirculation Actuation Signal (RAS).

The temperature of 135 +/- 9°F was chosen for the borated water solution because that is the minimum temperature expected at the inlet of the shutdown cooling heat exchangers during the initial phase of this accident when the TSP is dissolved into solution.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. PVNGS operating license amendment numbers 110. 102 and 82 for Units 1. 2 and 3. respectively. and associated NRC Safety Evaluation dated December 10. 1996.

PALO VERDE UNITS 1.2.3 B 3.5.6-5 REVISION 56

This page intentionally blank Containment Air Locks B 3.6.2 BASES ACTIONS C.1. C.2. and C.3 (continued)

Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time.

This specified time period is consistent with the ACTIONS of LCD 3.6.1. which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally. the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status. assuming that at least one door is maintained closed in each affected air lock.

0.1 and 0.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time. the plant must be brought to a MODE in which the LCD does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable.

based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program and includes testing of the airlock doors following each closing. as specified.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.2-7 REVISION 0

Containment Air Locks B 3.6.2 BASES SURVEILLANCE SR 3.6.2.1 (continued)

REQUIREMENTS The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR requiring the results to be evaluated against the acceptance criteria which is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly accounted for in determining the combined Type Band C containment leakage rate.

SR 3.6.2.2 The air lock interlock is designed to prevent simultaneous opening of both doors in a single air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident containment pressure. closure of either door will support containment OPERABILITY. Thus. the door interlock feature supports containment OPERABILITY while the air lock is being used for personnel transit into and out of containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous opening of the inner and outer doors will not inadvertently occur. Due to the purely mechanical nature of this interlock. and given that the interlock mechanism is not normally challenged when containment is used for entry and exit (procedures require strict adherence to single door opening). this test is only required to be performed every 24 months. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix J. Option B.

2. UFSAR. Section 3.8.

3. UFSAR. Section 6.2.

4. UFSAR. Section 15.6 PALO VERDE UNITS 1.2.3 B 3.6.2-8 REVISION 56

Containment Isolation Valves B 3.6.3 BASES ACTIONS 0.1. 0.2 and 0.3 (continued)

In accordance with Required Action 0.2. this penetration flow path must be verified to be isolated on a periodic basis.

The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident. which are no longer capable of being automatically isolated. will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation. Rather. it involves verification.

through a system walkdown. that those isolation devices outside containment capable of being mispositioned are in the correct position.

For the isolation devices inside containment. the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

For the required containment purge valve with a resilient seal that is isolated in accordance with Required Action 0.1.

SR 3.6.3.6 must be performed at least once every 92 days.

This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6. 184 days. is based on an NRC initiative. Generic Issue B-20 (Ref. 3). Since more reliance is placed on a single valve while in this Condition. it is prudent to perform the SR more often. Therefore. a Frequency of once per 92 days was chosen and has been shown to be acceptable based on operating experience.

E.1 and E.2 If the Required Actions and associated Completion Times are not met. the plant must be brought to a MODE in which the LCD does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.3-15 REVISION 43

Containment Isolation Valves B 3.6.3 BASES (continued)

SURVEILLANCE SR 3.6.3.1 REQUIREMENTS This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious opening of a 42 inch containment purge valve. Detailed analysis of the refueling purge valves failed to conclusively demonstrate their ability to close during a LOCA in time to limit offsite doses. Therefore. these valves are required to be in the sealed closed position during MODES 1. 2. 3. and 4.

A required containment purge valve that is sealed closed must have motive power to the valve operator removed. This can be accomplished by de-energizing the source of electric power.

In this application. the term "sealed" has no connotation of leak tightness. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is not required to be met while in Condition D of this LCO.

This is reasonable since the penetration flow path would be isolated.

SR 3.6.3.2 This SR ensures that the power access purge valves are closed as required or. if open. open for an allowable reason. If a purge valve is open in violation of this SR. the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed. it is not considered to have leakage outside of limits. The SR is not required to be met when the purge valves are open for pressure control. ALARA or air quality considerations for personnel entry. or for Surveillances that require the valves to be open. The power access purge valves are capable of closing in the environment following a LOCA. Therefore.

these valves are allowed to be open for limited periods Of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.3-16 REVISION 56

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.3 REQUIREMENTS (continued) This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked. sealed. or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather. it involves verification. through a system walkdown. that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked. sealed. or otherwise secured in the closed position. since these were verified to be in the correct position upon locking. sealing or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable. since access to these areas is typically restricted during MODES 1.

2. 3. 4 and for ALARA reasons. Therefore. the probability of misalignment of these containment isolation valves. once they have been verified to be in the proper position. is small.

SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked. sealed. or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. For containment isolation valves inside containment.

the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate. since these containment isolation valves are operated under (continued)

PALO VERDE UNITS 1.2.3 B 3.6.3-17 REVISION 56

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.4 (continued)

REQUIREMENTS administrative controls and the probability of their misalignment is low. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time that they are open. This SR does not apply to valves that are locked. sealed. or otherwise secured in the closed position. since these were verified to be in the correct position upon locking. sealing or securing.

The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable. since access to these areas is typically restricted during MODES 1. 2. 3 and 4 for ALARA reasons. Therefore. the probability of misalignment of these containment isolation valves. once they have been verified to be in their proper position. is small.

SR 3.6.3.5 Verifying that the isolation time of each required automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.6 For required containment purge valves with resilient seals.

additional leakage rate testing beyond the test requirements of 10 CFR 50. Appendix J. Option B (Ref. 5). is required to ensure OPERABILITY. Industry operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.3-18 REVISION 56

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.6 (continued)

REQUIREMENTS Additionally. this SR must be performed within 92 days after opening the valve. The 92 day Frequency was chosen recognizing that cycling the valve could introduce additional seal degradation (beyond that occurring to a valve that has not been opened). Thus. decreasing the interval is a prudent measure after a valve has been opened.

SR 3.6.3.7 Required automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures each required automatic containment isolation valve will actuate to its isolation position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked. sealed. or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 6.2.4.

2. UFSAR. Section 6.2.6.

3. Generic Issue B-20.

4. Generic Issue B-24.

5. 10 CFR 50. Appendix J. Option B.

6. 10 CFR 50. Appendix A

7. CL Design Basis Manual

8. CRDR 106542

9. CRDR 2326591 PALO VERDE UNITS 1.2.3 B 3.6.3-19 REVISION 56

This page intentionally blank Containment Pressure B 3.6.4 BASES (continued)

ACTIONS A.l When containment pressure is not within the limits of the LCO. containment pressure must be restored to within these limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1. "Containment." which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.l and B.2 If containment pressure cannot be restored to within limits within the required Completion Time. the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that operation remains within the limits assumed in the accident analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 6.2.1

2. UFSAR. Section 7.2

3. Calculation 13-JC-HC-20l PALO VERDE UNITS 1.2.3 B 3.6.4-3 REVISION 56

This page intentionally blank Containment Air Temperature B 3.6.5 BASES (continued)

ACTIONS A.1 When containment average air temperature is not within the limit of the LCO, it must be restored to within limit within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This Required Action is necessary to return operation to within the bounds of the containment analysis.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable considering the sensitivity of the analysis to variations in this parameter and provides sufficint time to correct minor problems.

B.1 and B.2 If the containment average air temperature cannot be restored to within its limit within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.1 REQUIREMENTS Verifying that containment average air temperature is within the LCO limit ensures that containment operation remains within the limit assumed for the containment analyses. In order to determine the containment average air temperature, an arithmetic average is calculated using measurements taken at locations within the containment selected to provide a representative sample of the overall containment atmosphere.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.5-3 REVISION 56

Containment Air Temperature B 3.6.5 BASES SURVEILLANCE SR 3.6.5.1 (continued)

REQUIREMENTS The Primary containment average air temperature is determined by taking the arithmetical average of the temperatures at any five of the following locations:

a. Nominal Elevation 85'- 0" e. Nominal Elevation 145' - 0"

b. Nominal Elevation 85'- 0" f. Nominal Elevation 188' - 0"

c. Nominal Elevation 126'- 0" g. Nominal Elevation 188' - 0"

d. Nominal Elevation 126'- 0" REFERENCES l. UFSAR. Section 6.2

2. UFSAR. Section 9.4 PALO VERDE UNITS 1.2.3 B 3.6.5-4 REVISION a

Containment Spray System B 3.6.6 BASES LCO containment spray actuation signal and automatically (continued) transferring suction to the containment sump on a recirculation actuation signal. Each spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

Therefore. in the event of an accident. the minimum requirements are met. assuming that the worst case single active failure occurs.

Each Containment Spray System typically includes a spray pump. a shutdown cooling heat exchanger. spray headers.

nozzles. valves. piping. instruments. and controls to ensure an OPERABLE flow path capable of taking suction from the RWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

APPLICABILITY In MODES 1. 2. and 3. and Mode 4 with RCS pressure ~ 385 psia. a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature. requiring the operation of the containment spray trains.

In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6.

the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus. the Containment Spray System is not required to be OPERABLE in these MODES.

ACTIONS A.l With one containment spray train inoperable. the inoperable containment spray train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition. the remaining OPERABLE spray train is adequate to perform the iodine removal.

hydrogen mixing. and containment cooling functions. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant heat removal capability afforded by the Containment Spray System. reasonable time for repairs. and the low probability of a DBA occurring during this period.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.6-5 REVISION 1

Containment Spray System B 3.6.6 BASES ACTIONS B.1 and B2 (continued)

If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time. the plant must be brought to a MODE in which the LCD does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 with RCS pressure < 385 psia within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable. based on operating experience. to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 4 with RCS pressure < 385 pSia allows additional time for the restoration of the containment spray train and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.

C.1 With two containment spray trains inoperable. the unit is in a condition outside the accident analysis. Therefore.

LCD 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct alignment for manual. power operated.

and automatic valves in the containment spray flow path provides assurance that the proper flow paths will exist for Containment Spray System operation (positioned to take suction from the RWT on a containment spray actuation test signal [CSAS]). This SR does not apply to valves that are locked. sealed. or otherwise secured in position since these were verified to be in the correct position prior to being secured. This SR also does not apply to valves that cannot be inadvertently misaligned. such as check valves. This SR does not require any testing or valve manipulation. Rather.

it involves verifying. through a system walkdown. that those valves outside containment and capable of potentially being mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.6-6 REVISION 56

Containment Spray System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.2 REQUIREMENTS (continued) Verifying that the containment spray header piping is full of water to the 113 ft level minimizes the time required to fill the header. This ensures that spray flow will be admitted to the containment atmosphere within the time frame assumed in the containment analysis. The analyses shows that the header may be filled with unborated water which helps to reduce boron plate out due to evaporation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The value of 113 ft is an indicated value which accounts for instrument uncertainty.

SR 3.6.6.3 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by the ASME OM Code (Ref. 6). Since the containment spray pumps cannot be tested with flow through the spray headers. they are tested on recirculation flow (either full flow or miniflow as conditions permit). This test is indicative of overall performance. Such inservice inspections confirm component OPERABILITY. trend performance. and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.6-7 REVISION 56

Containment Spray System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 and SR 3.6.6.5 REQUIREMENTS (continued) These SRs verify that each automatic containment spray valve actuates to its correct position and that each containment spray pump starts upon receipt of an actual or simulated safety injection actuation signal. recirculation actuation signal and containment spray actuation signal as applicable.

This Surveillance is not required for valves that are locked. sealed. or otherwise secured in the required position under administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The surveillance of containment sump isolation valves is also required by SR 3.5.3.5. A single surveillance may be used to satisfy both requirements.

SR 3.6.6.6 Unobstructed flow headers and nozzles are determined by either flow testing or visual inspection.

With the containment spray inlet valves closed and the spray header drained of any solution. low pressure air or smoke can be blown through test connections. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.6-8 REVISION 56

ADVs B 3.7.4 BASES ACTIONS C.1 and C.2 (continued)

If the ADV lines cannot be restored to OPERABLE status within the associated Completion Time. the unit must be placed in a MODE in which the LCD does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 4. without reliance on the steam generator for heat removal. within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the RCS. the ADVs must be able to be opened and throttled through their full range.

This SR ensures the ADVs are tested through a full control cycle at least once per fuel cycle. Performance of inservice testing or use of an ADV during a unit cooldown may satisfy this requirement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 10.3.

PALO VERDE UNITS 1.2.3 B 3.7.4-5 REVISION 56

This page intentionally left blank AFW System B 3.7.5 BASES ACTIONS C.1 and C.2 (continued)

When either Required Action A.1 or B.1 cannot be completed within the required Completion Time. or if two AFW trains are inoperable in MODES 1. 2. and 3. the unit must be placed in a MODE in which the LCO does not apply.

To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

This Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply to the turbine driven AFW pump is inoperable. coincident with another ("B" or "N") AFW train inoperable.

The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In MODE 4. with two AFW trains inoperable. operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO. Although it is not required. the unit may continue to cool down and start the SOC.

0.1 Required Action 0.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the conditions is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With all three AFW trains inoperable in MODES 1. 2. and 3.

the unit is in a seriously degraded condition with no TS related means for conducting a cooldown. and only limited means for conducting a cool down with nonsafety grade equipment. In such a condition. the unit should not be perturbed by any action. including a power change. that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. LCD 3.0.3 is not applicable.

as it could force the unit into a less safe condition.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.5-7 REVISION 9

AFW System B 3.7.5 BASES ACTIONS E.1 (continued)

Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the Condition is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With one AFW train inoperable. action must be taken to immediately restore the inoperable train to OPERABLE status or to immediately verify. by administrative means. the OPERABILITY of a second train. LCO 3.0.3 is not applicable.

as it could force the unit into a less safe condition.

In MODE 4. either the reactor coolant pumps or the SOC loops can be used to provide forced circulation as discussed in LCO 3.4.6. "RCS Loops - MODE 4."

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual. power operated.

and automatic valves in the AFW water and steam supply flow paths provides assurance that the proper flow paths exist for AFW operation. This SR does not apply to valves that are locked. sealed. or otherwise secured in position. since these valves are verified to be in the correct position prior to locking. sealing. or securing. This SR also does not apply to valves that cannot be inadvertently misaligned.

such as check valves. This Surveillance does not require any testing or valve manipulations; rather. it involves verification that those valves capable of potentially being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are (continued)

PALO VERDE UNITS 1.2.3 B 3.7.5-8 REVISION 56

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.2 (continued)

REQUIREMENTS normal tests of pump performance required by the ASME OM Code (Ref. 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating. this testing may be performed on recirculation flow. This test confirms one point on the pump design curve and can be indicative of overall performance. Such inservice tests confirm component OPERABILITY. trend performance. and detect incipient failures by indicating abnormal performance.

Performance of inservice testing. discussed in the ASME OM Code. (Ref. 2). at 3 month intervals satisfies this requirement.

This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions are established.

Normal operating pressure is established in the steam generators when RCS temperature reaches 532°F. this corresponds to a P~t of 900 psia. This deferral is required because there is an insufficient steam pressure to perform the test.

SR 3.7.5.3 This SR ensures that AFW can be delivered to the appropriate steam generator. in the event of any accident or transient that generates an AFAS signal. by demonstrating that each automatic valve in the flow path actuates to its correct position on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked.

sealed. or otherwise secured in the required position under administrative controls. This SR is not required for the non-essential train since there are no automatic valves which receive an AFAS. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note indicating that the SR should be deferred until suitable test conditions have been established. Normal operating pressure is established in the steam generators when RCS temperature reaches 532°F.

this corresponds to a Ps~ of 900 psia. This deferral is required because there is an insufficient steam pressure to perform the test.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.5-9 REVISION 56

AFW System B 3.7.5 BASES SURVEILLANCE SR 3.7.5.3 (continued)

REQUIREMENTS Also. this SR is modified by a Note that states the SR is not required in MODE 4. In MODE 4. the required AFW train is already aligned and operating.

SR 3.7.5.4 This SR ensures that the essential AFW pumps will start in the event of any accident or transient that generates an AFAS signal by demonstrating that each essential AFW pump starts automatically on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The non-essential AFW pump does not automatically activate and is not subject to this SR.

This SR is modified by two Notes. Note 1 indicates that the SR be deferred until suitable test conditions are established. Normal operating pressure is established in the steam generators when RCS temperature reaches 532°F.

this corresponds to a Psat of 900 psia. This deferral is required because there is insufficient steam pressure to perform the test. Note 2 states that the SR is not required in MODE 4. In MODE 4. the required pump is already operating and the autostart function is not required.

SR 3.7.5.5 This SR ensures that the AFW System is properly aligned by verifying the flow path from each essential AFW pump to each steam generator prior to entering MODE 2 operation. after 30 days in MODE 5 or 6. OPERABILITY of essential AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable.

based on engineering judgment. and administrative controls to ensure that flow paths remain OPERABLE.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.5-10 REVISION 56

CST B 3.7.6 BASES APPLICABILITY In MODES 1. 2. and 3. and in MODE 4. when steam generator is being relied upon for heat removal. the CST is required to be OPERABLE.

In MODES 5 and 6. the CST is not required because the AFW System is not required.

ACTIONS A.l and A.2 If the CST level is not within the limit. the OPERABILITY of the backup water supply (RMWT) must be verified within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

OPERABILITY of the RMWT must include initial alignment and verification of the OPERABILITY of flow paths from the RMWT to the AFW pumps. and availability of sufficient total water inventory using the combined CST and RMWT inventories to satisfy the requirements of long-term cooling event which includes both LOCA Long-Term Cooling and Reactor Systems Branch Technical Position 5-1 (RSB 5-1). The CST level must be returned to OPERABLE status within 7 days. as the RMWT may be performing this function in addition to its normal functions. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable. based on operating experience. to verify the OPERABILITY of the RMWT. The 7 day Completion Time is reasonable. based on an OPERABLE RMWT being available. and the low probability of an event requiring the use of the water from the CST occurring during this period.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.6-3 REVISION 55

CST B 3.7.6 BASES ACTIONS B.1 and B.2 (continued)

If the CST cannot be restored to OPERABLE status within the associated Completion Time. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 4. without reliance on steam generator for heat removal. within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that the CST contains the required volume of cooling water. (This level ~ 29.5 ft (300.000 gallons)).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.2.6.

2. UFSAR. Chapter 6.

3. UFSAR. Chapter 15.

4. NRC Standard Review Plan Branch Technical Pas iti on (BTP) RSB 5-1.

PALO VERDE UNITS 1.2.3 B 3.7.6-4 REVISION 56

EW System B 3.7.7 BASES LCO (continued) not acceptable and would render both the EW System and the SOC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

APPLI CAB ILITY In MODES 1. 2. 3. and 4. the EW System must be prepared to perform its post accident safety functions. primarily RCS heat removal by cooling the SOC heat exchanger.

When the plant is in other than MODES 1. 2. 3 or 4. the requirements for the EW System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.1 Required Action A.1 is modified by a Note indicating the requirement of entry into the applicable Conditions and Required Actions of LCO 3.4.6. "RCS Loops - MODE 4." for SOC made inoperable by EW. This note is only applicable in Mode

4. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

With one EW train inoperable. action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition.

the remaining OPERABLE EW train is adequate to perform the heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train. and the low probability of a DBA occurring during this period.

B.1 and B.2 If the EW train cannot be restored to OPERABLE status within the associated Completion Time. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.7-3 REVISION 1

EW System B 3.7.7 BASES ACTIONS B.1 and B.2 (continued)

The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual. power operated.

and automatic valves in the EW flow path provides assurance that the proper flow paths exist for EW operation. This SR does not apply to valves that are locked. sealed. or otherwise secured in position. since these valves are verified to be in the correct position prior to locking.

sealing. or securing. This SR also does not apply to valves that cannot be inadvertently misaligned. such as check valves. This Surveillance does not require any testing or valve manipulation; rather. it involves verification that those valves capable of potentially being mispositioned are in their correct position.

This SR is modified by a Note indicating that the isolation of the EW components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the EW System. Isolation of the EW System to the Essential Chiller. while rendering the Essential Chiller inoperable. is acceptable and does not impact the OPERABILITY of the EW System. Isolation of the EW System to the SOC system heat exchanger is not acceptable and would render both the EW System and the SOC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.2 This SR verifies proper automatic operation of the EW valves on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked.

sealed. or otherwise secured in the required position under (continued)

PALO VERDE UNITS 1.2.3 B 3.7.7-4 REVISION 56

EW System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.2 (continued)

REQUIREMENTS administrative controls. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.3 This SR verifies proper automatic operation of the EW pumps on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.2.2.

2. UFSAR. Secti on 9.2.1.

3. CRDR 980794 PALO VERDE UNITS 1.2.3 B 3.7.7-5 REVISION 56

This page intentionally blank ESPS B 3.7.8 BASES ACTIONS A.1 With one ESPS train inoperable. action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition.

the remaining OPERABLE ESPS train is adequate to perform the heat removal function. However. the overall reliability is reduced because a single failure in the ESPS train could result in loss of ESPS function. Required Action A.1 is modified by two Notes. The first Note indicates that the 0 applicable Conditions of LCO 3.8.1. °AC Sources - Operating.

must be entered when the inoperable ESPS train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6. oRCS Loops - MODE 4.0 should be entered if an inoperable ESPS train results in an inoperable SOC System. This note is only applicable in MODE 4. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train. and the low probability of a DBA occurring during this time period.

B.1 and B.2 If the ESPS train cannot be restored to OPERABLE status within the associated Completion Time. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual and power operated. valves in the ESPS flow path ensures that the proper flow paths exist for ESPS operation. This SR does not apply to valves that are locked. sealed. or otherwise secured in position. since they are verified to be in the correct position prior to locking. sealing. or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned. such as check valves. This (continued)

PALO VERDE UNITS 1.2.3 B 3.7.8-3 REVISION 1

ESPS B 3.7.8 BASES SURVEILLANCE SR 3.7.8.1 (continued)

REQUIREMENTS Surveillance does not require any testing or valve manipulation; rather. it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR is modified by a Note indicating that the isolation of the ESPS components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the ESPS. Isolation of the ESPS to the Diesel Generator (DG) cooler(s). while rendering the DG inoperable. is acceptable and does not impact the OPERABILITY of the ESPS. Isolation of the ESPS to the essential cooling water heat exchanger is not acceptable and would render both the Essential Cooling Water System and the ESPS inoperable (Ref. 3). The ESPS is inoperable in this situation because it is operating outside of the acceptable limits of the system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.8.2 The SR verifies proper automatic operation of the ESPS pumps on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.2.1.

2. UFSAR. Section 5.4.7.

3. CRDR 980795 PALO VERDE UNITS 1.2.3 B 3.7.8-4 REVISION 56

UHS B 3.7.9 BASES (continued)

SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR verifies adequate long term (26 days) cooling can be maintained with no makeup. The level specified also ensures sufficient NPSH is available for operating the ESPS pumps.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. A usable water depth of 12 feet requires 13'-6" of actual water depth. The implementing procedure requires the operator to verify that the level is greater than or equal to 13'-6" measured locally at the spray pond or 14' indicated in the control room using installed instrumentation. The difference is a result of instrument uncertainty.

SR 3.7.9.2 This SR verifies that the ESPS is available to cool the EW System to at least its maximum design temperature within the maximum accident or normal design heat loads for 26 days following a DBA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.2.5.

2. Regulatory Guide 1.27.

PALO VERDE UNITS 1.2.3 B 3.7.9-3 REVISION 56

This page intentionally blank EC System B 3.7.10 BASES APPLICABILITY (continued) When the plant is in other than MODES 1. 2. 3 or 4. the requirements for the EC System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.1 If one EC train is inoperable. action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition.

one OPERABLE ECW train is adequate to perform the cooling function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable. based on the low probability of an event occurring during this time and the 100% capacity OPERABLE EC train.

B.1 and B.2 If the EC train cannot be restored to OPERABLE status within the associated Completion Time. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Verifying the correct alignment for manual. power operated.

and automatic valves in the EC flow path provides assurance that the proper flow paths exist for EC operation. This SR does not apply to valves that are locked. sealed. or otherwise secured in position. since they are verified to be in the correct position prior to locking. sealing. or securing. This SR also does not apply to valves that cannot be inadvertently misaligned. such as check valves. This Surveillance does not require any testing or valve manipulation; rather. it involves verification that those valves capable of potentially being mispositioned are in the correct position.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.10-3 REVISION 1

EC System B 3.7.10 BASES SURVEILLANCE SR 3.7.10.1 (continued)

REQUIREMENTS The isolation of the EC System from other components or systems renders those components or systems inoperable, but does not necessarily affect the OPERABILITY of the EC System. Isolation of the EC System to any single EC supplied cooling coil, while rendering the cooling coil inoperable, is acceptable and does not impact the OPERABILITY of the EC System. Isolation of the EC System to any additional cooling coil is not acceptable without an engineering evaluation and an operability determination for that configuration (Ref. 2). The EC System is inoperable in this situation, unless it has been specifically evaluated, because it is operating outside of the acceptable limits of the system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.10.2 This SR verifies proper automatic operation of the EC System components and that the EC pumps will start in the event of any accident or transient that generates an applicable ESFAS signal. This SR also ensures that each automatic valve in the flow paths actuates to its correct position on an actual or simulated ESFAS signal.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 9.2.9.

2. CRDR 980796 PALO VERDE UNITS 1,2,3 B 3.7.10-4 REVISION 56

CREFS B 3.7.11 BASES ACTIONS E.l and E.2 (continued)

An alternative to Required Action E.l is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

F.l and F.2 If two CREFS trains become inoperable for reasons other than an inoperable CRE boundary or one or more CREFS trains become inoperable due to an inoperable CRE boundary, during Mode 5 or 6, or during the movement of irradiated fuel assemblies, immediate action must be taken to suspend activities that could release radioactivity that might enter the CRE. The Required Actions place the unit in a condition that minimizes accident risk. These actions do not preclude movement of fuel assemblies to safe positions.

G.l If both {REFS trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary (i.e.,

Condition B), the CREFS may not be capable of performing the intended function and the unit is in a condition outside the accident analyses. Therefore, LCD 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.11.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. Since the environment and normal operating conditions on this system are not severe, testing each train once every month provides an adequate check on this system.

Monthly operations for ~ 15 minutes to demonstrate the function of the system is required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.11-7 REVISION 56

CREFS B 3,7.11 BASES SURVEILLANCE SR 3.7.11.2 REQUIREMENTS (continued) This SR verifies that the required CREFS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The CREFS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 5). The VFTP includes testing HEPA filter performance. charcoal adsorber efficiency. minimum system flow rate. and the physical properties of the activated charcoal (general use and following specific operations). Specific test Frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.11.3 This SR verifies that each CREFS train starts and operates on an actual or simulated actuation signal. This includes verification that the system is automatically placed into a filtration mode of operation with flow through the HEPA filters and charcoal adsorber banks. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.11.4 This SR verifies the operability of the CRE boundary by testing for unfiltered air inleakage past the CRE bouhdary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose of CRE occupants calculated in the licensing basis analyses of DBA consequences is no more than 5 rem whole body or its equivalent to any part of the body and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate. Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.

Compensatory measures are discussed in Regulatory Guide 1.196. Section C.2.7.3. (Ref 6) which endorses. with exceptions. NEI 99-03. Section 8.4 and Appendix F (Ref. 7).

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.11-8 REVISION 56

CREATCS B 3.7.12 BASES (continued)

ACTIONS B.1 and B.2 (continued)

In MODE 1. 2. 3. or 4. when Required Action A.1 cannot be completed within the required Completion Time. the unit must be placed in a MODE that minimizes the accident risk. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 In MODE 5 or 6. if Required Action A.1 cannot be completed within the required Completion Time. the OPERABLE CREATCS train must be placed in operation immediately (including supporting systems. This action ensures that the remaining train is OPERABLE. that no failures preventing automatic actuation will occur. and that any active failure will be readily detected.

D.1 and D.2 During movement of irradiated fuel assemblies. if Required Action A.1 cannot be completed within the Required Completion Time. the OPERABLE CREATCS train must be placed in operation immediately (including supporting systems) or movement of irradiated fuel assemblies must be suspended immediately. The first action ensures that the remaining train is OPERABLE.

that no undetected failures preventing system operation will occur. and that any active failure will be readily detected.

If the system is not immediately placed in operation. this action requires suspension of the movement of irradiated fuel assemblies in order to minimize the risk of a release of radioactivity that might require isolation of the control room. This does not preclude the movement of fuel to a safe position.

E.1 and E.2 In MODE 5 or 6. or during movement of irradiated fuel assemblies with two CREATCS trains inoperable. action must be taken immediately to suspend activities that could result in a release of radioactivity that might require isolation of the control room. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.12-3 REVISION 55

CREATes B 3.7.12 BASES ACTIONS F.1 (continued)

If both CREATCS trains are inoperable in MODE 1. 2. 3. or 4.

the CREATCS may not be capable of performing the intended function and the unit is in a condition outside the accident analysis. Therefore. LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.12.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to meet design requirements. This SR consists of a combination of testing and calculations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.4.

PALO VERDE UNITS 1.2.3 B 3.7.12-4 REVISION 56

ESF PREACS B 3.7.13 BASES LCO c. Heater. prefilter. ductwork. valves. and dampers are (continued) OPERABLE. and air circulation can be maintained.

In addition. the auxiliary building envelope below the 100 ft. elevation must be maintained. including the integrity of the walls. floors. ceilings. ductwork.

and access doors.

APPLICABILITY In MODES 1. 2. 3. and 4. the ESF PREACS is required to be OPERABLE consistent with the OPERABILITY requirements of the ECCS.

In MODES 5 and 6. the ESF PREACS is not required to be OPERABLE. since the ECCS is not required to be OPERABLE.

ACTIONS A.1 With one ESF PREACS train inoperable. action must be taken to restore OPERABLE status within 7 days. During this time.

the remaining OPERABLE train is adequate to perform the ESF PREACS function.

The 7 day Completion Time is appropriate because the risk contribution is less than that for the ECCS (72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time) and this system is not a direct support system for the ECCS. The 7 day Completion Time is reasonable. based on the low probability of a DBA occurring during this time period. and the consideration that the remaining train can provide the required capability.

B.1 and B.2 If the ESF PREACS train cannot be restored to OPERABLE status within the associated Completion Time. the unit must be in a MODE in which the LCO does not apply. To achieve this status. the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.13-3 REVISION 0

ESF PREACS B 3.7.13 BASES (continued)

SURVEILLANCE SR 3.7.13.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. Since the environment and normal operating conditions on this system are not severe.

testing each train once a month provides an adequate check on this system.

Operations for ~ 15 minutes demonstrates the function of the system. There is not expected to be any moisture buildup on the adsorbers and HEPA filters due to the low humidity at PVNGS (Ref. 7). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.13.2 This SR verifies that the required ESF PREACS testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The ECCS PREACS filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4). The VFTP includes testing HEPA filter performance. charcoal adsorber efficiency. minimum system flow rate. and the physical properties of the activated charcoal (general use and following specific operations). Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.13.3 This SR verifies that each ESF PREACS train starts and operates on an actual or simulated actuation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.13.4 This SR verifies the integrity of the ESF envelope. The ability of the ESF envelope to maintain a negative pressure.

with respect to potentially uncontaminated adjacent areas.

is periodically tested to verify proper function of the ESF PREACS. During the post accident mode of operation. the ESF PREACS is designed to maintain a slight negative pressure in the ESF envelope with respect to adjacent areas to prevent unfiltered LEAKAGE. For the purposes of testing. the term (continued)

PALO VERDE UNITS 1.2.3 B 3.7.13-4 REVISION 56

ESF PREACS B 3.7.13 BASES SURVEILLANCE SR 3.7.13.4 (continued)

REQUIREMENTS "measurable negative pressure" is defined as 10 times the minimum instrument reading. The ESF PREACS is designed to maintain this negative pressure at a flow rate of 6.000 cfm +/- 10% from the ESF envelope. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Sect ion 6. 5. 1.

2. UFSAR. Section 9.4.2.

3. UFSAR. Section 15.6.5.

4. Regulatory Guide 1.52 (Rev. 2) .

5. 10 CFR 100.11.

6. NUREG-OBOO. Section 6.5.1. Rev. 2. July 19B1.

7. UFSAR. Section 1.B PALO VERDE UNITS 1.2.3 B 3.7.13-5 REVISION 56

This page intentionally blank Fuel Storage Pool Water Level B 3.7.14 BASES (continued)

SURVEILLANCE SR 3.7.14.1 REQUIREMENTS This SR verifies sufficient fuel storage pool water is available in the event of a fuel handling accident. The water level in the fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

During refueling operations. the level in the fuel storage pool is at equilibrium with that of the refueling canal. and the level in the refueling canal is checked daily in accordance with LCO 3.9.6. "Refueling Water Level-Fuel As semb 1i es" .

REFERENCES 1. UFSAR. Secti on 9.1. 2.

2. UFSAR. Section 9.1.3.

3. UFSAR. Section 15.7.4.

4. Regulatory Guide 1.25

5. 10 FR 100.11.

PALO VERDE UNITS 1.2.3 B 3.7.14-3 REVISION 56

This page intentionally blank Fuel Storage Pool Boron Concentration B 3.7.15 B 3.7 PLANT SYSTEMS B 3.7.15 Fuel Storage Pool Boron Concentration BASES BACKGROUND As described in LCD 3.7.17. "Spent Fuel Assembly Storage."

fuel assemblies are stored in the spent fuel racks in accordance with criteria based on initial enrichment and discharge burnup. Although the water in the spent fuel pool is normally borated to ~ 2150 ppm. the criteria that limit the storage of a fuel assembly to specific rack locations is conservatively developed without taking credit for boron.

In order to maintain the spent fuel pool keff < 1.0. a soluble boron concentration of 900 ppm is required to maintain the spent fuel pool keff S 0.95 assuming the most limiting single fuel mishandling accident.

APPLICABLE A fuel assembly could be inadvertently loaded into a spent SAFETY ANALYSES fuel rack location not allowed by LCD 3.7.17 (e.g .. an unirradiated fuel assembly or an insufficiently depleted fuel assembly). Another type of postulated accident is associated with a fuel assembly that is dropped onto the fully loaded fuel pool storage rack or between a rack and the pool walls. These incidents could have a positive reactivity effect. decreasing the margin to criticality.

However. the negative reactivity effect of the soluble boron compensates for the increased reactivity caused by these postulated accident scenarios.

The concentration of dissolved boron in the fuel pool satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCD The specified concentration of dissolved boron in the fuel pool preserves the assumptions used in the analyses of the potential accident scenarios described above. This concentration of dissolved boron is the minimum required concentration for fuel assembly storage and movement within the fuel pool.

APPLICABILITY This LCD applies whenever any fuel assembly is stored in the spent fuel pool in order to comply with the TS 4.3.1.1.c design requirement that keff S 0.95.

(continued)

PALO VERDE UNITS 1.2.3 B 3.7.15-1 REVISION 3

Fuel Storage Pool Boron Concentration B 3.7.15 BASES (continued)

ACTIONS A.l and A.2 The Required Actions are modified by a Note indicating that LCO 3.0.3 does not apply.

When the concentration of boron in the spent fuel pool is less than required. immediate action must be taken to preclude an accident from happening or to mitigate the consequences of an accident in progress. This is most efficiently achieved by immediately suspending the movement of fuel assemblies. This does not preclude the movement of fuel assemblies to a safe position. In addition. action must be immediately initiated to restore boron concentration to within limit.

If moving fuel assemblies while in MODE 5 or 6. LCO 3.0.3 would not specify any action. If moving fuel assemblies while in MODE 1. 2. 3. or 4. the fuel movement is independent of reactor operation. Therefore. inability to suspend movement of fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.15.1 REQUIREMENTS This SR verifies that the concentration of boron in the spent fuel pool is within the required limit. As long as this SR is met. the analyzed incidents are fully addressed.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 9.1.2.

2. PVNGS Operating License Amendments 82. 69 and 54 for Units 1. 2 and 3. respectively. and associated NRC Safety Evaluation dated September 30. 1994.

3. 13-N-001-1900-1221-1. ~Palo Verde Spent Fuel Pool Criticality Analysis.~ ABB calculation A-PV-FE-OI06.

revision 3. dated January 15. 1999.

PALO VERDE UNITS 1.2.3 B 3.7.15-2 REVISION 56

Secondary Specific Activity B 3.7.16 BASES (continued)

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators are not being used for heat removal. Both the RCS and steam generators are depressurized, and primary to secondary LEAKAGE is minimal.

Therefore, monitoring of secondary specific activity is not required.

ACTIONS A.l and A.2 DOSE EQUIVALENT 1-131 exceeding the allowable value in the secondary coolant, is an indication of a problem in the RCS, and contributes to increased post accident doses. If secondary specific activity cannot be restored to within limits in the associated Completion Time, the unit must be placed in a MODE in which the LCD does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.16.1 REQUIREMENTS This SR ensures that the secondary specific activity is within the limits of the accident analysis. A gamma isotope analysis of the secondary coolant, which determines DOSE EQUIVALENT 1-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in reactor coolant activity or LEAKAGE. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.16-3 REVISION 56

Secondary Specific Activity B 3.7.16 BASES REFERENCES 1. 10 CFR 100.11.

2. UFSAR. Chapter 15.

PALO VERDE UNITS 1.2.3 B 3.7.16-4 REVISION 0

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE The required steady state frequency range for the DG is REQUIREMENTS 60 +0.7/-0.3 Hz to be consistent with the safety analysis to (continued) provide adequate safety injection flow. In accordance with the guidance provided in Regulatory Guide 1.9 (Ref. 3).

where steady state conditions do not exist (i .e ..

transients). the frequency range should be restored to within +/- 2% of the 60 Hz nominal frequency (58.8 Hz to 61.2 Hz) and the voltage range should be restored to within +/- 10%

of the 4160 volts nominal voltage (3740 volts to 4580 volts). The timed start is satisfied when the DG achieves at least 3740 volts and 58.8 Hz. At these values.

the DG output breaker permissives are satisfied. and on detection of bus undervoltage or loss of power. the DG breakers would close. reenergizing its respective ESF bus.

Steady state and transient voltage and frequency limits have not been adjusted for instrument accuracy. Error values for specific instruments are established by plant staff to derive the indicated values for the steady state and transient voltage and frequency limits.

Specific MODE restraints have been footnoted where applicable to each 18 month SR. The reason for "This Surveillance shall not be performed in MODE 1 or 2" is that during operation with the reactor critical. performance of this SR could cause perturbations to the EDS that could challenge continued steady state operation and. as a result.

unit safety systems; or that performing the SR would remove a required DG from service. The reason for "This Surveillance shall not be performed in MODE 1. 2. 3. or 4" is that performing this SR would remove a required offsite circuit from service. perturb the EDS. and challenge safety systems.

SR 3.8.1.1 This SR assures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and indicated availability of offsite AC electrical power.

The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source. and that appropriate independence of offsite circuits is maintained.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-23 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 REQUIREMENTS (continued) These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs are modified by a Note to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are started from standby condition. Standby conditions for a DG mean that the engine lube oil and coolant temperatures are maintained consistent with manufacturer recommendations. Additionally, during standby conditions the diesel engine lube oil is circulated continuously and the engine coolant is circulated on and off via thermostatic control.

In order to reduce stress and wear on diesel engines, the DG manufacturer recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. This is the intent of Note 3, which is only applicable when such modified start procedures are recommended by the manufacturer.

SR 3.8.1.2 Note 4 and SR 3.8.1.7 Note 2 state that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy.

The analyzed values for the steady-state diesel generator voltage limits are ~ 4000 and s 4377.2 volts and the analyzed values for the steady-state diesel generator frequency limits are ~ 59.7 and s 60.7 hertz. The indicated steady state diesel generator voltage and frequency limits, using the panel mounted diesel generator instrumentation and adjusted for instrument error, are ~ 4080 and s 4300 volts (Ref. 12), and ~ 59.9 and s 60.5 hertz (Ref. 13),

respectively. If digital Maintenance and Testing Equipment (M&TE) is used instead of the panel mounted diesel generator instrumentation, the instrument error may be reduced, increasing the range for the indicated steady state voltage and frequency limits.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-24 REVISION 50

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS SR 3.8.1.7 requires that the DG starts from standby conditions with the engine at normal keep-warm conditions and achieves required voltage and frequency within 10 seconds, and subsequently achieves steady state required voltage and frequency ranges. The 10 second start requirement supports the assumptions of the design basis LOCA analysis in the FSAR, Chapter 15 (Ref. 5).

A minimum voltage and frequency is specified rather than an upper and a lower limit because a diesel engine acceleration at full fuel (such as during a fast start) is likely to "overshoot" the upper limit initially and then go through several oscillations prior to a voltage and frequency within the stated upper and lower bounds. The time to reach "steady state" could exceed 10 seconds, and be cause to fail the SR. However, on an actual emergency start, the EDG would reach minimum voltage and frequency in ~ 10 seconds at which time it would be loaded. Application of the load will dampen the oscillations. Therefore, only specifying the minimum voltage and frequency (at which the EDG can accept load) demonstrates the necessary capability of the EDG to satisfy safety requirements without including a potential for failing the Surveillance. Error values for specific instruments are established to derive indicated values in test procedures.

While reaching minimum voltage and frequency (at which the DG can accept load) in ~ 10 seconds is an immediate test of OPERABILITY, the ability of the governor and voltage regulator to achieve steady state operation, and the time to do so are important indicators of continued OPERABILITY.

Therefore, the time to achieve steady state voltage and frequency will be monitored as a function of continued OPERABILITY.

The 10 second start requirement is not applicable to SR 3.8.1.2 (see Note 3) when a modified start procedure as described above is used. If a modified start is not used, 10 second start requirement of SR 3.8.1.7 applies. The existing design for a CSAS actuation signal does not provide an emergency mode start to the DG. A CSAS actuation signal cannot occur until after a SIAS actuation signal has already been generated.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-25 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.7 (continued)

REQUIREMENTS Since SR 3.8.1.7 requires a 10 second start. it is more restrictive than SR 3.8.1.2. and it may be performed in lieu of SR 3.8.1.2. This is the intent of Note 1 of SR 3.8.1.2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.3 This Surveillance verifies that the OGs are capable of synchronizing with the offsite electrical system and accepting loads of 90 to 100 percent (4950 - 5500 kW) of the continuous rating of the DG. Consistent with the guidance provided in the Regulatory Guide 1.9 (Ref. 3) load-run test description. the 4950 - 5500 kW band will demonstrate 90 to 100 percent of the continuous rating of the DG. The load band (4950 - 5500 kW) is meant as guidance to avoid routine overloading of the engine. Loads in excess of this band for special testing may be performed within the guidance of the generator capability curve.

A minimum run time of 60 minutes is required to stabilize engine temperatures. while minimizing the time that the DG is connected to the offsite source.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by four Notes. Note 1 indicates that diesel engine runs for this Surveillance may include gradual loading. as recommended by the manufacturer. so that mechanical stress and wear on the diesel engine are minimized. Note 2 states that momentary transients because of changing bus loads do not invalidate this test. Note 3 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 4 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-26 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.4 REQUIREMENTS (continued) This SR verifies that there is enough usable fuel oil in the DG Day Tank to run the diesel generator at full load for a minimum of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months plus 10%. The surveillance is on fuel level since there is no direct indicator of volume. Level is read in feet on the Main Control Board indicators or in equivalent units on local DG instrumentation.

The source for the run-time requirement is the UFSAR Sec. 1.8 and Question 9A.9 commitment to ANSI N195-1976. That standard refers to the level at which fuel is automatically added to the tank. For the DG Day Tanks the "pump start" level is above the SR and so is additionally conservative.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1. 5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling. but all must have a water environment in order to survive. Removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition. it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources. including condensation. ground water. rain water.

contaminated fuel oil. and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-27 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 REQUIREMENTS (continued) This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. This is required to support continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.7 See SR 3.8.1.2.

SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit distribution network to power the auto-connected emergency loads. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the surveillance in MODE 1 or 2 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-28 REVISION 56

AC Sources - Operating B 3.B.1 BASES SURVEILLANCE REQUIREMENTS SR 3.B.1.B (continued)

OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed surveillance. a successful surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.B.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed. which. if excessive. might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load. or equivalent load. without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. Train A Normal Water Chiller (less than 925 kw) and Train B AFW pump (less than 1000 kw) are the bounding loads for DG A and DG B to reject. respectively. These values were established in references 14 through 17. This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.

As required by IEEE-30B (Ref. 11). the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint. or 15% above synchronous speed.

whichever is lower.

(continued)

PALO VERDE UNITS 1.2.3 B 3.B.1-29 REVISION 53

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS The time. voltage. and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recommendations for response during load sequence intervals.

The 3 seconds specified is equal to 60% of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the OG. SR 3.8.1.9.a corresponds to the maximum frequency excursion. while SR 3.8.1.9.b and SR 3.8.1.9.c are the voltage and frequency values the system must meet.

within three seconds. following load rejection. Error values for specific instruments are established to derive indicated values in test procedures. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing this SR would remove a required offsite circuit from service. perturb the EOS. and challenge safety systems. This SR is performed in emergency mode (not paralleled to the grid) ensuring that the DG is tested under load conditions that are as close to design basis conditions as possible. This restriction from normally performing the surveillance in Mode 1. 2. 3. or 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification.

deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines that plant safety is maintained or enhanced.

This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed surveillance. a successful surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance: as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1. 2. 3. or 4. Risk insights or deterministic methods may be used for this assessment.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-30 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS The following compensatory measures shall be implemented prior to the performance of this SR in MODE 1 or 2:

a. Weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.

b. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit performing this SR.

c. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled. Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded approach according to risk significance.

SR 3.8.1.10 This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine generator load response under the simulated test conditions. This test simulates the loss of the total connected load that the DG experiences following a full load rejection and verifies that the DG will not trip upon loss of the load. These acceptance criteria provide DG damage protection. While the DG is not expected to experience this transient during an event and continues to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-31 REVISION 50

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible. testing is performed using design basis kW loading and maximum kVAR loading permitted during testing. These loads represent the inductive loading that the DG would experience to the extent practicable and is consistent with the guidance of Regulatory Guide 1.9 (Ref. 3). Consistent with the guidance provided in the Regulatory Guide 1.9 full-load rejection test description. the 4950 - 5500 kW band will demonstrate the DG's capability to reject a load equal to 90 to 100 percent of its continuous rating. Error values for specific instruments are established to derive indicated values in test procedures. Administrative limits have been placed upon the Class 1E 4160 V buses due to high voltage concerns. As a result power factors deviating much from unity are currently not possible when the DG runs parallel to the grid while the plant is shutdown. To the extent practicable. VARs will be provided by the DG during this SR.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. This Note ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power. testing should be performed at a lagging power factor of ~ 0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. This power factor should be able to be achieved when performing this SR at power and synchronized with offsite power by transferring house loads from the auxiliary transformer to the startup transformer in order to lower the Class 1E bus voltage. Under certain conditions. however. Note 2 allows the surveillance to be conducted at a power factor other than ~ 0.89. These conditions occur when grid voltage is high. and the additional field excitation needed to get the power factor to ~ 0.89 results in voltages on the emergency busses that are too high. This would occur when performing this SR while shutdown and the loads on the startup transformer are too light to lower the voltage sufficiently to achieve a 0.89 power factor. Under these conditions. the power factor (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-32 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.89 may not cause unacceptable voltages.on the emergency busses, but the excitation levels are in excess of those recommended for the DG. In such cases, the power factor shall be maintained as close as practicable to 0.89 without exceeding DG excitation limits.

The following compensatory measures shall be implemented prior to the performance of this SR in MODE 1 or 2:

a. Weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.

b. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit performing this SR.

c. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled. Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded approach according to risk significance.

SR 3.8.1.11 As required by Regulatory Guide 1.9 (Ref. 3),

paragraph 2.2.4, this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-33 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS shedding of the nonessential loads and energization of the emergency buses and respective loads from the DG. It further demonstrates the capability of the DG to automatically achieve the required voltage and frequency within the specified time.

The DG auto-start time of 10 seconds is derived from requirements of the accident analysis. The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved.

The requirement to verify the connection and power supply of permanent and auto-connected emergency loads is intended to satisfactorily show the relationship of these loads to the DG loading logic. In certain circumstances. many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance. Emergency Core Cooling Systems (ECCS) injection valves are not desired to be stroked open. high pressure injection systems are not capable of being operated at full flow. or shutdown cooling (SOC) systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads. testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential. overlapping. or total steps so that the entire connection and loading sequence is verified to the extent possible ensuring power is available to the component.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by four Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service. perturb the electrical distribution system. and challenge safety systems. This restriction from normally performing the (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-34 REVISION 56

AC Sources - Operating B 3.B.1 BASES SURVEILLANCE SR 3.B.1.11 (continued)

REQUIREMENTS surveillance in MODE 1. 2. 3. and 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification. deficient or incomplete surveillance testing.

and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with the failed partial surveillance. a successful partial surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance: as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1. 2. 3.

or 4. Risk insights or deterministic methods may be used for this assessment. Note 3 states that momentary voltage and frequency transients induced by load changes do not invalidate this test. Note 4 states that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy. The analyzed values for the steady-state diesel generator voltage limits are ~ 4000 and ~ 4377.2 volts and the analyzed values for the steady-state diesel generator frequency limits are ~

59.7 and ~ 60.7 hertz. The indicated steady state diesel generator voltage and frequency limits. using the panel mounted diesel generator instrumentation and adjusted for instrument error. are ~ 40BO and ~ 4300 volts (Ref. 12). and

~ 59.9 and ~ 60.5 hertz (Ref. 13). respectively. If digital Maintenance and Testing Equipment (M&TE) is used instead of the panel mounted diesel generator instrumentation. the instrument error may be reduced. increasing the range for the indicated steady state voltage and frequency limits.

SR 3.B.1.12 This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis accident (LOCA) signal. and subsequently achieves steady state required voltage and frequency ranges. and operates for ~ 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. Error values for specific instruments for non-steady state (transients) are established to derive indicated values in test procedures.

(continued)

PALO VERDE UNITS 1.2.3 B 3.B.1-35 REVISION 50

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS The existing design for CSAS actuation signal does not provide an emergency mode start to the DG. A CSAS actuation signal cannot occur until after a SIAS actuation signal has already been generated. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that permanently connected loads and auto-connected emergency loads (auto-connected through the automatic load sequencer) are energized from the offsite electrical power system on an ESF signal without loss of offsite power.

The requirement to verify the connection of permanent and auto-connected emergency loads is intended to satisfactorily show the relationship of these loads to the offsite circuit loading logic. In certain circumstances. many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance. ECCS injection valves are not desired to be stroked open. high pressure injection systems are not capable of being operated at full flow. or SOC systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of connection and loading of loads.

testing that adequately shows the capability of the offsite circuit system to perform these functions is acceptable.

This testing may include any series of sequential.

overlapping. or total steps so that the entire connection and loading sequence is verified to the extent possible ensuring power is available to the component.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-36 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. The reason for Note 2 is that performing this SR would remove a required offsite circuit from service. perturb the EDS. and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance.

corrective modification. deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed partial surveillance. a successful partial surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes.

These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1. 2. 3. or 4. Risk insights or deterministic methods may be used for this assessment. Note 3 states that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy. The analyzed values for the steady-state diesel generator voltage limits are ~ 4000 and

$ 4377.2 volts and the analyzed values for the steady-state diesel generator frequency limits are ~ 59.7 and $ 60.7 hertz. The indicated steady state diesel generator voltage and frequency limits. using the panel mounted diesel generator instrumentation and adjusted for instrument error are ~ 4080 and $ 4300 volts (Ref. 12). and ~ 59.9 and $ 60.5 hertz (Ref. 13). respectively. If digital Maintenance and Testing Equipment (M&TE) is used instead of the panel mounted diesel generator instrumentation. the instrument error may be reduced. increasing the range for the indicated steady state voltage and frequency limits.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-37 REVISION 45

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 REQUIREMENTS (continued) This Surveillance demonstrates that DG and its associated 4.16 KV output breaker noncritical protective functions (e.g .. high jacket water temperature) are bypassed on a loss of voltage signal concurrent with an ESF actuation test signal. and critical protective functions (engine overspeed.

generator differential current. engine low lube oil pressure. and manual emergency stop trip). trip the DG to avert substantial damage to the DG unit. The noncritical trips are bypassed during DBAs and provide an alarm on an abnormal engine condition. This alarm provides the operator with sufficient time to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.14 Regulatory Guide 1.9 (Ref. 3). paragraph 2.2.9. requires demonstration that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . ~ 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 105 to 110% of the continuous rating of the DG (5775 - 6050 kW) and

~ 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months at a load equivalent to 90 to 100% of the continuous duty rating of the DG (4950 - 5500 kW). The DG starts for this Surveillance can be performed either from normal keep-warm or hot conditions. The provisions for prelubricating and warmup. discussed in SR 3.8.1.2. and for gradual loading. discussed in SR 3.8.1.3. are applicable to this SR (Note 3 and Note 4).

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible. testing is performed using design basis kW loading and maximum kVAR loading permitted during testing. These (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-38 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS loads represent the inductive loading that the DG would experience to the extent practicable and is consistent with the intent of Regulatory Guide 1.9 (Ref. 3). Administrative limits have been placed upon the Class IE 4160 V buses due to high voltage concerns. As a result, power factors deviating much from unity are currently not possible when the DG runs parallel to the grid while the plant is shutdown. To the extent practicable, VARs will be provided by the DG during this SR. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The following compensatory measures shall be implemented prior to the performance of this SR in MODE 1 or 2 with the DG connected to an offsite circuit:

a. Weather conditions will be assessed, and the SR will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.

b. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit performing this SR.

c. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled. Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded approach according to risk significance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-39 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS This Surveillance is modified by four Notes. Note 1 states that momentary variations due to changing bus loads do not invalidate the test. Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power. testing should be performed at a lagging power factor of ~ 0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. This power factor should be able to be achieved when performing this SR at power and synchronized with offsite power by transferring house loads from the auxiliary transformer to the startup transformer in order to lower the Class IE bus voltage. Under certain conditions.

however. Note 2 allows the surveillance to be conducted at a power factor other than ~ 0.89. These conditions occur when grid voltage is high. and the additional field excitation needed to get the power factor to ~ 0.89 results in voltages on the emergency busses that are too high. This would occur when performing this SR while shutdown. and the loads on the startup transformer are too light to lower the voltage sufficiently to achieve a 0.89 power factor. Under these conditions. the power factor should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances. the grid voltage may be such that the DG excitation levels needed to obtain a power factor of 0.89 may not cause unacceptable voltages on the emergency busses.

but the excitation levels are in excess of those recommended for the DG. In such cases. the power factor shall be maintained as close as practicable to 0.89 without exceeding DG excitation limits. The provisions for prelubricating and warmup. discussed in SR 3.8.1.2. and for gradual loading.

discussed in SR 3.8.1.3. are applicable to this SR (Note 3 and Note 4).

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-40 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 REQUIREMENTS (continued) This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 10 seconds, and subsequently achieves steady state required voltage and frequency ranges. Error values for specific instruments for non-steady state (transients) are established to derive indicated values in test procedures. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The load band is provided to avoid routine overloading of the DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Per the guidance in Regulatory Guide 1.9, this SR would demonstrate the hot restart functional capability at full-load temperature conditions, after the DG has operated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (or until operating temperatures have stabilized) at full load.

Momentary transients due to changing bus loads do not invalidate the test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing. Note 3 states that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy.

The analyzed values for the steady-state diesel generator voltage limits are ~ 4000 and ~ 4377.2 volts and the analyzed values for the steady-state diesel generator frequency limits are ~ 59.7 and ~ 60.7 hertz. The indicated steady state diesel generator voltage and frequency limits, using the panel mounted diesel generator instrumentation and adjusted for instrument error, are ~ 4080 and ~ 4300 volts (Ref. 12), and ~ 59.9 and ~ 60.5 hertz (Ref. 13),

respectively. If digital Maintenance and Testing Equipment (M&TE) is used instead of the panel mounted diesel generator instrumentation, the instrument error may be reduced, increasing the range for the indicated steady state voltage and frequency limits.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-41 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 REQUIREMENTS (continued) As required by Regulatory Guide 1.9 (Ref. 3).

paragraph 2.2.11. this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the auto-start logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage. in standby operation (running unloaded). the output breaker is open and can receive an autoclose signal on bus undervoltage. and the load sequence timers are reset.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service. perturb the electrical distribution system. and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification.

deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed surveillance. a successful surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-42 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.B.1.17 REQUIREMENTS (continued) Demonstration of the test mode override ensures that the DG availability under accident conditions will not be compromised as the result of testing and the DG will automatically reset to ready-to-load operation if a LOCA actuation signal (e.g .. simulated SIAS) is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage. in standby operation (running unloaded) with the DG output breaker open. These provisions for automatic switchover are required by IEEE-30B (Ref. 11). paragraph 6.2.6(2) and Regulatory Guide 1.9 (Ref. 3). paragraph 2.2.13.

The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.B.1.12. The intent in the requirement associated with SR 3.B.1.17.b is to show that the emergency loading was not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads. testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.

This testing may include any series of sequential.

overlapping. or total steps so that the entire connection and loading sequence is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service. perturb the electrical distribution system. and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification.

deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed partial surveillance. a successful partial surveillance. and a (continued)

PALO VERDE UNITS 1.2.3 B 3.B.1-43 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1. 2. 3.

or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.18 Under accident and loss of offsite power conditions loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the

,permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents.

The 1 second load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. FSAR. Chapter 8 (Ref. 2) provides a summary of the automatic loading of ESF buses.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service. perturb the electrical distribution system. and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification.

deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed surveillance. a successful surveillance. and a perturbation of the offsite or onsite system when they are tied together (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-44 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS or operated independently for the surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the surveillance is performed in MODE 1 or 2. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power. the DGs are required to supply the necessary power to ESF systems so that the fuel. RCS. and containment deSign limits are not exceeded.

This Surveillance demonstrates the DG operation. as discussed in the Bases for SR 3.8.1.11. during a loss of offsite power actuation test Signal in conjunction with an ESF actuation signal. In lieu of actual demonstration of connection and loading of loads. testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential. overlapping. or total steps so that the entire connection and loading sequence is verified. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by three Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing. the DGs must be started from standby conditions. that is. with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DGs. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service. perturb the electrical distribution system. and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification. deficient or incomplete surveillance testing.

and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-45 REVISION 56

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 (continued)

REQUIREMENTS enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed partial surveillance. a successful partial surveillance and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1. 2. 3.

or 4. Risk insights or deterministic methods may be used for this assessment. Note 3 states that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy. The analyze values for the steady-state diesel generator voltage limits are ~ 4000 and s 4377.2 volts and the analyzed values for the steady-state diesel generator frequency limits are ~

59.7 and s 60.7 hertz. The indicated steady state diesel generator voltage and frequency limits. using the panel mounted diesel generator instrumentation and adjusted for instrument error. are ~ 4080 and s 4300 volts (Ref.12). and

~ 59.9 and s 60.5 hertz (Ref.13). respectively. If digital Maintenance and Testing Equipment (M&TE) is used instead of the panel mounted diesel generator instrumentation. the instrument error may be reduced. increasing the range for the indicated steady state voltage and frequency limits.

SR 3.8.1.20 This Surveillance demonstrates that the DG starting independence has not been compromised. Also. this Surveillance demonstrates that each engine can achieve proper speed within the specified time when the DGs are started simultaneously. Error values for specific instruments for non-steady state (transients) are established to derive indicated values in test procedures.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear on the DG during testing. Note 2 states that the steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument accuracy. The analyzed values for the steady-state diesel generator voltage limits are ~ 4000 and (continued)

PALO VERDE UNITS 1.2.3 B 3.8.1-46 REVISION 56

Diesel Fuel Oil. Lube Oil. and Starting Air B 3.8.3 BASES ACTIONS 0.1 (continued)

With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits. a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil. when mixed with previously stored fuel oil. remains acceptable.

or restore the stored fuel oil properties. This restoration may involve feed and bleed procedures. filtering. or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits. there is a high likelihood that the DG would still be capable of performing its intended function.

E.1 Each DG is OPERABLE with one air receiver capable of delivering an operating pressure of ~ 230 psig indicated.

Although there are two independent and redundant starting air receivers per DG. only one starting air receiver is required for DG OPERABILITY. Each receiver is sized to accomplish 5 DG starts from its normal operating pressure of 250 psig. and each will start the DG in ~ 10 seconds with a minimum pressure of 185 psig indicated. If the required starting air receiver is < 230 psig and ~ 185 psig indicated. the starting air system is degraded and a period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This 48-hour period is acceptable based on the minimum starting air capacity (~ 185 psig indicated). the fact that the DG start must be accomplished on the first attempt (there are no sequential starts in emergency mode).

and the low probability of an event during this brief period. Calculation 13-JC-DG-203 (Ref. 8) supports the proposed values for receiver pressures.

F.1 With a Required Action and associated Completion Time not met. or one or more DGs with diesel fuel oil. lube oil. or starting air subsystem inoperable for reasons other than addressed by Conditions A through E. the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.3-5 REVISION 54

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS F.1 (continued)

A Note modifies condition F. Periodic starting of the Emergency Diesel Generator(s) requires isolation on one of the two normally aligned air start receivers. During the subsequent Diesel Generator start, the air pressure in the one remaining air receiver may momentarily drop below the minimum required pressure of 185 psig indicated. This would normally require declaring the now running Diesel Generator inoperable, due to low pressure in the air start system.

This is not required, as the Diesel Generator would now be running following the successful start. Should the start not be successful, the DG would be declared inoperable per the requirements of LCO 3.8.1. As such, this Condition is modified by a Note stating that should the required starting air receiver pressure momentarily drop to <185 psig indicated while starting the Diesel Generator on one air receiver only, then entry into Condition F is not required.

It is expected that this condition would be fairly short duration (approximately 8 minutes), as the air start compressors should quickly restore the air receiver pressure after the diesel start.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at full load. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least 7 days of full load operation for each DG. The 2.5 inches visible in the sightglass requirement is based on the DG manufacturer consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the capability to (continued)

PALO VERDE UNITS 1,2,3 B 3.8.3-6 REVISION 56

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.2 (continued)

REQUIREMENTS transfer the lube oil from its storage location to the OG, when the DG lube oil sump does not hold adequate inventory for 7 days of full load operation without the level reaching the manufacturer recommended minimum level.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.3 The tests listed below are a means of determining whether new fuel oil is of the appropriate grade and has not been contaminated with substances that would have an immediate, detrimental impact on diesel engine combustion. If results from these tests are within acceptable limits, the fuel oil may be added to the storage tanks without concern for contaminating the entire volume of fuel oil in the storage tanks. These tests are to be conducted prior to adding the new fuel to the storage tank(s), but in no case is the time between receipt of new fuel and conducting the tests to exceed 31 days. The tests, limits, and applicable ASTM Standards are as follows:

a. Sample the fuel oil in accordance with ASTM-04057 (Ref. 6);

b. Verify in accordance with the tests specified in ASTM 0975 (Ref. 6) that the sample has an absolute specific gravity at 60/60°F of ~ 0.83 and ~ 0.89, or an API gravity at 60°F of ~ 27° and ~ 39°, a kinematic viscosity at 40°C of ~ 1.9 centistokes and ~ 4.1 centistokes, and a flash point ~ 125°F; and

c. Verify in accordance with the tests specified in ASTM 01796 (Ref. 6) that the sample water and sediment is

~ 0.05 percent volume.

Failure to meet any of the above limits is cause for rejecting the new fuel oil, but does not represent a failure to meet the LCO concern since the fuel oil is not added to the storage tanks.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.3-7 REVISION 56

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS Within 31 days following the initial new fuel oil sample, the fuel oil is analyzed to establish that the other properties specified in Table 1 of ASTM 0975 (Ref. 7) are met for new fuel oil when tested in accordance with ASTM 0975 (Ref. 6), except that the analysis for cetane number may be performed in accordance with ASTM 0976 (Ref. 6) or ASTM 04737 (Ref. 6). The 31 day period is acceptable because the fuel oil properties of interest, even if they were not within stated limits, would not have an immediate effect on OG operation. This surveillance ensures the availability of high quality fuel oil for the OGs.

Fuel oil degradation during long term storage shows up as an increase in particulate, due mostly to oxidation. The presence of particulate does not mean the fuel oil will not burn properly in a diesel engine. The particulate can cause fouling of filters and fuel oil injection equipment, however, which can cause engine failure.

Particulate concentrations should be determined in accordance with ASTM 02276, Method A (Ref. 6). This method involves a gravimetric determination of total particulate concentration in the fuel oil and has a limit of 10 mg/l.

It is acceptable to obtain a field sample for subsequent laboratory testing in lieu of field testing. Each tank must be considered and tested separately.

The Frequency of this test takes into consideration fuel oil degradation trends that indicate that particulate concentration is unlikely to change significantly between Frequency intervals.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.3-8 REVISION 41

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.4 REQUIREMENTS (continued)

This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. The system design requirements provide for a minimum of five engine start cycles without recharging. A start cycle is defined by the DG vendor, but usually is measured in terms of time (seconds or cranking) or engine cranking speed. The pressure specified in this SR is intended to reflect the lowest value at which the DG can be considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Removal of water from the fuel oil storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The presence of water does not necessarily represent failure of this SR provided the accumulated water is removed during the performance of this Surveillance.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.3-9 REVISION 56

Diesel Fuel Oil. Lube Oil. and Starting Air B 3.8.3 BASES REFERENCES 1. FSAR. Section 9.5.4.2.

2. Regulatory Guide 1.137.

3. ANSI N195-1976. Appendix B.

4. FSAR. Chapter 6.

5. FSAR. Chapter 15.

6. ASTM Standards: 04057-81; 0975-07b; 0976-91; 04737-90; 01796-83; 02276-89. Method A.

7. ASTM Standards. 0975. Table 1.

8. "Emergency Diesel Generator and Diesel Fuel Oil Systems Instrumentation Uncertainty Calculation". 13-JC-OG-203. Parts 23 and 51 PALO VERDE UNITS 1.2.3 B 3.8.3-10 REVISION 54

DC Sources - Operating B 3.8.4 BASES power subsystem with attendant loss of ESF functions.

continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and. if the DC electrical power subsystem is not restored to OPERABLE status. to prepare to effect an orderly and safe unit shutdown.

Entry into Condition A is not required with one of the required (in-service) battery chargers inoperable. When one of the required (in-service) battery chargers is inoperable.

Condition C is appropriate to enter. The loss of two required (in-service) battery chargers on the same train would be a degradation of the train beyond the scope of Condition C. thus rendering the train inoperable and requiring entry into Condition A.

B.1 and B.2 If the inoperable DC electrical power subsystem (exclusive of the battery charger) cannot be restored to OPERABLE status within the required Completion Time of Condition A.

the unit must be brought to a MODE in which the LCD does not apply. To achieve this status. the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).

C.1 and C.2 Condition C represents the loss of one of the required (in-service) battery chargers and assumes that action will be taken immediately to restore charging capability to the battery with the alternate charger (i .e .. normal or backup).

Under normal plant load conditions. the loss of the battery charger for ~ 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months has a negligible effect on the rated battery capacity and does not impact the DC electrical power subsystem's capability to perform its DBA safety function.

Immediately following the loss of the charging capability.

battery cell parameters may not meet Category A limits because these limits assume that the battery is being charged at a minimum float voltage. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion (continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-5 REVISION 2

DC Sources - Operating B 3.8.4 BASES ACTIONS C.1 and C.2 (continued)

Time allows for re-establishing charging capability such that Category A parameters can be met. Operation with the DC electrical power subsystem battery charger inoperable is not allowed for an indefinite period of time even when the battery cell parameters have been verified to meet the Category A limits of Table 3.8.6-1. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time provides a period of time to correct the problem commensurate with the importance of maintaining the DC electrical power subsystem battery charger in an OPERABLE status.

The loss of the two required (in-service) battery chargers on the same train would be a degradation of the train beyond the scope of Condition C. thus rendering the train inoperable and requiring entry into Condition A.

0.1 If the battery cell parameters cannot be maintained within Category A limits as specified in LCO 3.8.6. the short term capability of the battery is also degraded and the battery must be declared inoperable.

SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or a battery cell) in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-6 REVISION 56

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.2 REQUIREMENTS (continued) Visual inspection to detect corrosion of the battery cells and connections. or measurement of the resistance of each inter-cell. inter-rack. inter-tier. and terminal connection.

provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.

The limits established for this SR are based on calculation 1.2.3ECPK207 which states that if every terminal connection were to degrade to 150E-6 ohms. there would be sufficient battery capacity to satisfy the DBA Duty Cycle (Ref. 13).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.3 Visual inspection of the battery cells. cell plates. and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The presence of physical damage or deterioration does not necessarily represent a failure of this SR. provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.4 and SR 3.8.4.5 Visual inspection and resistance measurements of inter-cell.

inter-rack. inter-tier. and terminal connections provide an indication of physical damage or abnormal deterioration that could indicate degraded battery condition. The anticorrosion material is used to help ensure good electrical connections and to reduce terminal deterioration.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-7 REVISION 56

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.4 and SR 3.8.4.5 (continued)

REQUIREMENTS The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection. The removal of visible corrosion is a preventive maintenance SR. The presence of visible corrosion does not necessarily represent a failure of this SR provided visible corrosion is removed during performance of SR 3.8.4.4.

The connection resistance limits for SR 3.8.4.5 is based on calculation 1.2.3ECPK207 which states that if every terminal connection were to degrade to 150E-6 ohms there would be sufficient battery capacity to satisfy the DBA Duty Cycle (Ref. 13).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.6 This SR requires that each required battery charger be capable of supplying 400 amps for batteries A and Band 300 amps for batteries C and D. and 125 V for ~ 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . These requirements are based on the design capacity of the chargers (Ref. 4). According to Regulatory Guide 1.32 (Ref. 10). the battery charger supply is required to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state. irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensures that these requirements can be satisfied.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance on the charger credited for (continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-8 REVISION 56

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.6 (continued)

REQUIREMENTS OPERABILITY would perturb the electrical distribution system and challenge safety systems. This restriction from normally performing the surveillance in MODE 1. 2. 3. and 4 is further amplified to allow portions of the surveillance to be performed for the purpose of reestablishing OPERABILITY (e.g .. post work testing following corrective maintenance. corrective modification. deficient or incomplete surveillance testing. and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall. as a minimum. consider the potential outcomes and transients associated with a failed partial surveillance. a successful partial surveillance. and a perturbation of the offsite or onsite system when they are tied together or operated independently for the partial surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when portions of the surveillance are performed in MODE 1. 2. 3. or 4. Risk insights or deterministic methods may be used for this assessment.

SR 3.8.4.7 A battery service test is a special test of battery capability. as found. to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length should correspond to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows the performance of a battery performance discharge test or a modified performance discharge test in SR 3.8.4.8 in lieu of a service test since both performance discharge test parameters envelope the service test. The reason for Note 2 is that performing the Surveillance would perturb the electrical distribution system and challenge safety systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-9 REVISION 56

DC Sources - Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 REQUIREMENTS (continued) A battery performance discharge test is a test of constant current capacity of a battery. normally done in the "as found" condition. after having been in service. to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.

The modified performance discharge test is a simulated duty cycle conSisting of just two rates: the one minute rate published for the battery or the largest current load of the duty cycle (but in no case lower than the performance test rate). followed by the test rate employed for the performance test. both of which envelope the duty cycle of the service test. Since the ampere-hours removed by a rated one minute discharge represents a very small portion of the battery capacity. the test rate can be changed to that for the performance test without compromising the results of the performance discharge test.

A modified discharge test is a test of the battery capacity and its ability to provide a high rate. short duration load (usually the highest rate of the duty cycle). This will often confirm the battery's ability to meet the critical period of the load duty cycle. in addition to determining its percentage of rated capacity. Initial conditions for the modified performance discharge test should be identical to those specified for a service test.

Either the battery performance discharge test or the modified performance discharge test is acceptable for satisfying SR 3.8.4.8. In addition. either of the performance discharge tests may be used to satisfy SR 3.8.4.8 while satisfying the requirements of SR 3.8.4.7 at the same time. because the test parameters envelope the service test described in SR 3.8.4.7.

The acceptance criteria for this Surveillance are consistent with IEEE-450 (Ref. 9) and IEEE-485 (Ref. 5). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer rating. A capacity of 80% shows that the battery rate of deterioration is increasing. even if there is ample capacity to meet the load requirements.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation. or if the (continued)

PALO VERDE UNITS 1.2.3 B 3.8.4-10 REVISION 56

Battery Cell Parameters B 3.8.6 BASES ACTIONS A.1. A.2. and A.3 (continued)

Continued operation is only permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. With the consideration that. while battery capacity is degraded. sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits. this time is acceptable prior to declaring the battery inoperable.

B.1 With one or more batteries with one or more battery cell parameters not within the Category C limit for any connected cell. sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding DC electrical power subsystem must be declared inoperable.

Additionally. other potentially extreme conditions. such as not completing any of the Required Actions of Condition A within the required Completion Time or average electrolyte temperature of representative cells falling below 60°F. are also cause for immediately declaring the associated DC electrical power subsystem inoperable.

SURVEILLANCE SR 3.8.6.1 REQUIREMENTS This SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 3). which recommends regular battery inspections including float voltage. specific gravity. and electrolyte level of pilot cells.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.6.2 The inspection of level. specific gravity and float voltage is consistent with IEEE-450 (Ref. 3). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. In addition. within 7 days of a battery discharge < 105 V or a battery overcharge> 150 V. the battery must be demonstrated to meet Category B limits.

Transients. such as motor starting transients. which may momentarily cause battery voltage to drop to ~ 105 V.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.6-3 REVISION 56

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.2 (continued)

REQUIREMENTS do not constitute a battery discharge provided the battery terminal voltage and float current return to pre-tr~nsient values. This inspection is also consistent with IEEE-450 (Ref. 3). which recommends special inspections following a severe discharge or overcharge. to ensure that no significant degradation of the battery occurs as a consequence of such discharge or overcharge.

SR 3.8.6.3 This Surveillance verification that the average temperature of representative cells (a 10% representative sample of available cells for each battery bank) is ~ 60°F is consistent with a recommendation of IEEE-450 (Ref. 3). which states that the temperature of electrolytes in representative cells should be determined on a quarterly basis.

Lower than normal temperatures act to inhibit or reduce battery capacity. This SR ensures that the operating temperatures remain within an acceptable operating range.

This limit is based on vendor recommendations.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Table 3.8.6-1 This table delineates the limits on electrolyte level. float voltage. and specific gravity for three different categories. The meaning of each category is discussed below.

Category A defines the normal parameter limit for each designated pilot cell in each battery. The cells selected as pilot cells are those whose level. voltage and electrolyte specific gravity approximate the state of charge of the entire battery.

The Category A limits specified for electrolyte level are based on vendor recommendations and are consistent with the guidance in IEEE-450 (Ref. 3). with the extra ~ inch allowance above the high water level indication for operating margin to account for temperatures and charge (continued)

PALO VERDE UNITS 1.2.3 B 3.8.6-4 REVISION 56

Inverters - Operating B 3.8.7 BASES (continued)

SURVEILLANCE SR 3.8.7.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital instrument buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation of the RPS and ESFAS connected to the AC vital instrument buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 8.

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15.

PALO VERDE UNITS 1,2,3 B 3.8.7-5 REVISION 56

This Page is Intentionally Left Blank Inverters - Shutdown B 3.8.8 BASES LCO equipment are required to be OPERABLE by LCO 3.8.10. the (continued) necessary AC vital instrument bus(es) associated with the additional train of inverters shall be energized by either the bus(es)' associated inverter or AC voltage regulator.

For those situations where an AC vital instrument bus associated with the additional train of inverters is energized by its inverter. the corresponding DC bus must be energized by a minimum of its associated battery charger or backup battery charger per LCO 3.8.5.

APPLI CAB ILITY The inverters required to be OPERABLE in MODES 5 and 6. and during movement of irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel in the core;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are avail ab 1e; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification. The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

Inverter requirements for MODES 1. 2. 3. and 4 are covered in LCO 3.8.7.

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A.1. A.2.1. A.2.2. A.2.3. and A.2.4 If two trains of AC vital instrument buses are required by LCO 3.8.10. "Distribution Systems - Shutdown." of the two required trains. the remaining bus(es) with AC power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS. fuel (continued)

PALO VERDE UNITS 1.2.3 B 3.8.8-3 REVISION 21

Inverters - Shutdown B 3.8.8 BASES ACTIONS A.1. A.2.1. A.2.2. A.2.3. and A.2.4 (continued) movement. operations with a potential for draining the reactor vessel. and operations with a potential for positive reactivity additions. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable. appropriate restrictions will be implemented in accordance with the affected required features LCOs' Required Actions. In many instances. this option may involve undesired administrative efforts.

Therefore. the allowance for sufficiently conservative actions is made (i .e .. to suspend CORE ALTERATIONS. movement of irradiated fuel assemblies. and operations involving positive reactivity additions). The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory.

provided the required SDM is maintained.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. If moving irradiated fuel assemblies while in MODES 1. 2. 3. or

4. the fuel movement is independent of reactor operations.

Therefore. inability to immediately suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action until restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are functioning properly with all required circuit breakers closed and AC vital instrument buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital instrument buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.8-4 REVISION 56

Inverters - Shutdown B 3.8.8 BASES (continued)

REFERENCES 1. UFSAR. Chapter 6.

2. UFSAR. Chapter 15.

PALO VERDE UNITS 1.2.3 B 3.8.8-5 REVISION 56

This page intentionally blank Distribution Systems - Operating B 3.8.9 BASES ACTIONS 0.1 and 0.2 (continued)

If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time. the unit must be brought to a MODE in which the LCO does not apply. To achieve this status. the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable.

based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost. When more than one Condition is entered. and this results in the loss of a required safety function. the plant is in a condition outside the accident analysis. Therefore. no additional time is justified for continued operation.

LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.9-9 REVISION 0

Distribution Systems - Operating B 3.8.9 BASES (continued)

SURVEI LLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the AC. DC. and AC vital instrument bus electrical power distribution systems are functioning properly. with the required circuit breakers closed and the buses energized. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained. and the appropriate voltage is available to each required bus.

The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 6.

2. UFSAR. Chapter 15.

3. Regulatory Guide 1.93. Revision O. December 1974.

PALO VERDE UNITS 1.2.3 B 3.8.9-10 REVISION 56

Distribution Systems - Shutdown B 3.8.10 BASES (continued)

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A.I. A.2.1. A.2.2. A.2.3. A.2.4. and A.2.5 Although redundant required features may require redundant trains of electrical power distribution subsystems to be OPERABLE. one OPERABLE distribution subsystem train may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable.

appropriate restrictions are implemented in accordance with the affected required features LCO's Required Actions. In many instances. this option may involve undesired administrative efforts. Therefore. the allowance for sufficiently conservative actions is made (i .e .. to suspend CORE ALTERATIONS. movement of irradiated fuel assemblies.

and operations involving positive reactivity additions).

The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory provided the required SDM is maintained.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. If moving irradiated fuel assemblies while in MODES 1. 2. 3. or

4. the fuel movement is independent of reactor operations.

Therefore. inability to immediately suspend movement of irradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC. DC. and AC vital instrument bus electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the unit safety systems.

(continued)

PALO VERDE UNITS 1.2.3 B 3.8.10-3 REVISION 48

Distribution Systems - Shutdown B 3.8.10 BASES ACTIONS A.1. A.2.1. A.2.2. A.2.3. A.2.4. and A.2.5 (continued)

Notwithstanding performance of the above conservative Required Actions. a required shutdown cooling (SOC) subsystem may be inoperable. In this case. Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCD 3.0.6. the SOC ACTIONS would not be entered.

Therefore. Required Action A.2.5 is provided to direct declaring SOC inoperable. which results in taking the appropriate SOC actions.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the unit safety systems may be without power.

SURVEILLANCE SR 3.8.10.1 REQUIREMENTS This Surveillance verifies that the AC. DC. and AC vital instrument bus electrical power distribution system is functioning properly. with all the required buses energized.

The verification of proper voltage availability on the buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Chapter 6.

2. UFSAR. Chapter 15.

PALO VERDE UNITS 1.2.3 B 3.8.10-4 REVISION 56

Boron Concentration B 3.9.1 BASES LCO The LCO requires that a minimum boron concentration be maintained in the RCS and the refueling canal to ensure a uniform boron concentration is maintained for reactivity control in the volumes having direct access to the reactor vessel while in MODE 6. The boron concentration limit specified in the COLR ensures a core keff of S 0.95 is maintained during fuel handling operations. Violation of the LCO could lead to an inadvertent criticality during MODE 6.

APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor vessel will remain subcritical. The required boron concentration ensures a k~f S 0.95. Above MODE 6.

LCO 3.1.1. "SHUTDOWN MARGIN (SDM) - Reactor Trip Breakers Open." and LCO 3.1.2. "SHUTDOWN MARGIN - Reactor Trip Breakers Closed." ensure that an adequate amount of negative reactivity is available to shut down the reactor and to maintain it subcritical .

ACTIONS A.l and A.2 Continuation of CORE ALTERATIONS or positive reactivity additions (including actions to reduce boron concentration) is contingent upon maintaining the unit in compliance with the LCO. If the boron concentration of any coolant volume in the RCS or the refueling canal is less than its limit.

all operations involving CORE ALTERATIONS or positive reactivity additions must be suspended immediately.

Suspension of CORE ALTERATIONS and positive reactivity additions shall not preclude moving a component to a safe position.

A.3 In addition to immediately suspending CORE ALTERATIONS or positive reactivity additions. boration to restore the concentration must be initiated immediately.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.1-3 REVISION 0

Boron Concentration B 3.9.1 BASES ACTIONS A.3 (continued)

In determining the required combination of boration flow rate and concentration. there is no unique design basis event that must be satisfied. The only requirement is to restore the boron concentration to its required value as soon as possible at greater than or equal to 26 gpm of a solution containing greater than 4000 ppm boron. In order to raise the boron concentration as soon as possible. the operator should begin boration with the best source available for unit conditions.

Once boration is initiated. it must be continued until the boron concentration is restored. The restoration time depends on the amount of boron that must be injected to reach the required concentration.

SURVEILLANCE SR 3.9.1.1 REQUIREMENTS This SR ensures the coolant boron concentration in the RCS and the refueling canal is within the COLR limits. The boron concentration of the coolant in each volume is determined periodically by chemical analysis.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50. Appendix A. GDC 26.

2. UFSAR. Section 9.1.2.

PALO VERDE UNITS 1.2.3 B 3.9.1-4 REVISION 56

Nuclear Instrumentation B 3.9.2 BASES ACTIONS B.1 (continued)

With no SRM OPERABLE. action to restore a monitor to OPERABLE status shall be initiated immediately. Once initiated. action shall be continued until an SRM is restored to OPERABLE status.

With no SRM OPERABLE. there is no direct means of detecting changes in core reactivity. However. since CORE ALTERATIONS and positive reactivity additions are not to be made. the core reactivity condition is stabilized until the SRMs are OPERABLE. This stabilized condition is verified by performing Action B.1 of LCD 3.3.12 which requires RCS boron concentration to be determined by redundant methods immediately and at the monitoring frequency specified in the COLR Section 3.3.12. This action satisfies the requirements of the inadvertent deboration safety analysis.

RCS boron concentration sampling by redundant methods ensures a boron dilution will be detected with sufficient time to terminate the event before the reactor achieves criticality.

SURVEILLANCE SR 3.9.2.1 REQUIREMENTS SR 3.9.2.1 is the performance of a CHANNEL CHECK. which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels. but each channel should be consistent with its local conditions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.2-3 REVISION 56

Nuclear Instrumentation B 3.9.2 BASES SURVEILLANCE SR 3.9.2.2 REQUIREMENTS (continued) SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION.

This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION. The detectors are of simple construction, and any failures in the detectors will be apparent as change in channel output. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational. This SR is an extension of SR 3.3.12 for the Boron Dilution Alarm System CHANNEL CALIBRATION listed here because of its Applicability in these MODES. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CALIBRATION is normally performed during a plant outage, but can be performed with the reactor at power if detector curve determination is not performed.

Detector curve determination can only be performed under conditions that apply during a plant outage since the flux level needs to be at shutdown levels for detector energization.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29.

2. UFSAR, Section 15.4.6.

PALO VERDE UNITS 1,2,3 B 3.9.2-4 REVISION 56

Containment Penetrations B 3.9.3 BASES ACTIONS A.l and A.2 (continued) valves are open. the unit must be placed in a condition in which the isolation function is not needed. This is accomplished by immediately suspending CORE ALTERATIONS and movement of irradiated fuel assemblies within containment.

Performance of these actions shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS This Surveillance demonstrates that each of the containment penetrations required to be in its closed position is in that position. The Surveillance on the open purge and exhaust valves will demonstrate that the valves are not blocked from closing. Also. the Surveillance will demonstrate that each valve operator has motive power.

which will ensure each valve is capable of being closed by an OPERABLE automatic containment purge isolation signal.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.3.2 This Surveillance demonstrates that each containment purge valve actuates to its isolation position on manual initiation or on an actual or simulated high radiation signal. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

These surveillances performed during MODE 6 will ensure that the valves are capable of closing after a postulated fuel handling accident to limit a release of fission product radioactivity from the containment.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.3-5 REVISION 56

Containment Penetrations B 3.9.3 BASES SURVILLANCE SR 3.9.3.3 REQUIREMENTS (continued) This Surveillance demonstrates that the necessary hardware, tools, equipment and personnel are available to close the equipment hatch and that the equipment hatch is clear of obstructions that would impede its closure. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. GPU Nuclear Safety Evaluation SE-0002000-001, Rev. 0, May 20, 1988.

2. UFSAR, Section 15.7.4.

3. NUREG-0800, Section 15.7.4, Rev. 1, July 1981.

PALO VERDE UNITS 1,2,3 B 3.9.3-6 REVISION 56

SOC and Coolant Circulation - High Water Level B 3.9.4 BASES APPLICABILITY Requirements for the SOC System in other MODES are covered (continued) by LCOs in Section 3.4. Reactor Coolant System (RCS). and Section 3.5. Emergency Core Cooling Systems (ECCS). SOC loop requirements in MODE 6. with the water level < 23 ft above the top of the reactor vessel flange. are located in LCD 3.9.5. "Shutdown Cooling (SOC) and Coolant Circulation -

Low Water Level."

ACTIONS SOC loop requirements are met by having one SOC loop OPERABLE and in operation. except as permitted in the Note to the LCD.

A.l If SOC loop requirements are not met. there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations can occur through the addition of water with a lower boron concentration than that contained in the RCS. Therefore.

actions that reduce boron concentration shall be suspended immediately.

A.2 If SOC loop requirements are not met. actions shall be taken immediately to suspend loading irradiated fuel assemblies in the core. With no forced circulation cooling. decay heat removal from the core occurs by natural convection to the heat sink provided by the water above the core. A minimum refueling water level of 23 ft above the reactor vessel flange provides an adequate available heat sink. Suspending any operation that would increase the decay heat load. such as loading an irradiated fuel assembly. is a prudent action under this condition.

A.3 If SOC loop requirements are not met. actions shall be initiated and continued in order to satisfy SOC loop requirements.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.4-3 REVISION 0

SOC and Coolant Circulation - High Water Level B 3.9.4 BASES ACTIONS A.4 (continued)

If SOC loop requirements are not met. all containment penetrations to the outside atmosphere must be closed to prevent fission products. if released by a loss of decay heat event. from escaping the containment building. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time allows fixing most SOC problems without incurring the additional action of violating the containment atmosphere.

SURVEILLANCE SR 3.9.4.1 REQUIREMENTS This Surveillance demonstrates that the SOC loop is in operation and circulating reactor coolant at a flowrate of greater than or equal to 3780 gpm. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 5.4.7.

PALO VERDE UNITS 1.2.3 B 3.9.4-4 REVISION 56

SOC and Coolant Circulation - Low Water Level B 3.9.5 BASES APPLICABILITY Two SOC loops are required to be OPERABLE. and one SOC loop must be in operation in MODE 6. with the water level < 23 ft above the top of the reactor vessel flange. to provide decay heat removal. Requirements for the SOC System in other MODES are covered by LCOs in Section 3.4. Reactor Coolant System. MODE 6 requirements. with a water level ~ 23 ft above the reactor vessel flange. are covered in LCO 3.9.4.

"Shutdown Cooling and Coolant Circulation - High Water Level."

ACTIONS A.l and A.2 If one SOC loop is inoperable. action shall be immediately initiated and continued until the SOC loop is restored to OPERABLE status and to operation. or until ~ 23 ft of water level is established above the reactor vessel flange. When the water level is established at ~ 23 ft above the reactor vessel flange. the Applicability will change to that of LCO 3.9.4. "Shutdown Cooling and Coolant Circulation - High Water Level." and only one SOC loop is required to be OPERABLE and in operation. An immediate Completion Time is necessary for an operator to initiate corrective actions.

B.l If no SOC loop is in operation or no SOC loops are OPERABLE.

there will be no forced circulation to provide mixing to establish uniform boron concentrations. Reduced boron concentrations can occur by the addition of water with lower boron concentration than that contained in the RCS.

Therefore. actions that reduce boron concentration shall be suspended immediately.

B.2 If no SOC loop is in operation or no SOC loops are OPERABLE.

action shall be initiated immediately and continued without interruption to restore one SOC loop to OPERABLE status and operation. Since the unit is in Conditions A and B concurrently. the restoration of two OPERABLE SOC loops and one operating SOC loop should be accomplished expeditiously.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.5-3 REVISION 27

SOC and Coolant Circulation - Low Water Level B 3.9.5 BASES ACTIONS B.3 (Continued)

If no SOC loop is in operation or no SOC loops are OPERABLE.

all containment penetrations providing direct access from the containment atmosphere to the outside atmosphere must be closed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . With the SOC loop requirements not met. the potential exists for the coolant to boil and release radioactive gas to the containment atmosphere.

Closing containment penetrations that are open to the outside atmosphere ensures that dose limits are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable. based on the low probability of the coolant boiling in that time.

SURVEILLANCE SR 3.9.5.1 REQUIREMENTS This Surveillance demonstrates that one SOC loop is operating and circulating reactor coolant at a flowrate of greater than or equal to 3780 gpm. The flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability and to prevent thermal and boron stratification in the core. In addition. this Surveillance demonstrates that the other SOC loop is OPERABLE.

In addition. during operation of the SOC loop with the water level in the vicinity of the reactor vessel nozzles. the SOC loop flow rate determination must also consider the SOC pump suction requirements. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.5.2 Verification that the required pump that is not in operation is OPERABLE ensures that an additional SOC pump can be placed in operation. if needed. to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR. Section 5.4.7.

PALO VERDE UNITS 1.2.3 B 3.9.5-4 REVISION 56

Refueling Water Level-Fuel Assemblies B 3.9.6 BASES SURVEILLANCE SR 3.9.6.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regul atory Gui de 1. 25. March 23. 1972.

2. UFSAR. Section 15.7.4.

3. NUREG-0800. Secti on 15.7.4.

4. 10 CFR 100.10.

PALO VERDE UNITS 1.2.3 B 3.9.6-3 REVISION 56

This page intentionally blank Refueling Water Level-CEAs B 3.9.7 BASES (continued)

SURVEILLANCE SR 3.9.7.1 REQUIREMENTS Verification of a minimum water level of 23 ft above the top of irradiated fuel assemblies seated within the reactor vessel ensures that the design basis for the postulated fuel handling accident analysis during refueling operations is met. Water at the required level above the top of the irradiated fuel limits the consequences of damaged fuel rods that are postulated to result from a fuel handling accident inside containment (Ref. 2).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regulatory Guide 1.25. March 23. 1972.

2. UFSAR. Section 15.7.4.

3. NUREG-0800. Section 15.7.4.

4. 10 CFR 100.10.

PALO VERDE UNITS 1.2.3 B 3.9.7-3 REVISION 56

This page intentionally blank

ML12193A042

Text

Navigation menu

Search