Text

License Amendment Request Supplement for Risk-Informed Completion Times
	ML17307A188
Person / Time
Site:	Palo Verde
Issue date:	11/03/2017
From:	Lacal M; Arizona Public Service Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	102-07587-MLL/TNW
	Download: ML17307A188 (309)
	v • d • e

10 CFR 50.90 Maria L. Lacal Senior Vice President, Nuclear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 102-07587-MLL/TNW Tel 623 393 6491 November 3, 2017 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Dear Sirs:

Reference:

Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 [Agency Documents Access and Management System (ADAMS)

Accession Number ML15218A300]

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Renewed Operating License Nos. NPF-41, NPF-51, NPF-74 License Amendment Request Supplement for Risk-Informed Completion Times In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), APS submitted in the referenced letter a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.

This license amendment request (LAR) supplement replaces information provided in the referenced letter. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, provides marked up pages of the existing TS Bases to show the proposed changes. of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in of the enclosure supersedes the commitments in the referenced letter.

Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.

A member of the STARS Alliance LLC Callaway

Diablo Canyon

Palo Verde

Wolf Creek

102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 2 The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (ADAMS Accession Number ML16300A245) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during the review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.

APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) - A, Risk-Managed Technical Specifications (RMTS)

Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (ADAMS Accession Number ML12286A322).

Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (ADAMS Accession number ML15127A669) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.

This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR.

APS requests approval of the proposed license amendment within one year, with the amendment being implemented within 180 days of issuance.

In accordance with the PVNGS Quality Assurance Program, the Plant Review Board reviewed and approved this LAR supplement. By copy of this letter, this LAR supplement is being forwarded to the Arizona Radiation Regulatory Agency pursuant to 10 CFR 50.91(b)(1).

Should you have any questions concerning the content of this letter, please contact Matthew S. Cox, Licensing Section Leader, at (623) 393-5753.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on ___November 3, 2017_______

(Date)

Sincerely, Digitally signed by Andrews, George Andrews, George W(Z99748)

DN: cn=Andrews, George W(Z99748)

W(Z99748)

Reason: I am approving this document as delegated for Maria Lacal Date: 2017.11.03 07:35:00 -07'00' MLL/TNW/NTA

102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 3

Enclosure:

Description and Assessment of Proposed Amendment for Risk-Informed Completion Times cc:

K. M. Kennedy NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS M. M. Watford OBanion NRC NRR Project Manager C. A. Peabody NRC Senior Resident Inspector for PVNGS T. Morales Arizona Radiation Regulatory Agency (ARRA)

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table of Contents

1.0 DESCRIPTION

2.0 ASSESSMENT 3.0 REGULATORY SAFETY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

ATTACHMENTS:

1. Proposed Technical Specification Changes (Mark-up)

2. Revised Technical Specification Pages (Clean Copy)

3. Technical Specification Bases Changes (Mark-up)

4. License Conditions and Regulatory Commitment

5. List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions

6. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

7. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2

8. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models

9. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

10. Justification of Application of At-Power PRA Models to Shutdown Modes

11. Probabilistic Risk Assessment Model Update Process

12. Attributes of the Configuration Risk Management Program Model

13. Key Assumptions and Sources of Uncertainty

14. Program Implementation

15. Monitoring Program

16. Risk Management Action Examples i

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

1.0 DESCRIPTION

In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) submitted in reference 1, a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3. Reference 2 provided the APS response to a specific information request regarding instrumentation.

This license amendment request (LAR) supplement replaces information provided in reference 1. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, Attachment 3 provides marked up pages of the existing TS Bases to show the proposed changes. of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1. Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.

The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (Reference 5) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during the review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.

APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) -

A, Risk-Managed Technical Specifications (RMTS) Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (References 4 and 6).

Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (Reference 3) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.

The LAR supplement involves TS completion times (CT) for required actions (RA) to provide the option to calculate a RICT. A new program, the risk informed completion time program, is added to TS Section 5, Administrative Controls.

In addition as described in section 2.3 of this enclosure, this enclosure includes the addition of a license condition, to address the scope of the probabilistic risk assessment (PRA) methods approved by the NRC staff for use in the PVNGS RICT program. Additionally, APS 1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.

2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation APS reviewed the safety evaluation for NEI 06-09-A (Reference 4), and the safety evaluation for the lead plant for risk-informed completion times (Reference 3) and concluded that they are applicable to PVNGS Units 1, 2, and 3.

2.2 Verifications and Regulatory Commitments The following attachments are provided in accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A (Reference 4):

Attachment 4 to this enclosure lists the APS license conditions and regulatory commitment regarding changes necessary to support implementation of RICT.

Attachment 5 to this enclosure identifies each of the TS required actions (RA) to which the RICT program will apply, with a comparison of the TS functions to the functions modeled in the PRA of the structures, systems and components (SSC) subject to those actions.

Attachment 6 to this enclosure provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT program, as required by regulatory guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009, Section 4.2.

Attachment 7 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC.

Attachment 8 to this enclosure provides appropriate justification for excluding sources of risk not addressed by the PRA models.

Attachment 9 to this enclosure provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

Attachment 10 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC.

Attachment 11 to this enclosure provides a discussion of the programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

Attachment 12 to this enclosure provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified for use in the configuration risk management program (CRMP) to assess real-time configuration risk, and describes the scope of and quality controls applied to the CRMP.

2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 to this enclosure provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified for this LAR, and how their impact on the RICT program was assessed and evaluated.

Attachment 14 to this enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including risk management action (RMA) implementation.

Attachment 15 to this enclosure provides a description of the monitoring program as described in NEI 06-09-A (Reference 4).

Finally, attachment 16 to this enclosure provides a description of the process to identify RMAs and includes specific examples of RMAs.

2.3 Proposed Technical Specification and License Condition Changes APS proposes the addition of the following conditions to the PVNGS renewed operating licenses of Units 1, 2, and 3 to address the scope of the PRA methods approved by the NRC staff for use in the PVNGS RICT program.

1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.

2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Additionally, APS requests that license conditions implemented by license amendment (LA) numbers 171 and 200 be deleted because these conditions are no longer applicable.

LA number 171 adopted TSTF-448 which provided a schedule for implementation of various control room habitability tests. These tests have been completed therefore this license condition is no longer applicable.

LA number 200 authorized the Unit 3 train B emergency diesel generator (EDG) extended required action completion time which is no longer applicable.

APS proposes certain changes to the original LAR (Reference 1). These proposed differences between the PVNGS original LAR and this LAR supplement are provided in Table 1 -

Supplement Summary Table.

3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 1 1.3 Changes to the example in TS section 1.3 reflect a loss of function similar to the RICT lead plant Completion Times submittal.

2 3.3.4 This LCO is no longer included in the RICT LAR supplement, primarily since it is not modeled in PRA.

Reactor Protective This is consistent with how it was communicated to the NRC in reference 2.

System (RPS) Logic and Trip Initiation 3 3.3.6 This LCO is included in the RICT LAR supplement, with changes:

Engineered Safety

Condition A (matrix logic) is no longer included since it is not modeled in PRA.

Features Actuation

Condition B is being kept (one channel of manual trip or ESFAS initiation logic).

System (ESFAS)

Condition C is no longer included (loss of function for instrumentation).

Logic and Manual

Condition D is being kept (one channel of ESFAS actuation logic).

Trip

Condition E is no longer included (loss of function for instrumentation).

4 3.4.9 This LCO is no longer included in the RICT LAR supplement since the pressurizer heaters are not modeled in PRA.

Pressurizer 5 3.4.10 This LCO is included in the RICT LAR supplement, similar to the RICT lead plant submittal.

Pressurizer Safety

Condition A is for one PSV being inoperable and the appropriate loss of function (LOF) notes Valves (PSV) - have been added.

Modes 1, 2, and 3 4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 6 3.4.12 This LCO is included in the RICT LAR supplement. The pressurizer vent paths are modeled in the PRA Pressurizer Vents and credited in the PVNGS safety analysis for the steam generator tube rupture event as described in updated final safety analysis report (UFSAR) section 15.6.3. The pressurizer vent TS at PVNGS has similarities to the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed in the RICT lead plant submittal:

Condition A for two or three vents paths is being kept.

Condition B for all vents paths inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the last pressurizer vent path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the last pressurizer vent path, as opposed to all vent paths, that renders the RICT not applicable.

7 3.5.1 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant Safety Injection submittal Accumulator TS:

Tanks (SIT) -

Condition A for a SIT inoperable due to boron concentration not within limits is no longer in RICT Operating scope since it is a parameter.

Condition B for one SIT inoperable for reasons other than boron is also not in scope since the loss of a SIT is a loss of function condition which would be limited to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and PVNGS already has a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time.

Condition C for two or more SITs being inoperable for reasons other than boron is being kept similar to the RICT lead plant submittal approval. This is a loss of function condition with the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent SIT, as opposed to two or more SITs, intentionally made inoperable that render the condition being not applicable.

5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 8 3.5.3 This LCO is included in the RICT LAR supplement but has changes:

ECCS - Operating

Condition A for one low pressure safety injection (LPSI) subsystem inoperable is kept. The RICT lead plant submittal did not have this condition in their TS.

Condition B is kept but has changes. This is for one or more ECCS trains being inoperable AND at least 100% of the flow equivalent to one train being available. The portion after the AND is now kept in the TS similar to the RICT lead plant submittal to ensure it is not a loss of function.

Condition C is no longer included since it is only for less than 100% of flow available.

9 3.5.5 This LCO is included in the RICT LAR supplement but has changes:

Refueling Water Tank

Condition A for the RWT being inoperable for boron or temperature not within limits is no longer in (RWT) the RICT scope since they are parameters.

Condition B for the RWT being inoperable for reasons other than Condition A is being kept. It is a loss of function and all appropriate notes have been added, this is similar to the RICT lead plant submittal.

10 3.6.2 This LCO is included in the RICT LAR supplement without any changes:

Containment Air

Only Condition C is in the scope of RICT and is for the airlock being inoperable for reasons other Locks than Condition A (one door in the airlock inoperable) or B (interlock mechanism inoperable). There is already a required action in Condition C to evaluate overall containment leakage rate is per TS 3.6.1 so this is not a loss of function condition, this is similar to the RICT lead plant submittal.

6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 11 3.6.3 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Containment Isolation Valves (CIVs)

Condition A for one CIV inoperable is being kept.

Condition B for two CIVs in the same penetration is being kept and the appropriate LOF notes have been added. The wording of note 2 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CIV is intentionally made inoperable since this condition is part of the current licensing basis. Also, the wording was changed to be more precise that it is the second CIV, as opposed to the first two CIVs, that renders the RICT not applicable.

Condition C for one CIV inoperable in penetrations with only one CIV and a closed system inside containment is being kept. This is not a loss of function condition due to the closed system inside containment.

Condition D for one or more containment purge (CP) valves having leakage above their limit is being kept in RICT scope. The loss of function notes have been added with a clarifier that the notes only apply when there is a loss of function condition since if there is one CP valve operable, it would not be a loss of function condition. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CP valve is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second CP valve, as opposed to the first two, that renders the RICT not applicable.

12 3.6.6 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Containment Spray System

Condition A for one train of containment spray is being kept within the RICT scope.

Condition C for two trains is no longer included.

13 3.7.2 This LCO is included in the RICT LAR supplement but has changes:

Main Steam Isolation

Condition F for one MSIV inoperable in MODE 1 is being kept with no changes.

Valves (MSIVs)

Condition G for more than one MSIV inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was changed to be more precise that it is the second or a subsequent MSIV, as opposed to two or more MSIVs, intentionally made inoperable that render the condition being not applicable.

7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 14 3.7.3 This LCO is included in the RICT LAR supplement but has changes. The MFIVs are modeled in the PRA Main Feedwater and credited in the safety analysis to close during a steam line break and a feedwater line break:

Isolation Valves

Condition A for one or more MFIVs inoperable is being kept.

(MFIVs)

Condition B for two valves in the same flow path is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second valve in the affected flow path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second valve in the affected flow path, as opposed to the first two, that renders the RICT not applicable.

15 3.7.4 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

Atmospheric Dump

Condition A is being kept for one ADV (per SG) without any changes.

Valves (ADVs)

Condition B is being kept but has a clarifier on the applicability of the loss of function notes since if one ADV is operable (with as many as three being inoperable) it is not a loss of function. With all four ADVs inoperable, it is a loss of function condition. The wording of note 1 was changed to be more precise that it is the last ADV, as opposed to all ADVs, intentionally made inoperable that renders the condition not applicable.

16 3.7.5 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Auxiliary Feedwater (AFW) System

Condition A for one steam supply inoperable is being kept.

Condition B for one AFW train inoperable for reasons other than condition A is being kept.

Condition C for two AFW trains inoperable is being kept. It is a loss of function condition that has the appropriate notes added along with a clarifier since if one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function. The wording of note 1 was changed to be more precise that it is the second AFW train, as opposed to two AFW trains, being inoperable that renders the condition not applicable.

17 3.7.6 This LCO is no longer included in the RICT LAR supplement primarily since it is a single train system that Condensate Storage was not within the RICT lead plant submittal.

Tank (CST) 8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 18 3.7.7 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Essential Cooling Water (EW) System

Condition A for one train of EW inoperable is being kept.

Condition B for two trains of EW inoperable is being kept but is a loss of function condition that has the appropriate notes added.

19 3.7.8 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Essential Spray Pond System (ESPS)

Condition A for one train of ESPS inoperable is being kept.

Condition B for two trains of ESPS inoperable is being kept but is a loss of function condition that has the appropriate notes added.

20 3.7.9 This LCO is no longer included in RICT LAR supplement, primarily since it is a single train system.

Ultimate Heat Sink (UHS) 21 3.7.10 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Essential Chilled Water (EC) System

Condition A for one train of EC inoperable is being kept.

Condition B for two trains of EC inoperable is being kept but is a loss of function condition that has the appropriate notes added.

22 3.7.12 This LCO is no longer included in the RICT LAR supplement, primarily since Condition A for one train Control Room inoperable already allows 30 days to restore and Condition B for two trains inoperable was not within the Emergency Air RICT lead plant submittal.

Temperature Control System (CREATCS) 9

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 23 3.8.1 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

AC Sources -

Condition A for one offsite circuit inoperable is being kept without changes.

Operating

Condition B for one diesel generator (DG) inoperable is being kept without changes. The Note above the 10 day Completion Time regarding License Amendment 200 is being deleted since it is no longer applicable.

Condition C for two offsite circuits inoperable is being kept without changes.

Condition D for one offsite circuit and one DG inoperable stays without changes.

Condition E for two DGs inoperable is being kept but has loss of function notes added. Note 1 was modified to be more precise that it is the second diesel generator, not two diesel generators, that renders the condition not applicable.

Condition F for one DG Sequencer inoperable is being kept without changes.

Old Condition I for three or more required alternate current (AC) sources inoperable is being kept in the RICT scope but changes to be a loss of function and designate it as new condition H. The wording of note 1 was changed to be more precise in that it is the third or a subsequent required AC source, as opposed to three or more required AC sources, intentionally made inoperable that renders the condition being not applicable.

24 3.8.4 This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

DC Sources -

Condition A for one battery charger on a subsystem inoperable is being kept in RICT scope.

Operating However, required Action A.1 for restoring the battery terminal voltage to greater than minimum float voltage is no longer included in the RICT scope because it is a parameter. Only required action A.3 for restoring the battery charger to operable status stays.

Condition B for one direct current (DC) electrical power subsystem being inoperable for reasons other than Condition A is being kept.

Condition C for two DC electrical subsystems being inoperable is being kept but is a loss of function condition that has all of the appropriate LOF notes added. The wording on note 1 was changed to be more precise that it is the second DC electrical subsystem, not two DC electrical subsystems, intentionally made inoperable that renders the condition being not applicable.

10

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table ITEM # PVNGS Limiting Description of Change in this LAR supplement Condition of Operation (LCO) 25 3.8.7 This LCO is included in the RICT LAR supplement but has changes:

Inverters - Operating

Condition A for one inverter being inoperable is being kept.

Condition B for two or more inverters being inoperable stays in scope but has a clarifier since this condition does not always result in a loss of function. PVNGS design has two trains of inverters with a total of four inverters channels A, B, C and D. Channels A and C are train A. Channels B and D are train B. If two inverters in the same train are inoperable and the other two inverters on the opposite train remain operable, it is not a loss of function. The wording of note 1 was changed to be more precise that it is the second or a subsequent required inverter, as opposed to two or more required inverters, intentionally made inoperable that renders the Condition being not applicable.

26 3.8.9 This LCO is included in the RICT LAR supplement but has changes:

Distribution Systems -

Condition A for one AC electrical power distribution subsystem being inoperable is being kept.

Operating

Condition B for one AC vital instrument bus being inoperable is being kept.

Condition C for one DC electrical power distribution subsystem is being kept

New Condition D for two or more electrical power distribution subsystems being inoperable is being kept in scope but is a loss of function condition and has the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent electrical power distribution subsystem, as opposed to two or more electrical power distribution subsystems, intentionally made inoperable that renders the Condition being not applicable.

27 5.5.20 The TS program for risk informed completion time is included with changes to coincide with the TS program language from the RICT lead plant with minor changes. Editorial changes were made on the Risk-Informed pages for the Battery Monitoring Program of TS 5.5.19 to eliminate reference to the SFP Transition.

Completion Time Program 11

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 3.0 REGULATORY SAFETY ANALYSIS APS has evaluated the proposed change to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.

APS requests adoption of the proposed changes to the TS and plant specific TS, to modify the TS requirements related to completion times for required actions to provide the option to calculate RICT based on risk levels associated with equipment determined to be inoperable that are within the scope of the RICT program. The allowance is described in a new program in TS Section 5, Administrative Controls, entitled Risk Informed Completion Time Program. The proposed RICT program conforms to the NRC model safety evaluation, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, dated May 17, 2007 (References 4 and 6). of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1.

As required by 10 CFR 50.91(a), Notice for Public Comment, an analysis of the issue of no significant hazards consideration was provided in the original license amendment request.

This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR (Reference 1).

4.0 ENVIRONMENTAL CONSIDERATION

APS has reviewed the environmental evaluation included in the model safety evaluation published on March 15, 2012, as part of the Notice of Availability (77 FR 15399). APS has concluded that the NRC staff findings presented in that evaluation are applicable to PVNGS.

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, Standards for Protection Against Radiation, or would change an inspection or surveillance requirement.

However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review. Therefore, pursuant to 10 CFR 51.22, no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

12

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

References:

1. Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 (ADAMS Accession Number ML15218A300)

2. APS Letter 102-07227, Response to Request for Additional Information Regarding License Amendment Request to Adopt TSTF-505, dated April 11, 2016 (ADAMS Accession Number ML16102A463)

3. Vogtle Electric Generating Plant Units 1 and 2 - Issuance of Amendments Regarding implementation of Topical Report Nuclear Energy Institute NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specification (RMTS) Guidelines, Revision 0-A, dated August 8, 2017 (ADAMS Accession Number ML15127A669)

4. Nuclear Energy Institute (NEI) 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines (NEI 06-09-A), dated November 13, 2006 (ADAMS Accession Number ML12286A322)

5. Issues with Technical Specification Task Force Traveler TSTF-505, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B, dated November 15, 2016 (ADAMS Accession Number ML16300A245)

6. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-informed Technical Specifications initiative 4B, Risk-Managed Technical Specifications (RMT) Guideline (TAC NO. MD4995), dated May 17, 2007 (ADAMS Accession Number ML071200238) 13

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 1 Proposed Technical Specification Changes TS Mark-up Pages 1.3-13 3.7.7-1 3.3.6-1 3.7.8-1 3.3.6-2 3.7.10-1 3.4.10-1 3.8.1-2 3.4.12-1 3.8.1-3 3.5.1-1 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.4-1 3.6.2-3 3.8.7-1 3.6.3-1 3.8.7-2 3.6.3-2 3.8.9-1 3.6.3-3 3.8.9-2 3.6.3-4 5.5-19 3.6.6-1 5.5-19a 3.7.2-2 3.7.3-1 3.7.4-1 3.7.5-1 3.7.5-2

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, Insert 1 provided the Completion Time for Required Action A.2 has not expired.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a controlled manner.

PALO VERDE UNITS 1,2,3 1.3-13 AMENDMENT NO. 117

INSERT 1 (1.3-13)

EXAMPLES EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem to 7 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. ------NOTES------ B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable subsystem to OPERABLE when second status. OR subsystem intentionally In accordance made inoperable. with the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two subsystems inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not AND met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.

INSERT 1 (1.3-13 continued)

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two Notes. The first note states it is not applicable if the second subsystem is intentionally made inoperable. The second Note provides restrictions applicable to these "loss of function" Conditions.

The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service. The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply a RICT or to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and Condition B is not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant conditions result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.

ESFAS Logic and Manual Trip 3.3.6 3.3 INSTRUMENTATION 3.3.6 Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1.

APPLICABILITY: According to Table 3.3.6-1.

ACTIONS

NOTE-------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Matrix Logic OPERABLE status.

channel inoperable.

OR Three Matrix Logic channels are inoperable due to a common power source failure de-energizing three matrix power supplies.

B. One or more Functions B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Manual Trip OPERABLE status.

or Initiation Logic channel inoperable. Insert 2 (continued)

PALO VERDE UNITS 1,2,3 3.3.6-1 AMENDMENT NO. 117

INSERT 2 OR In accordance with the Risk Informed Completion Time Program Reviewers Note:

The Insert 2 is used repeatedly throughout this package. The insert will not be provided as a separate page every time it is used. This will be the only time the insert page will follow the marked-up TS page.

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions C.1 Open at least one Immediately with two Initiation contact in the Logic channels or affected trip leg of Manual Trip channels both ESFAS Actuation affecting the same Logics.

trip leg inoperable. AND C.2 Restore channels to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

D. One or more Functions D.1 --------NOTE---------

with one Actuation One channel of Logic channel Actuation Logic may inoperable. be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillances, provided the other channel is OPERABLE.

Restore inoperable 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months channel to OPERABLE status. Insert 2 E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Conditions for Containment Spray Actuation Signal, Main E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Steam Isolation Signal or Auxiliary Feedwater Actuation Signal not met.

(continued)

PALO VERDE UNITS 1,2,3 3.3.6-2 AMENDMENT NO. 117

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves - Modes 1, 2 and 3 LCO 3.4.10 Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.

APPLICABILITY: MODES 1, 2, and 3,

NOTE----------------------------

The lift settings are not required to be within LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions.

This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME Insert 3 A. One pressurizer safety A.1 Restore valve to 15 minutes valve inoperable. OPERABLE status.

Insert 2 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND OR B.2 Be in MODE 4 . 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Two or more pressurizer safety valves inoperable.

PALO VERDE UNITS 1,2,3 3.4.10-1 AMENDMENT NO. 117

INSERT 3 (3.4.10-1)

NOTES------------------------------

1. Not applicable when pressurizer safety valve intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Pressurizer Vents 3.4.12 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

MODE 4 with RCS pressure q 385 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required A.1 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer vent paths pressurizer vent inoperable. paths to OPERABLE status. Insert 2 Insert 4 B. All pressurizer vent B.1 Restore one 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months paths inoperable. pressurizer vent path to OPERABLE status. Insert 2 C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition A, or B not met.

C.2 Be in MODE 4 with RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months pressure < 385 psia.

PALO VERDE UNITS 1,2,3 3.4.12-1 AMENDMENT NO. 117, 188

INSERT 4 (3.4.12-1)

NOTES------------------------------

1. Not applicable when last pressurizer vent path intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

SITs-Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODES 3 and 4 with pressurizer pressure q 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due A.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration OPERABLE status.

not within limits.

OR One SIT inoperable due to inability to verify level or pressure.

B. One SIT inoperable for B.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status.

Condition A.

Insert 5 D C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND D

or B not met.

C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

, B, or C pressure to D < 1837 psia.

D. Two or more SITs D.1 Enter LCO 3.0.3. Immediately inoperable.

PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 117, 118

INSERT 5 (3.5.1-1)

C. ----- NOTES ----- C.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months SIT to OPERABLE status.

1. Not applicable OR when the second or a subsequent SIT intentionally In accordance made inoperable. with the Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons other than Condition A.

ECCS Operating 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure q 1837 psia or with RCS Tc q 485°F.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem A.1 Restore subsystem to 7 days inoperable. OPERABLE status. Insert 2 B. One or more trains B.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A. Insert 2 AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.

C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 1837 psia.

AND C.3 Reduce RCS Tc to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

< 485°F.

PALO VERDE UNITS 1,2,3 3.5.3-1 AMENDMENT NO. 117, 124

RWT 3.5.5 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.5 Refueling Water Tank (RWT)

LCO 3.5.5 The RWT shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron A.1 Restore RWT to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months concentration not OPERABLE status.

within limits.

OR RWT borated water temperature not within limits.

Insert 6 B. RWT inoperable for B.1 Restore RWT to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months reasons other than OPERABLE status.

Condition A. Insert 2 C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.5.5-1 AMENDMENT NO. 117

INSERT 6 (3.5.5-1)

NOTES------------------------------

1. Not applicable when RWT is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Containment Air Locks 3.6.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.1 Verify an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.

AND B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.

AND B.3 --------NOTE---------

Air lock doors in high radiation areas may be verified locked closed by administrative means.

Verify an OPERABLE Once per 31 days door is locked closed in the affected air lock.

C. One or more C.1 Initiate action to Immediately containment air locks evaluate overall inoperable for reasons containment leakage other than Condition A rate per LCO 3.6.1.

or B. AND C.2 Verify a door is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months closed in the affected air lock.

AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

Insert 2 (continued)

PALO VERDE UNITS 1,2,3 3.6.2-3 AMENDMENT NO. 117

Containment Isolation Valves 3.6.3 3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

NOTES-----------------------------------

1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path.

3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves.

4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.

5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in accordance with SR 3.6.1.1.

CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE--------- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path penetration flow paths by use of at least with two required one closed and Insert 2 containment isolation de-activated valves. automatic valve,

closed manual valve, blind flange, or One or more check valve with flow penetration flow paths through the valve with one required secured.

containment isolation valve inoperable AND except for purge valve leakage not within limit.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-1 AMENDMENT NO. 117, 166

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------NOTE---------

Isolation devices in high radiation areas may be verified by use of administrative following means. isolation Verify the affected Once per 31 days penetration flow path for isolation is isolated. devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment S

B. ---------NOTE--------- B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Only applicable to penetration flow path penetration flow paths by use of at least Insert 2 with two required one closed and Insert 7 containment isolation de-activated valves. automatic valve,

closed manual valve, or blind flange.

One or more penetration flow paths with two required containment isolation valves inoperable except for purge valve leakage not within limit.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO. 117, 166

INSERT 7 (3.6.3-2)

2. RICT is not applicable when the second containment isolation valve is intentionally made inoperable.

3. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. ---------NOTE--------- C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path penetration flow paths by use of at least Insert 2 with only one required one closed and containment isolation de-activated valve and a closed automatic valve, system. closed manual valve,

or blind flange.

One or more AND penetration flow paths with one required C.2 --------NOTE---------

containment isolation Isolation devices in valve inoperable. high radiation areas may be verified by use of administrative following means. isolation Verify the affected Once per 31 days penetration flow path Insert 8 is isolated.

D. One or more D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months penetration flow paths penetration flow path with one or more by use of at least Insert 2 required containment one closed and purge valves not de-activated within purge valve automatic valve with leakage limits. resilient seals, or blind flange.

AND (continued)

PALO VERDE UNITS 1,2,3 3.6.3-3 AMENDMENT NO. 117, 166

INSERT 8 (3.6.3-3)

NOTES------------------------------

1. RICT is not applicable when the second containment purge valve is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 --------NOTE---------

Isolation devices in high radiation areas may be verified by use of administrative following means. isolation Verify the affected Once per 31 days penetration flow path for isolation is isolated. devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment AND D.3 Perform SR 3.6.3.6 Once per 92 days for the resilient seal purge valves following closed to comply with isolation Required Action D.1.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.6.3-4 AMENDMENT NO. 117

Containment Spray System 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

MODE 4 when RCS pressure is q 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray A.1 Restore containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable. spray train to OPERABLE status. Insert 2 B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met.

B.2 Be in MODE 4 with RCS 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months pressure < 385 psia.

C. Two containment spray C.1 Enter LCO 3.0.3. Immediately trains inoperable.

PALO VERDE UNITS 1,2,3 3.6.6-1 AMENDMENT NO. 117

MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV E.1 Declare each affected Immediately actuator trains MSIV inoperable.

inoperable.

OR Required Action and associated Completion Time of Condition A, B, or C not met.

F. One MSIV inoperable in F.1 Restore MSIV to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months MODE 1. OPERABLE status.

Insert 2 Insert 9 G. Required Action and G.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion H Time of Condition F H not met. or G I

H. ---------NOTE--------- H.1 Close MSIV. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Separate Condition I entry is allowed for AND each MSIV.

H.2 Verify MSIV is Once per 7 days closed.

One or more MSIVs I inoperable in MODE 2, 3, or 4.

J I. Required Action and I.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion J Time of Condition H AND not met.

I I.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months J

PALO VERDE UNITS 1,2,3 3.7.2-2 AMENDMENT NO. 117, 163

INSERT 9 (3.7.2-2)

G. ----- NOTES ----- G.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months MSIV to OPERABLE status.

1. Not applicable OR when the second or a subsequent MSIV In accordance intentionally with the Risk made inoperable. Informed Completion Time Program

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two or more MSIVs inoperable in MODE 1.

MFIVs 3.7.3 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)

LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power operated valve.

ACTIONS

NOTE------------------------------------

Separate Condition entry is allowed for each penetration flow path.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs A.1 Close or isolate 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. inoperable MFIV.

Insert 10 AND A.2 Verify inoperable Once per 7 days MFIV is closed or isolated.

B. Two valves in the B.1 Isolate affected flow 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months same flow path path.

inoperable.

AND B.2 Verify inoperable Once per 7 days MFIV is closed or isolated.

(continued)

PALO VERDE UNITS 1,2,3 3.7.3-1 AMENDMENT NO. 117 158

INSERT 10 (3.7.3-1)

A.1 Restore MFIV(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR OR In accordance with the Risk Informed Completion Time Program A.2.1 Close or isolate inoperable 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months MFIV(s).

AND A.2.2 Verify inoperable Once per 7 days MFIV(s) is closed following Isolation or isolated.

B. ----- NOTES ------

1. RICT is not B.1 Restore one valve 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months applicable when to OPERABLE the second valve status. OR in the affected flow path is In accordance with intentionally OR the Risk Informed made inoperable. Completion Time Program

2. The following Section 5.5.20 constraints are B.2.1 Isolate affected 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months applicable: parts flow path.

b, c.2, c.3, d, e, f, g, and h. AND Two valves in the B.2.2 Verify inoperable Once per 7 days same flow path MFIV(s) is closed following Isolation inoperable. or isolated.

ADVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)

LCO 3.7.4 Four ADV lines shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------

Separate Condition A.1 Restore ADV line to 7 days entry is allowed for OPERABLE status.

each SG. Insert 2 One required ADV line inoperable.

Insert 11 B. Two or more ADV lines B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months inoperable with both to OPERABLE status on ADV lines inoperable each SG.

on one or more SGs.

Insert 2 C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat removal.

PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 165, 191 (CORRECTED PAGE)

INSERT 11 (3.7.4-1)

NOTES------------------------------

1. Not applicable when the last ADV intentionally made inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.

NOTE----------------------------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS

NOTE-------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to A.1 Restore affected 7 days turbine driven AFW equipment to OPERABLE pump inoperable. status. Insert 2 OR

NOTE---------

Only applicable if MODE 2 has not been entered following refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A Insert 2 in MODE 1, 2, or 3.

(continued)

PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. 165, 197

AFW System 3.7.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME Insert 12 D C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion D Time of Condition A AND or B not met.

, B, or C C.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR D

Two AFW trains inoperable in MODE 1, 2, or 3 D. Three AFW trains D.1 --------NOTE---------

inoperable in MODE 1, LCO 3.0.3 and all E 2, or 3. other LCO Required E Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to Immediately restore one AFW train to OPERABLE status.

E. Required AFW train E.1 --------NOTE---------

inoperable in MODE 4. LCO 3.0.3 and all F F other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to Immediately restore one AFW train to OPERABLE status.

PALO VERDE UNITS 1,2,3 3.7.5-2 AMENDMENT NO. 117

INSERT 12 (3.7.5-2)

C. ----- NOTES ----- C.1 Restore at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months one AFW train to OPERABLE status.

1. Not applicable OR when second AFW train intentionally In accordance made inoperable with the Risk resulting in loss Informed of safety Completion Time function. Program

2. The following Section 5.5.20 constraints are applicable when there is a loss of function:

parts b, c.2, c.3, d, e, f, g, and h.

Two AFW trains inoperable in MODE 1, 2, or 3.

EW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Essential Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train A.1 --------NOTE---------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4" for shutdown cooling made inoperable by EW.

Restore EW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

Insert 2 Insert 13 C B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion C Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C

PALO VERDE UNITS 1,2,3 3.7.7-1 AMENDMENT NO. 117

INSERT 13 (3.7.7-1)

B. ----- NOTES ----- B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months EW train to OPERABLE status.

1. Not applicable OR when second EW train intentionally In accordance made inoperable. with the Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two EW trains inoperable.

ESPS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train A.1 --------Notes--------

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1.

AC Sources Operating, for emergency diesel generator made inoperable by ESPS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6.

RCS Loops MODE 4, for shutdown cooling made inoperable by ESPS.

Restore ESPS train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

Insert 2 Insert 14 C B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion C Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C

PALO VERDE UNITS 1,2,3 3.7.8-1 AMENDMENT NO. 117

INSERT 14 (3.7.8-1)

B. ----- NOTES ----- B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ESPS train to OPERABLE status.

1. Not applicable OR when second ESPS train intentionally In accordance made inoperable. with the Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two ESPS trains inoperable.

EC 3.7.10 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train A.1 Restore EC train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

Insert 2 Insert 15 C B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C

B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power In accordance operated, and automatic valve in the flow with the path, that is not locked, sealed, or Surveillance otherwise secured in position, is in the Frequency correct position. Control Program SR 3.7.10.2 Verify the proper actuation of each EC In accordance System component on an actual or simulated with the actuation signal. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.10-1 AMENDMENT NO. 117, 188

INSERT 15 (3.7.10-1)

B. ----- NOTES ----- B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months EC train to OPERABLE status.

1. Not applicable OR when second EC train intentionally In accordance made inoperable. with the Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two EC trains inoperable.

AC Sources Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. Insert 2 B. One DG inoperable. B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for the OPERABLE AND required offsite circuit(s). Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported discovery of by the inoperable DG Condition B inoperable when its concurrent with redundant required inoperability of feature(s) is redundant inoperable. required feature(s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG is not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG.

AND (continued)

PALO VERDE UNITS 1,2,3 3.8.1-2 AMENDMENT NO. 164, 197

AC Sources Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME Deleted B. (continued) B.4 Restore DG -------NOTE------ NOTE to OPERABLE For the Unit 3 from LA status. Train B DG failure 200 on December 15, 2016, restore the inoperable DG to OPERABLE status within 62 days.

10 days Insert 2 C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) discovery of inoperable when Condition C its redundant concurrent with required inoperability of feature(s) is redundant required inoperable. feature(s)

AND C.2 Restore one 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months required offsite circuit to Insert 2 OPERABLE status.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO. 197, 200

AC Sources Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite ------------NOTE-------------

circuit inoperable. Enter applicable Conditions AND and Required Actions of LCO 3.8.9, "Distribution One DG inoperable. Systems Operating," when Condition D is entered with no AC power source to a train.

D.1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuits to Insert 2 OPERABLE status.

OR D.2 Restore DG 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to OPERABLE status. Insert 2 Insert 16 E. Two DGs inoperable. E.1 Restore one DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status. Insert 2 F. One automatic load F.1 Restore automatic 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months sequencer inoperable. load sequencer to OPERABLE status. Insert 2 AND F.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported discovery of by the inoperable Condition F sequencer inoperable concurrent with when its redundant inoperability of required feature(s) redundant is inoperable. required feature(s)

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO. 117

INSERT 16 (3.8.1-4)

NOTES------------------------------

1. Not applicable when second DG intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

AC Sources Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. --------NOTE-------- G.1 Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Condition G is not capability of the applicable for Class offsite circuit(s).

1E bus(es) provided with a two stage time OR delay for the degraded voltage relays and a fixed time delay for the loss of voltage relays.

One or more required offsite circuit(s) do not meet required capability.

NOTE------------

Enter LCO 3.8.1 Condition A or C for required offsite circuit(s) inoperable.

G.2 Transfer the ESF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months bus(es) from the offsite circuit(s) to Insert 17 the EDG(s).

I H. Required Action and H.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion AND I Time of Condition A, B, C, D, E, F, or G not met. H.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months G or H I I. Three or more I.1 Enter LCO 3.0.3. Immediately required AC sources inoperable.

PALO VERDE UNITS 1,2,3 3.8.1-5 AMENDMENT NO. 123, 201

INSERT 17 (3.8.1-5)

H. ----- NOTES ----- H.1 Restore required AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months source(s) to OPERABLE status.

1. Not applicable OR when the third or a subsequent required AC In accordance source with the Risk intentionally Informed made inoperable. Completion Time Program

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Three or more required AC sources inoperable.

DC Sources Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on A.1 Restore battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months one subsystem terminal voltage to inoperable. greater than or equal to the minimum established float voltage.

AND A.2 Verify battery float Once per 12 FXUUHQWDPSV hours AND A.3 Restore battery 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months charger to OPERABLE status.

Insert 2 B.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months B. One DC electrical power subsystem to power subsystem Insert 2 OPERABLE status .

inoperable for reasons other than Condition A.

Insert 18 D C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months D

PALO VERDE UNITS 1,2,3 3.8.4-1 AMENDMENT NO. 117, 193

INSERT 18 (3.8.4-1)

C. ----- NOTES ----- C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months DC electrical power subsystem to

1. Not applicable OR OPERABLE status.

when second DC electrical power subsystem In accordance intentionally with the Risk made inoperable. Informed Completion Time Program

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Two DC electrical power subsystems inoperable.

Inverters Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.

NOTE----------------------------

One inverter may be disconnected from its associated DC bus for a 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and

b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter A.1 ---------NOTE---------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems - Operating" with any vital instrument bus de-energized.

Restore inverter to 7 days OPERABLE status.

Insert 2 (continued)

PALO VERDE UNITS 1,2,3 3.8.7-1 AMENDMENT NO. 117 180

Inverters Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME Insert 19 C B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion C Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, In accordance and alignment to required AC vital with the instrument buses. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.7-2 AMENDMENT NO. 117, 188

INSERT 19 (3.8.7-2)

B. ----- NOTES ----- B.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inverter to OPERABLE status.

1. Not applicable OR when the second or a subsequent required In accordance inverter with the Risk intentionally Informed made inoperable Completion Time resulting in Program loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function:

parts b, c.2, c.3, d, e, f, g, and h.

Two or more required inverters inoperable.

Distribution Systems Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical A.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution Insert 2 subsystem inoperable. subsystem to OPERABLE status.

B. One AC vital B.1 Restore AC vital 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months instrument bus instrument bus electrical power electrical power distribution subsystem distribution inoperable. subsystem to OPERABLE status. Insert 2 (continued)

PALO VERDE UNITS 1,2,3 3.8.9-1 AMENDMENT NO. 117 197

Distribution Systems Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One DC electrical C.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power distribution power distribution subsystems inoperable. subsystem to OPERABLE Insert 2 status.

Insert 20 E D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.

E D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months E

E. Two or more inoperable E.1 Enter LCO 3.0.3. Immediately distribution subsystems that result in a loss of safety function.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and In accordance voltage to required AC, DC, and AC vital with the instrument bus electrical power Surveillance distribution subsystems. Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.9-2 AMENDMENT NO. 188, 197

INSERT 20 (3.8.9-2)

D. ----- NOTES ----- D.1 Restore electrical 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months power distribution subsystem(s) to

1. Not applicable OR OPERABLE status.

when the second or a subsequent electrical power In accordance distribution with the Risk subsystem Informed intentionally Completion Time made inoperable Program resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function:

parts b, c.2, c.3, d, e, f, g, and h.

Two or more electrical power distribution subsystems inoperable.

Before SFP transition Programs and Manuals 5.5 Delete 5.5 Programs and Manuals (continued) 5.5.19 Battery Monitoring and Maintenance Program (continued)

4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, State of Charge Indicator, the following statements in paragraph (d) may be omitted: When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full charge. These measurements shall be made after the initially high charging current decreases sharply and the battery voltage rises to approach the charger output voltage.

5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, Restoration, the following may be used: Following the test, record the float voltage of each cell of the string.

b. The program shall include the following provisions:

1. Actions to restore battery cells with float voltage < 2.13 V;

2. Actions to determine whether the float voltage of the UHPDLQLQJEDWWHU\FHOOVLV9ZKHQWKHIORDWYROWDJHRID

battery cell has been found to be < 2.13 V;

3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates;

4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and

5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.

(continued)

PALO VERDE UNITS 1,2,3 5.5-19 AMENDMENT NO. 193, 203

After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.19 Battery Monitoring and Maintenance Program (continued)

4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, State of Charge Indicator, the following statements in paragraph (d) may be omitted: When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full charge. These measurements shall be made after the initially high charging current decreases sharply and the battery voltage rises to approach the charger output voltage.

5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, Restoration, the following may be used: Following the test, record the float voltage of each cell of the string.

b. The program shall include the following provisions:

1. Actions to restore battery cells with float voltage < 2.13 V;

2. Actions to determine whether the float voltage of the remaining batWHU\FHOOVLV13 V when the float voltage of a battery cell has been found to be < 2.13 V;

3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates;

4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and

5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.

Insert 21 5.5.20 Not Used PALO VERDE UNITS 1,2,3 5.5-19a AMENDMENT NO. 193, 203

INSERT 21 (5.5-20) 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09 (Revision 0) - A, Risk-Managed Technical Specifications (RMTS) Guidelines. The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered PRA functional as defined in Section 2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

INSERT 21 continued

f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0) - A. However, the following additional constraints shall be applied to the criteria for "PRA Functional."

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

INSERT 21 continued

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC.

Documentation of RMAs shall be available for NRC review.

h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 2 Revised Technical Specification Pages (Clean copy) 1.3-13 3.7.5-5 1.3-14 3.7.7-1 1.3-15 3.7.7-2 3.3.6-1 3.7.8-1 3.3.6-2 3.7.8-2 3.4.10-1 3.7.10-1 3.4.10-2 3.7.10-2 3.4.12-1 3.8.1-1 3.4.12-2 3.8.1-2 3.5.1-1 3.8.1-3 3.5.1-2 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.1-6 3.6.2-3 3.8.1-7 3.6.3-1 3.8.1-8 3.6.3-2 3.8.1-9 3.6.3-3 3.8.1-10 3.6.3-4 3.8.1-11 3.6.3-5 3.8.1-12 3.6.3-6 3.8.1-13 3.6.3-7 3.8.1-14 3.6.6-1 3.8.1-15 3.7.2-2 3.8.1-16 3.7.2-3 3.8.1-17 3.7.3-1 3.8.1-18 3.7.3-2 3.8.4-1 3.7.4-1 3.8.4-2 3.7.4-2 3.8.4-3 3.7.5-1 3.8.4-4 3.7.5-2 3.8.7-1 3.7.5-3 3.8.7-2 3.7.5-4 3.8.9-1 3.8.9-2 3.8.9-3 5.5-20 5.5-21 5.5-22

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

EXAMPLES EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem to 7 days inoperable. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. --------NOTES------- B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable subsystem to OPERABLE when second status. OR subsystem intentionally In accordance with made inoperable. the Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two subsystems inoperable.

PALO VERDE UNITS 1,2,3 1.3-13 AMENDMENT NO. 117

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.

C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two Notes. The first note states it is not applicable if the second subsystem is intentionally made inoperable. The second Note provides restrictions applicable to these "loss of function" Conditions. The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service. The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply a RICT or to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and Condition B is not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

PALO VERDE UNITS 1,2,3 1.3-14 AMENDMENT NO.

Completion Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-8 (continued)

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant conditions result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a controlled manner.

PALO VERDE UNITS 1,2,3 1.3-15 AMENDMENT NO.

ESFAS Logic and Manual Trip 3.3.6 3.3 INSTRUMENTATION 3.3.6 Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1.

APPLICABILITY: According to Table 3.3.6-1.

ACTIONS

NOTE-----------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Matrix Logic OPERABLE status.

channel inoperable.

OR Three Matrix Logic channels are inoperable due to a common power source failure de-energizing three matrix power supplies.

B. One or more Functions B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Manual Trip or OPERABLE status.

Initiation Logic channel OR inoperable.

In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.3.6-1 AMENDMENT NO. 117

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions C.1 Open at least one Immediately with two Initiation Logic contact in the affected channels or Manual Trip trip leg of both ESFAS channels affecting the Actuation Logics.

same trip leg inoperable. AND C.2 Restore channels to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

D. One or more Functions D.1 -------------NOTE----------

with one Actuation Logic One channel of channel inoperable. Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillances, provided the other channel is OPERABLE.

Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Conditions for Containment Spray Actuation Signal, Main E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Steam Isolation Signal or Auxiliary Feedwater Actuation Signal not met.

(continued)

PALO VERDE UNITS 1,2,3 3.3.6-2 AMENDMENT NO. 117

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves - Modes 1, 2 and 3 LCO 3.4.10 Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.

APPLICABILITY: MODES 1, 2, and 3,

NOTE----------------------------

The lift settings are not required to be within LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions.

This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTES--------- A.1 Restore valve to 15 minutes OPERABLE status.

1. Not applicable when pressurizer safety OR valve intentionally made inoperable. In accordance with the Risk

2. The following Informed Section 5.5.20 Completion Time constraints are Program applicable: parts b, c.2, c.3, d, e, f, g, and h.

One pressurizer safety valve inoperable.

PALO VERDE UNITS 1,2,3 3.4.10-1 AMENDMENT NO. 117

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND OR B.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Two or more pressurizer safety valves inoperable.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is In accordance OPERABLE in accordance with the Inservice with the Testing Program. Following testing, lift Inservice settings shall be within +/- 1%. Testing Program PALO VERDE UNITS 1,2,3 3.4.10-2 AMENDMENT NO. 117

Pressurizer Vents 3.4.12 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

MODE 4 with RCS pressure 385 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required A.1 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer vent paths pressurizer vent inoperable. paths to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. --------NOTES--------- B.1 Restore one 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

1. Not applicable when pressurizer vent path last pressurizer to OPERABLE status.

OR vent path intentionally made inoperable. In accordance with the Risk

2. The following Informed Section 5.5.20 Completion Time constraints are Program applicable: parts b, c.2, c.3, d, e, f, g, and h.

All pressurizer vent paths inoperable.

PALO VERDE UNITS 1,2,3 3.4.12-1 AMENDMENT NO. 188,

Pressurizer Vents 3.4.12 ACTIONS (CONTINUED)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition A, or B not met.

C.2 Be in MODE 4 with RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months pressure < 385 psia.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.12.1 Perform a complete cycle of each In accordance Pressurizer Vent Valve. with the Surveillance Frequency Control Program SR 3.4.12.2 Verify flow through each In accordance pressurizer vent path. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.4.12-2 AMENDMENT NO. 188,

SITs-Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due A.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration OPERABLE status.

not within limits.

OR One SIT inoperable due to inability to verify level or pressure.

B. One SIT inoperable for B.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status.

Condition A.

C. --------NOTES-------- C.1 Restore all but one SIT 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable when to OPERABLE status.

the second or a OR subsequent SIT intentionally made inoperable. In accordance with the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons other than Condition A.

PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 118,

SITs-Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition A, B, or C not met.

D.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 1837 psia.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each SIT isolation valve is fully In accordance open. with the Surveillance Frequency Control Program SR 3.5.1.2 Verify borated water volume in each SIT is In accordance 28% narrow range and 72% narrow range. with the Surveillance Frequency Control Program SR 3.5.1.3 Verify nitrogen cover pressure in each SIT In accordance is 600 psig and 625 psig. with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.5.1-2 AMENDMENT NO. 188,

ECCS Operating 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.

APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure 1837 psia or with RCS Tc 485°F.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem A.1 Restore subsystem to 7 days inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One or more trains B.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status. OR other than Condition A.

AND In accordance with the Risk At least 100% of the Informed ECCS flow equivalent to Completion Time a single OPERABLE ECCS Program train available.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.

C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 1837 psia.

AND C.3 Reduce RCS Tc to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

< 485°F.

PALO VERDE UNITS 1,2,3 3.5.3-1 AMENDMENT NO. 124,

RWT 3.5.5 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.5 Refueling Water Tank (RWT)

LCO 3.5.5 The RWT shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron A.1 Restore RWT to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months concentration not OPERABLE status.

within limits.

OR RWT borated water temperature not within limits.

B. --------NOTES--------- B.1 Restore RWT to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OPERABLE status.

1. Not applicable OR when RWT is intentionally made inoperable. In accordance with the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

RWT inoperable for reasons other than Condition A.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.5.5-1 AMENDMENT NO. 117

Containment Air Locks 3.6.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.1 Verify an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.

AND B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.

AND B.3 --------NOTE---------

Air lock doors in high radiation areas may be verified locked closed by administrative means.

Verify an OPERABLE Once per 31 days door is locked closed in the affected air lock.

C. One or more C.1 Initiate action to Immediately containment air locks evaluate overall inoperable for reasons containment leakage other than Condition A rate per LCO 3.6.1.

or B. AND C.2 Verify a door is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months closed in the affected air lock.

AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.6.2-3 AMENDMENT NO. 117

Containment Isolation Valves 3.6.3 3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS

NOTES-----------------------------------

1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path.

3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves.

4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.

5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in accordance with SR 3.6.1.1.

CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE--------- A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path penetration flow paths by use of at least OR with two required one closed and containment isolation de-activated In accordance valves. automatic valve, with the Risk

closed manual valve, Informed blind flange, or One or more Completion Time check valve with flow penetration flow paths Program through the valve with one required secured.

containment isolation valve inoperable AND except for purge valve leakage not within limit.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-1 AMENDMENT NO. 166,

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------NOTE---------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path following is isolated. isolation for isolation devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment B. --------NOTES-------- B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Only applicable to penetration flow path penetration flow by use of at least one OR paths with two closed and de-activated required containment automatic valve, closed In accordance isolation valves. manual valve, or blind with the Risk flange.

2. RICT is not Informed applicable when the Completion Time second containment Program isolation valve is intentionally made inoperable.

3. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO. 166,

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

One or more penetration flow paths containment isolation valves inoperable except for purge valve leakage not within limit.

C. ---------NOTE--------- C.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months penetration flow path Only applicable to by use of at least one OR penetration flow paths closed and with only one required de-activated automatic containment isolation In accordance valve, closed manual valve and a closed with the Risk valve, or blind flange.

system. Informed

Completion Time AND Program One or more penetration flow paths C.2 --------NOTE---------

with one required Isolation devices in containment isolation high radiation areas valve inoperable. may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path following is isolated. isolation PALO VERDE UNITS 1,2,3 3.6.3-3 AMENDMENT NO. 166,

Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. ---------NOTES--------- D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

1. RICT is not penetration flow path applicable when the by use of at least OR second containment one closed and purge valve is de-activated In accordance intentionally made automatic valve with with the Risk inoperable. resilient seals, or Informed blind flange. Completion Time

2. The following Program Section 5.5.20 AND constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

One or more penetration flow paths with one or more required containment purge valves not within purge valve leakage limits.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-4 AMENDMENT NO. 117

Containment Isolation Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 --------NOTE---------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path following is isolated. isolation for isolation devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment AND D.3 Perform SR 3.6.3.6 Once per 92 days for the resilient following seal purge valves isolation closed to comply with Required Action D.1.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.6.3-5 AMENDMENT NO. 188

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.3.1 Verify each required 42 inch purge valve is In accordance sealed closed except for one purge valve in with the a penetration flow path while in Surveillance Condition D of this LCO. Frequency Control Program SR 3.6.3.2 Verify each 8 inch purge valve is closed In accordance except when the 8 inch purge valves are with the open for pressure control, ALARA or air Surveillance quality considerations for personnel entry, Frequency or for Surveillances that require the Control Program valves to be open.

SR 3.6.3.3 -------------------NOTE--------------------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

Verify each containment isolation manual In accordance valve and blind flange that is located with the outside containment and not locked, sealed Surveillance or otherwise secured and is required to be Frequency closed during accident conditions is Control Program closed, except for containment isolation valves that are open under administrative controls.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-6 AMENDMENT NO. 188,

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.6.3.4 -------------------NOTE--------------------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

Verify each containment isolation manual Prior to entering valve and blind flange that is located MODE 4 from MODE 5 inside containment and not locked, sealed if not performed or otherwise secured and required to be within the previous closed during accident conditions is 92 days closed, except for containment isolation valves that are open under administrative controls.

SR 3.6.3.5 Verify the isolation time of each required In automatic power operated containment accordance isolation valve is within limits. with the Inservice Testing Program SR 3.6.3.6 Perform leakage rate testing for required In accordance with containment purge valves with resilient the Surveillance seals. Frequency Control Program AND Within 92 days after opening the valve SR 3.6.3.7 Verify each required automatic containment In accordance with isolation valve that is not locked, sealed, the Surveillance or otherwise secured in position, actuates Frequency Control to the isolation position on an actual or Program simulated actuation signal.

PALO VERDE UNITS 1,2,3 3.6.3-7 AMENDMENT NO.

Containment Spray System 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

MODE 4 when RCS pressure is 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray A.1 Restore containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable. spray train to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A AND not met.

B.2 Be in MODE 4 with RCS 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months pressure < 385 psia.

C. Two containment spray C.1 Enter LCO 3.0.3. Immediately trains inoperable.

PALO VERDE UNITS 1,2,3 3.6.6-1 AMENDMENT NO. 117

MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV E.1 Declare each affected Immediately actuator trains MSIV inoperable.

inoperable.

OR Required Action and associated Completion Time of Condition A, B, or C not met.

F. One MSIV inoperable in F.1 Restore MSIV to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months MODE 1. OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program G. --------NOTES--------- G.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months MSIV to OPERABLE

1. Not applicable when status. OR the second or a subsequent MSIV intentionally made In accordance inoperable. with the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more MSIVs inoperable in MODE 1.

H. Required Action and H.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time of Condition F or G not met.

PALO VERDE UNITS 1,2,3 3.7.2-2 AMENDMENT NO. 163,

MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME I. ---------NOTE--------- I.1 Close MSIV. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Separate Condition AND entry is allowed for each MSIV. I.2 Verify MSIV is Once per 7 days

closed.

One or more MSIVs inoperable in MODE 2, 3, or 4.

J. Required Action and J.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition I AND not met.

J.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 -------------------NOTE--------------------

Not required to be performed prior to entry into MODE 3.

Verify closure time of each MSIV is In accordance within limits with each actuator train on with the an actual or simulated actuation signal. Inservice Testing Program PALO VERDE UNITS 1,2,3 3.7.2-3 AMENDMENT NO. 181

MFIVs 3.7.3 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)

LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power operated valve.

ACTIONS

NOTE------------------------------------

Separate Condition entry is allowed for each penetration flow path.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs A.1 Restore MFIV(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

OR In accordance with the Risk OR Informed Completion Time Program A.2.1 Close or isolate 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable MFIV(s).

AND A.2.2 Verify inoperable Once per 7 days MFIV(s) is closed or following isolated. Isolation PALO VERDE UNITS 1,2,3 3.7.3-1 AMENDMENT NO. 158

MFIVs 3.7.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES---------- B.1 Restore one valve to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status.

1. RICT is not OR applicable when the second valve in the OR In accordance affected flow path with the Risk is intentionally Informed made inoperable. Completion Time Program

2. The following Section 5.5.20 constraints are B.2.1 Isolate affected flow 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months applicable: parts b, path.

c.2, c.3, d, e, f, g, and h. AND Two valves in the same B.2.2 Verify inoperable Once per 7 days flow path inoperable. MFIV(s) is closed or following isolated. Isolation.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.3.1 Verify the closure time of each MFIV is In accordance within limits on an actual or simulated with the actuation signal. Inservice Testing Program PALO VERDE UNITS 1,2,3 3.7.3-2 AMENDMENT NO. 181

ADVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)

LCO 3.7.4 Four ADV lines shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------

Separate Condition A.1 Restore ADV line to 7 days entry is allowed for OPERABLE status. OR each SG.

In accordance with the Risk One required ADV line Informed inoperable. Completion Time Program B. --------NOTES--------- B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

1. Not applicable when to OPERABLE status on the last ADV each SG. OR intentionally made In accordance inoperable resulting with the Risk in loss of safety Informed function. Completion Time Program

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs.

PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 191, (CORRECTED PAGE)

ADVs 3.7.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat removal.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.4.1 Verify one complete cycle of each ADV. In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.4-2 AMENDMENT NO. 188,

AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.

NOTE----------------------------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS

NOTE-------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to A.1 Restore affected 7 days turbine driven AFW equipment to OPERABLE pump inoperable. status. OR OR In accordance

NOTE--------- with the Risk Only applicable if Informed MODE 2 has not been Completion Time entered following Program refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A OR in MODE 1, 2, or 3.

In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. 197,

AFW System 3.7.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. -------NOTES-------- C.1 Restore at least one AFW 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months train to OPERABLE status.

1. Not applicable when OR second AFW train intentionally made inoperable resulting In accordance in loss of safety with the Risk function. Informed Completion Time Program

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Two AFW trains inoperable in MODE 1, 2, or 3.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B AND or C not met.

D.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months PALO VERDE UNITS 1,2,3 3.7.5-2 AMENDMENT NO. 117

AFW System 3.7.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three AFW trains E.1 --------NOTE---------

inoperable in MODE 1, LCO 3.0.3 and all other 2, or 3. LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to restore one AFW train Immediately to OPERABLE status.

F. Required AFW train F.1 --------NOTE---------

inoperable in MODE 4. LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to restore one AFW train to Immediately OPERABLE status.

PALO VERDE UNITS 1,2,3 3.7.5-3 AMENDMENT NO. 188

AFW System 3.7.5 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.5.1 Verify each AFW manual, power operated, and In accordance automatic valve in each water flow path and with the in both steam supply flow paths to the Surveillance steam turbine driven pump, that is not Frequency locked, sealed, or otherwise secured in Control Program position, is in the correct position.

SR 3.7.5.2 -------------------NOTE--------------------

Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

Verify the developed head of each AFW pump In accordance at the flow test point is greater than or with the equal to the required developed head. Inservice Test Program SR 3.7.5.3 -------------------NOTES-------------------

1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

2. Not applicable in MODE 4 when steam generator is relied upon for heat removal.

Verify each AFW automatic valve that is not In accordance locked, sealed, or otherwise secured in with the position, actuates to the correct position Surveillance on an actual or simulated actuation signal. Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.7.5-4 AMENDMENT NO. 188,

AFW System 3.7.5 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.7.5.4 -------------------NOTES-------------------

1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

2. Not applicable in MODE 4 when steam generator is relied upon for heat removal.

Verify each AFW pump starts automatically In accordance on an actual or simulated actuation signal. with the Surveillance Frequency Control Program SR 3.7.5.5 Verify the proper alignment of the required Prior to AFW flow paths by verifying flow from the entering MODE 2 condensate storage tank to each steam whenever unit generator. has been in MODE 5 or 6 for

> 30 days PALO VERDE UNITS 1,2,3 3.7.5-5 AMENDMENT NO.

EW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Essential Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train A.1 --------NOTE---------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4" for shutdown cooling made inoperable by EW.

Restore EW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. --------NOTES-------- B.1 Restore at least one EW 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months train to OPERABLE

1. Not applicable when status.

second EW train OR intentionally made inoperable.

In accordance

2. The following with the Risk Section 5.5.20 Informed constraints are Completion Time applicable: parts b, Program c.2, c.3, d, e, f, g, and h.

Two EW trains inoperable.

PALO VERDE UNITS 1,2,3 3.7.7-1 AMENDMENT NO. 117

EW System 3.7.7 ACTION (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1 -------------------NOTE--------------------

Isolation of EW flow to individual components does not render the EW System inoperable.

Verify each EW manual, power operated, and In accordance automatic valve in the flow path servicing with the safety related equipment, that is not Surveillance locked, sealed, or otherwise secured in Frequency position, is in the correct position. Control Program SR 3.7.7.2 Verify each EW automatic valve in the flow In accordance path that is not locked, sealed, or with the otherwise secured in position, actuates to Surveillance the correct position on an actual or Frequency simulated actuation signal. Control Program SR 3.7.7.3 Verify each EW pump starts automatically on In accordance an actual or simulated actuation signal. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.7-2 AMENDMENT NO. 188,

ESPS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train A.1 --------Notes--------

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1. AC Sources Operating, for emergency diesel generator made inoperable by ESPS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6. RCS Loops MODE 4, for shutdown cooling made inoperable by ESPS.

Restore ESPS train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,3 3.7.8-1 AMENDMENT NO. 117

ESPS 3.7.8 ACTION (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. ---------NOTES--------- B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ESPS train to OPERABLE

1. Not applicable when status.

second ESPS train OR intentionally made inoperable. In accordance

2. The following with the Risk Section 5.5.20 Informed constraints are Completion Time applicable: parts Program b, c.2, c.3, d, e, f, g, and h.

Two ESPS trains inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1 -------------------Notes-------------------

Isolation of ESPS flow to individual components does not render ESPS inoperable.

Verify each ESPS manual and power operated In accordance valve in the flow path servicing safety with the related equipment, that is not locked, Surveillance sealed, or otherwise secured in position, Frequency is in the correct position. Control Program SR 3.7.8.2 Verify each ESPS pump starts automatically In accordance on an actual or simulated actuation signal. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.8-2 AMENDMENT NO. 188,

EC 3.7.10 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train A.1 Restore EC train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. --------NOTES--------- B.1 Restore at least one EC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable when train to OPERABLE status.

second EC train OR intentionally made inoperable. In accordance

2. The following with the Risk Section 5.5.20 Informed constraints are Completion Time applicable: parts b, Program c.2, c.3, d, e, f, g, and h.

Two EC trains inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.7.10-1 AMENDMENT NO. 188

EC 3.7.10 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power In accordance operated, and automatic valve in the flow with the path, that is not locked, sealed, or Surveillance otherwise secured in position, is in the Frequency correct position. Control Program SR 3.7.10.2 Verify the proper actuation of each EC In accordance System component on an actual or simulated with the actuation signal. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.10-2 AMENDMENT NO.

AC Sources Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One DG inoperable. B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for the OPERABLE AND required offsite circuit(s). Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) discovery of supported by the Condition B inoperable DG concurrent with inoperable when inoperability of its redundant redundant required required feature(s) is feature(s) inoperable.

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG is not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG.

AND (continued)

PALO VERDE UNITS 1,2,3 3.8.1-2 AMENDMENT NO. 197,

AC Sources Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG 10 days to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. feature(s) discovery of inoperable when Condition C its redundant concurrent with required inoperability of feature(s) is redundant required inoperable. feature(s)

AND C.2 Restore one 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months required offsite circuit to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO. 200,

AC Sources Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite -----------NOTE-----------

circuit inoperable. Enter applicable Conditions and Required Actions of AND LCO 3.8.9, "Distribution One DG inoperable. Systems Operating," when Condition D is entered with no AC power source to a train.

D.1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuits to OPERABLE status. OR OR In accordance with the Risk Informed Completion Time Program D.2 Restore DG 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

NOTES--------- E.1 Restore one DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status.

1. Not applicable when OR second DG intentionally made In accordance with inoperable. the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

E. Two DGs inoperable.

PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO. 117

AC Sources Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. One automatic load F.1 Restore automatic 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months sequencer inoperable. load sequencer to OPERABLE status. OR AND In accordance with the Risk Informed Completion Time Program F.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported discovery of by the inoperable Condition F sequencer inoperable concurrent with when its redundant inoperability of required feature(s) redundant required is inoperable. feature(s)

G. --------NOTE-------- G.1 Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Condition G is not capability of the applicable for Class offsite 1E bus(es) provided circuit(s).

with a two stage time OR delay for the degraded voltage relays and a fixed time delay for the loss of voltage relays.

One or more required offsite circuit(s) do not meet required capability.

NOTE-----------

Enter LCO 3.8.1 Condition A or C for required offsite circuit(s) inoperable.

G.2 Transfer the ESF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months bus(es) from the offsite circuit(s) to the EDG(s).

PALO VERDE UNITS 1,2,3 3.8.1-5 AMENDMENT NO. 201,

AC Sources Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H.---------NOTES-------- H.1 Restore required AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months source(s) to OPERABLE

1. Not applicable when status.

the third or a OR subsequent required AC source In accordance intentionally made with the Risk inoperable. Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Three or more required AC sources inoperable.

I. Required Action and I.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion Time of Condition A, AND B, C, D, E, F, G, or H not met. I.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.8.1-6 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and In accordance indicated power availability for each with the required offsite circuit. Surveillance Frequency Control Program SR 3.8.1.2 --------------------NOTES------------------

1. Performance of SR 3.8.1.7 satisfies this SR.

2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer. When modified start procedures are not used, the time, voltage, and frequency tolerances of SR 3.8.1.7 must be met.

4. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts from standby In accordance condition and achieves steady state with the voltage 4000 V and 4377.2 V, and Surveillance frequency 59.7 Hz and 60.7 Hz. Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-7 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.3 -------------------NOTES-------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.

3. This Surveillance shall be conducted on only one DG at a time.

4. This SR shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.2 or SR 3.8.1.7.

Verify each DG is synchronized and loaded, In accordance and operates for 60 minutes at a load with the 4950 kW and 5500 kW. Surveillance Frequency Control Program SR 3.8.1.4 Verify each day tank contains 550 gal of In accordance fuel oil (minimum level of 2.75 feet). with the Surveillance Frequency Control Program SR 3.8.1.5 Check for and remove accumulated water from In accordance each day tank. with the Surveillance Frequency Control Program SR 3.8.1.6 Verify the fuel oil transfer system In accordance operates to automatically transfer fuel with the oil from the storage tank to the day tank. Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-8 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7 -------------------NOTE--------------------

1. All DG starts may be preceded by an engine prelube period followed by a warmup period prior to loading.

2. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts from standby In accordance condition and achieves with the

a. In 10 seconds, voltage 3740 V and Surveillance frequency 58.8 Hz; and Frequency

b. Steady state voltage 4000 V and Control Program 4377.2 V, and frequency 59.7 Hz and 60.7 Hz.

SR 3.8.1.8 --------------------NOTE------------------

This Surveillance shall not normally be performed in MODE 1 or 2. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify manual transfer of AC power sources In accordance from the normal offsite circuit to each with the alternate offsite circuit. Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-9 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.9 --------------------NOTE------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG rejects a load greater than In accordance or equal to its associated single largest with the post-accident load, and: Surveillance Frequency

a. Following load rejection, the Control Program frequency is 64.5 Hz;

b. Within 3 seconds following load rejection, the voltage is 3740 V and 4580 V; and

c. Within 3 seconds following load rejection, the frequency is 58.8 Hz and 61.2 Hz.

SR 3.8.1.10 --------------------NOTE-----------------

If performed with the DG synchronized with offsite power, it shall be performed at a power factor of 0.89. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verify each DG does not trip, and voltage In accordance is maintained 6200 V during and following with the a load rejection of 4950 kW and Surveillance 5500 kW. Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-10 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.11 -------------------NOTE--------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3. Momentary voltage and frequency transients induced by load changes do not invalidate this test.

4. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated loss of In accordance offsite power signal: with the Surveillance

a. De-energization of emergency buses; Frequency Control Program

b. Load shedding from emergency buses;

c. DG auto-starts and:

1. energizes permanently connected loads in 10 seconds,

2. energizes auto-connected emergency loads through automatic load sequencer,

3. maintains steady state voltage 4000 V and 4377.2 V,

4. maintains steady state frequency 59.7 Hz and 60.7 Hz, and

5. supplies permanently connected and auto-connected emergency loads for 5 minutes.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-11 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.12 -------------------NOTES------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated Engineered In accordance Safety Feature (ESF) actuation signal with the (without a loss of offsite power) each Surveillance DG auto-starts and: Frequency Control Program

a. In 10 seconds, achieves voltage 3740 V and frequency 58.8 Hz;

b. Achieves steady state voltage 4000 and 4377.2 V and frequency 59.7 Hz and 60.7 Hz;

c. Operates for 5 minutes on standby (running unloaded);

d. Permanently connected loads remain energized from the offsite power system; and

e. Emergency loads are energized (auto-connected through the automatic load sequencer) from the offsite power system.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-12 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.13 Verify each DG automatic trip is bypassed In accordance on actual or simulated loss of voltage with the signal on the emergency bus concurrent with Surveillance an actual or simulated ESF actuation Frequency signal except: Control Program

a. Engine overspeed;

b. Generator differential current;

c. Engine low lube oil pressure; and

d. Manual emergency stop trip.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-13 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14 -------------------NOTES-------------------

1. Momentary transients outside the load range do not invalidate this test.

2. If performed with the DG synchronized with offsite power, it shall be performed at a power factor of 0.89.

However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

3. All DG starts may be preceded by an engine prelube period followed by a warmup period prior to loading.

4. DG loading may include gradual loading as recommended by the manufacturer.

Verify each DG operates for 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: In accordance with the

a. For 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months loaded 4950 kW and Surveillance 5500 kW; and Frequency Control Program

b. For the remaining hours ( 2) of the test loaded 5775 kW and 6050 kW.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-14 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.15 -------------------NOTES-------------------

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG, loaded 4950 kW and 5500 kW, has operated 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or until temperatures have stabilized.

Momentary transients outside of load range do not invalidate this test.

2. All DG starts may be preceded by an engine prelube period.

3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts and achieves In accordance

a. In 10 seconds, voltage 3740 V and with the frequency 58.8 Hz; and Surveillance Frequency

b. Steady state voltage 4000 V and Control Program 4377.2 V, and frequency 59.7 Hz and 60.7 Hz.

SR 3.8.1.16 -------------------NOTE-------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG: In accordance

a. Synchronizes with offsite power source with the while loaded with emergency loads upon Surveillance a simulated restoration of offsite Frequency power; Control Program

b. Transfers loads to offsite power source; and

c. Returns to ready-to-load operation.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-15 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.17 -------------------NOTE--------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify, with a DG operating in test mode In accordance and connected to its bus, an actual or with the simulated ESF actuation signal overrides Surveillance the test mode by: Frequency Control Program

a. Returning DG to ready-to-load operation; and

b. Automatically energizing the emergency load from offsite power.

SR 3.8.1.18 -------------------NOTE-------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify interval between each sequenced load In accordance block is within +/- 1 second of design with the interval for each automatic load sequencer. Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-16 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.19 -------------------NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated loss of In accordance offsite power signal in conjunction with an with the actual or simulated ESF actuation signal: Surveillance Frequency

a. De-energization of emergency buses; Control Program

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in 10 seconds,

2. energizes auto-connected emergency loads through load sequencer,

3. achieves steady state voltage 4000 V and 4377.2 V,

4. achieves steady state frequency 59.7 Hz and 60.7 Hz, and

5. supplies permanently connected and auto-connected emergency loads for 5 minutes.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-17 AMENDMENT NO. 188,

AC Sources Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.20 -------------------NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify, when started simultaneously, each In accordance DG achieves with the

a. In 10 seconds, voltage 3740 V and Surveillance frequency 58.8 Hz; and Frequency

b. Steady state voltage 4000 V and Control Program 4377.2 V, and frequency 59.7 Hz and 60.7 Hz.

PALO VERDE UNITS 1,2,3 3.8.1-18 AMENDMENT NO.

DC Sources Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on A.1 Restore battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months one subsystem terminal voltage to inoperable. greater than or equal to the minimum established float voltage.

AND A.2 Verify battery float Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months current 2 amps.

AND 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months A.3 Restore battery charger to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program B.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months B. One DC electrical power subsystem to power subsystem OPERABLE status. OR inoperable for reasons other than In accordance Condition A. with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,3 3.8.4-1 AMENDMENT NO. 193,

DC Sources Operating 3.8.4 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. --------NOTES-------- C.1 Restore at least one DC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months electrical power

1. Not applicable when subsystem to OPERABLE OR second DC status.

electrical power subsystem In accordance intentionally made with the Risk inoperable. Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two DC electrical power subsystems inoperable.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.8.4-2 AMENDMENT NO. 193,

DC Sources Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is greater In accordance than or equal to the minimum established with the float voltage. Surveillance Frequency Control Program SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 Deleted SR 3.8.4.5 Deleted SR 3.8.4.6 Verify each battery charger supplies In accordance 400 amps for Batteries A and B and with the 300 amps for Batteries C and D at Surveillance greater than or equal to the minimum Frequency established float voltage for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Control Program OR Verify each battery charger can recharge the battery to the fully charged state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying the largest combined demands of the various continuous steady state loads, after a battery discharge to the bounding design basis event discharge state.

(continued)

PALO VERDE UNITS 1,2,3 3.8.4-3 AMENDMENT NO. 193,

DC Sources Operating 3.8.4 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.4.7 -------------------NOTES-------------------

1. The modified performance discharge test in SR 3.8.6.9 may be performed in lieu of SR 3.8.4.7.

2. This Surveillance shall not be performed in MODE 1, 2, 3, or 4.

Verify battery capacity is adequate to In accordance supply, and maintain in OPERABLE status, with the the required emergency loads for the design Surveillance duty cycle when subjected to a battery Frequency service test. Control Program SR 3.8.4.8 Deleted PALO VERDE UNITS 1,2,3 3.8.4-4 AMENDMENT NO.

Inverters Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.

NOTE----------------------------

One inverter may be disconnected from its associated DC bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and

b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter A.1 ---------NOTE---------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems - Operating" with any vital instrument bus de-energized.

Restore inverter to 7 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.8.7-1 AMENDMENT NO. 180

Inverters Operating 3.8.7 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES-------- B.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inverter to OPERABLE

1. Not applicable when status. OR the second or a subsequent required inverter In accordance intentionally made with the Risk inoperable resulting Informed in loss of safety Completion Time function. Program

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Two or more required inverters inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, In accordance and alignment to required AC vital with the instrument buses. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.7-2 AMENDMENT NO. 188,

Distribution Systems Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical A.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution subsystem inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program B. One AC vital B.1 Restore AC vital 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months instrument bus instrument bus electrical power electrical power OR distribution subsystem distribution inoperable. subsystem to OPERABLE In accordance status. with the Risk Informed Completion Time Program C. One DC electrical C.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power distribution power distribution subsystems inoperable. subsystem to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.8.9-1 AMENDMENT NO. 197

Distribution Systems Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. --------NOTES-------- D.1 Restore electrical 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months power distribution

1. Not applicable when subsystem(s) to the second or a OR OPERABLE status.

subsequent electrical power In accordance with distribution the Risk Informed subsystem Completion Time intentionally made Program inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Two or more electrical power distribution subsystems inoperable.

E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and In accordance voltage to required AC, DC, and AC vital with the instrument bus electrical power Surveillance distribution subsystems. Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.9-2 AMENDMENT NO. 197,

Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09 (Revision 0) -

A, Risk-Managed Technical Specifications (RMTS) Guidelines. The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered PRA functional as defined in Section 2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0) -

A. However, the following additional constraints shall be applied to the criteria for "PRA Functional."

PALO VERDE UNITS 1,2,3 5.5-20 AMENDMENT NO.

Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review.

h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

PALO VERDE UNITS 1,2,3 5.5-21 AMENDMENT NO.

After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.21 Spent Fuel Storage Rack Neutron Absorber Monitoring Program Certain storage cells in the spent fuel storage racks utilize neutron absorbing material that is credited in the spent fuel storage rack criticality safety analysis to ensure the limitations of Technical Specifications 3.7.17 and 4.3.1.1 are maintained.

In order to ensure the reliability of the neutron absorber material, a monitoring program is provided to confirm the aassumptions in the spent fuel pool criticality safety analysis.

The Spent Fuel Storage Rack Neutron Absorber Monitoring Program shall require periodic inspection and monitoring of spent fuel pool test coupons and neutron absorber inserts on a performance-based frequency, not to exceed 10 years.

Test coupons shall be inspected as part of the monitoring program.

These inspections shall include visual, B-10 areal density and corrosion rate.

Visual in-situ inspections of inserts shall also be part of the program to monitor for signs of degradation. In addition, an insert shall be removed periodically for visual inspection, thickness measurements, and determination of retention force.

PALO VERDE UNITS 1,2,3 5.5-22 AMENDMENT NO.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 3 Technical Specification Bases Changes TS Bases Mark-up Pages B 3.3.6-16 B 3.7.5-6 B 3.3.6-18 B 3.7.5-7 B 3.4.10-3 B 3.7.5-8 B 3.4.12-3 B 3.7.7-3 B 3.4.12-4 B 3.7.7-4 B 3.5.1-8 B 3.7.8-3 B 3.5.3-6 B 3.7.10-3 B 3.5.5-8 B 3.8.1-9 B 3.6.2-7 B 3.8.1-12 B 3.6.3-10 B 3.8.1-13 B 3.6.3-11 B 3.8.1-15 B 3.6.3-12 B 3.8.1-16 B 3.6.3-13 B 3.8.1-17 B 3.6.3-14 B 3.8.1-22 B 3.6.3-15 B 3.8.4-7 B 3.6.6-5 B 3.8.4-8 B 3.7.2-7 B 3.8.7-4 B 3.7.2-8 B 3.8.9-4 B 3.7.3-3 B 3.8.9-5 B 3.7.3-4 B 3.8.9-6 B 3.7.4-5 B 3.8.9-7 B 3.7.5-5

ESFAS Logic and Manual Trip B 3.3.6 BASES ACTIONS A.1 (continued)

The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This provides the operator with time to take appropriate actions and still ensures that any risk involved in operating with a failed channel is acceptable.

Operating experience has demonstrated that the probability of a random failure of a second Matrix Logic channel is low during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. If the channel cannot be restored to OPERABLE status with 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , Condition E is entered.

or in accordance B.1 with the Risk Condition B applies to one Manual Trip or Initiation Logic Informed channel inoperable.

Completion Time Program The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Operating experience has demonstrated that the probability of a random failure in a second channel is low during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period.

Failure of a single Initiation Logic channel may open one contact affecting both Actuation Logic channels. For the purposes of this Specification, the Actuation Logic is not inoperable. This prevents the need to enter LCO 3.0.3 in the event of an Initiation Logic channel failure. The Actions differ from those involving one RPS manual channel inoperable, because in the case of the RPS, opening RTCBs can be easily performed and verified. Opening an initiation relay contact is more difficult to verify, and subsequent shorting of the contact is always possible.

C.1 and C.2 Condition C applies to the failure of both Initiation Logic channels affecting the same trip leg.

In this case, the Actuation Logic channels are not inoperable, since they are in one-out-of-two logic and capable of performing as required. This obviates the need to enter LCO 3.0.3 in the event of a matrix or vital bus power failure.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.6-16 REVISION 0

ESFAS Logic and Manual Trip B 3.3.6 BASES ACTIONS D.1 (continued)

The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Operating experience has demonstrated that the probability of a random failure in the Actuation Logic of the second train is low during a given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period.

or in accordance Failure of a single Initiation Logic channel, matrix with the Risk channel power supply, or vital instrument bus may open one Informed or both contacts in the same trip leg in both Actuation Logic channels. For the purposes of this Specification, Completion Time the Actuation Logic is not inoperable. This obviates the Program need to enter LCO 3.0.3 in the event of a vital bus, matrix, or initiation channel failure.

Each Actuation Logic channel has two sets of redundant power supplies. The power supplies in each set are powered from different vital instrument buses. Failure of a single power supply or a set of power supplies due to the loss of a vital instrument bus, does not affect the operation of the Actuation Logic because the redundant power supplies can supply the full system load. For the purposes of this specification, the Actuation Logic is not inoperable.

Required Action D.1 is modified by a Note to indicate that one channel of Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillance, provided the other channel is OPERABLE.

This allows performance of a PPS CHANNEL FUNCTIONAL TEST on an OPERABLE ESFAS train without generating an ESFAS actuation in the inoperable train.

E.1 and E.2 If the Required Actions and associated Completion Times of Conditions for CSAS, MSIS or AFAS cannot be met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.6-18 REVISION 0

Pressurizer Safety Valves-MODES 1, 2, and 3 B 3.4.10 BASES APPLICABILITY The requirements for overpressure protection in other MODES (continued) are covered by LCO 3.4.11, "Pressurizer Safety Valves-MODE 4," and LCO 3.4.13, "LTOP System."

The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from service for testing. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months exception is based on 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each of the four valves.

The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that hot testing can be performed within this timeframe.

or in accordance with the Risk Informed ACTIONS A.1 Completion Time Program With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS overpressure protection system. An inoperable safety valve coincident with an RCS overpressure event could challenge Insert 1 the integrity of the RCPB.

B.1 and B.2 If the Required Action cannot be met within the required Completion Time or if two or more pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed is reasonable, based on operating experience, to reach MODE 3 from full power without challenging plant systems.

Similarly, the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed is reasonable, based on operating experience, to reach MODE 4 without challenging plant systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.10-3 REVISION 0

Insert 1: B 3.4.10-3 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when pressurizer safety valve is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Pressurizer Vents B 3.4.12 BASES LCO A vent path is flow capability from the pressurizer to the (continued) RDT or from the pressurizer to containment atmosphere.

Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable. A pressurizer vent path is required to depressurize the RCS in a SGTR design basis event which assumes LOP and APSS unavailable.

APPLICABILITY In MODES 1, 2, 3, and MODE 4 with RCS pressure q 385 psia the four pressurizer vent paths are required to be OPERABLE.

The safety analysis for the SGTR with LOP and a Single Failure (loss of APSS) credits a pressurizer vent path to reduce RCS pressure.

In MODES 1, 2, 3, and MODE 4 with RCS pressure q 385 psia the SGs are the primary means of heat removal in the RCS, until shutdown cooling can be initiated. In MODES 1, 2, 3, and MODE 4 with RCS pressure q 385 psia, assuming the APSS is not available, the pressurizer vent paths are the credited means to depressurize the RCS to Shutdown Cooling System entry conditions. Further depressurization into MODE 5 requires use of the pressurizer vent paths. In MODE 5 with the reactor vessel head in place, temperature requirements of MODE 5 (< 210°F) ensure the RCS remains depressurized.

In MODE 6 the RCS is depressurized.

ACTIONS A.1 If two or three pressurizer vent paths are inoperable, they must be restored to OPERABLE status. Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable. Any vent path that provides flow capability from the pressurizer to the RDT or to the containment atmosphere, independent of which train is powering the valves in the flow path, can be considered an operable vent path. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable because there is at least one pressurizer vent path that remains OPERABLE.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.12-3 REVISION 48

Pressurizer Vents B 3.4.12 Alternatively, a Completion Time can be determined in accordance with the Risk BASES Informed Completion Time Program.

ACTIONS B.1 (continued)

If all pressurizer vent paths are inoperable, then restore at least one pressurizer vent path to OPERABLE status. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to allow time to correct the situation, yet emphasize the importance of restoring at least one pressurizer vent path. If at least one pressurizer vent path is not restored to OPERABLE within Insert 2 the Completion Time, then Action C is entered.

C.1 If the required Actions, A and B, cannot be met within the associated Completion Times, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and to MODE 4 with RCS pressure < 385 psia within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS SR 3.4.12.1 requires complete cycling of each pressurizer vent path valve. The vent valves must be cycled from the control room to demonstrate their operability. Pressurizer vent path valve cycling demonstrates its function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6. In any Mode, partial surveillance tests can be performed for post-maintenance testing under site procedural controls that ensure the valve being tested is isolated from RCS pressure.

SR 3.4.12.2 SR 3.4.12.2 requires verification of flow through each pressurizer vent path. Verification of pressurizer vent path flow demonstrates its function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6.

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.12-4 REVISION 56

Insert 2: B 3.4.12-4 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the last pressurizer vent path is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if three pressurizer vent paths are inoperable for any reason and the last vent path is found to be inoperable, or if all pressurizer vent paths are found to be inoperable at the same time.

Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

SITs-Operating B 3.5.1 BASES ACTIONS B.1 If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.

CE NPSD-994 (Ref. 6) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 (Ref. 6) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or the operation of one high pressure safety injection (HPSI) pump and a single SIT. CE NPSD-994 (Ref. 6) also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to Insert 3 shorter recovery periods.

D ACTIONS C.1 and C.2 SIT(s)

D If the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 1837 psia within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Specification 3.5.2, "SITs - Shutdown", further requires the plant to be in Mode 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the SIT inoperability was discovered but not restored while in the applicability of Specification 3.5.1, "SITs - Operating".

D.1 If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.1-8 REVISION 1

Insert 3: B 3.5.1-8 C.1 With two or more SITs inoperable, the Required Action is to restore all but one SIT to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain this safety function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of sufficient SITs to regain safety function. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent SIT is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one SIT is inoperable for any reason and additional SITs are found to be inoperable, or if two or more SITs are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

ECCS - Operating B 3.5.3 BASES Alternatively, a Completion Time can be determined in accordance ACTIONS A.1 with the Risk Informed Completion Time Program.

Condition A addresses the specific condition where the only affected ECCS subsystem is a single LPSI subsystem. The availability of at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is implicit in the definition of Condition A.

If LCO 3.5.3 requirements are not met due only to the existence of Condition A, then the inoperable LPSI subsystem components must be returned to OPERABLE status within 7 days of discovery of Condition A. This 7 day Completion Time is based on the findings of the deterministic and probabilistic analysis that are discussed in Reference 6. Seven days is a reasonable amount of time to perform many corrective and preventative maintenance items on the affected LPSI subsystem. Reference 6 concluded that the overall risk impact of this Completion Time was either risk-beneficial or risk-neutral.

The Configuration Risk Management Program (CRMP) in TRM Section 5.0.500.19 applies when Condition A is entered.

Alternatively, a Completion Time can be determined in accordance B.1 with the Risk Informed Completion Time Program.

If one or more ECCS trains are inoperable, except for reasons other than Condition A (one LPSI subsystem inoperable), and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC study (Ref. 4) using a reliability evaluation and is a reasonable amount of time to effect many repairs.

An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS. The individual components are inoperable if they are not capable of performing their design function, or if supporting systems are not available.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.3-6 REVISION 2

RWT B 3.5.5 or in accordance with the Risk Informed BASES Completion Time Program ACTIONS B.1 (continued)

With RWT borated water volume not within limits, it must be returned to within limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, neither the ECCS nor Containment Spray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the unit in a MODE in which these systems are not required. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWT to OPERABLE status is based on this condition since the contents of the tank are not available for injection and Insert 4 core cooling.

C.1 and C.2 If the RWT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.5.1 REQUIREMENTS RWT borated water temperature shall be verified to be within the limits assumed in the accident analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures are within the operating temperature limits of the RWT. With ambient temperatures within this range, the RWT temperature should not exceed the limits.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.5-8 REVISION 56

Insert 4: B 3.5.5-8 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when RWT is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if RWT is inoperable for any reason other than Condition A. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Containment Air Locks B 3.6.2 or in accordance with the Risk Informed Completion Time Program BASES ACTIONS C.1, C.2, and C.3 (continued)

Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time.

This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.

D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program and includes testing of the airlock doors following each closing, as specified.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.2-7 REVISION 0

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

In the event one required containment isolation valve in one or more penetration flow paths is inoperable except for purge valve leakage not within limit (refer to Action D),the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic valve),

a blind flange, and a check valve with flow through the valve secured. Compliance with this Action is established via:

1) Administrative controls on the de-activated automatic valve, closed manual valve, blind flange, or check valve, and

2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e., flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position or in accordance with the Risk Informed Completion Time Program

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-10 REVISION 64

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued) following isolation should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides appropriate actions.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-11 REVISION 43

Containment Isolation Valves B 3.6.3 or in accordance with the Risk Informed BASES Completion Time Program ACTIONS B.1 (continued)

With two required containment isolation valves in one or more penetration flow paths inoperable except for purge valve leakage not within limit (refer to Action D), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic valve), and a blind flange. Compliance with this Action is established via: 1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange, and

2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e.,

flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of their misalignment is low. Notes. Note 1 is Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

Insert 5

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-12 REVISION 64

Insert 5: B 3.6.3-12 Note 2 states that RICT is not applicable when the second containment isolation valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 3 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

With one or more required penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely Alternatively, a affected by a single active failure. Isolation barriers that meet this Completion Time criterion are a closed and de-activated automatic valve, a closed can be determined manual valve (including a de-activated non-automatic valve), and in accordance with a blind flange. Compliance with this Action is established via:

the Risk Informed 1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange and 2) Administrative controls Completion Time on vents, drains, and test connections located within the Program. containment penetration. Instruments (i.e., flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. A check valve may not be used to isolate the affected penetration.

Required Action C.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration following isolation is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate considering the valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The only credited closed systems are the Steam Generating and the Containment Pressure Monitoring Systems. This Note is necessary since this Condition is

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-13 REVISION 64

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued) written to specifically address those penetration flow paths which are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere (10 CFR 50, APP. A, GDC 57).

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.

D.1, D.2, and D.3 In the event one or more required containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits, or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve with resilient seals, or a blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.1 must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. Compliance with this Action is established via:

1) Administrative controls on the de-activated automatic valve with resilient seals or blind flange, and 2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e., flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. The specified Completion Time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-14 REVISION 64

Containment Isolation Valves B 3.6.3 BASES ACTIONS D.1, D.2 and D.3 (continued)

In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation.

Rather, it involves verification, through a system walkdown, that those isolation devices outside containment capable of being mispositioned are in the correct position.

following isolation For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

following isolation For the required containment purge valve with a resilient seal that is isolated in accordance with Required Action D.1, SR 3.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6, 184 days, is based on an NRC initiative, Generic Issue B-20 (Ref. 3). Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown to be acceptable based on operating experience.

following isolation Insert 6 E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-15 REVISION 43

Insert 6: B 3.6.3-15 Note 1 states that RICT is not applicable when the second containment purge valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Containment Spray System B 3.6.6 BASES LCO containment spray actuation signal and automatically (continued) transferring suction to the containment sump on a recirculation actuation signal. Each spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

Therefore, in the event of an accident, the minimum requirements are met, assuming that the worst case single active failure occurs.

Each Containment Spray System typically includes a spray pump, a shutdown cooling heat exchanger, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

APPLICABILITY In MODES 1, 2, and 3, and Mode 4 with RCS pressure q 385 psia, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the containment spray trains.

In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray System is not required to be OPERABLE in these MODES.

or in accordance with the Risk Informed ACTIONS A.1 Completion Time Program With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE spray train is adequate to perform the iodine removal, hydrogen mixing, and containment cooling functions. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant heat removal capability afforded by the Containment Spray System, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.6-5 REVISION 1

MSIVs B 3.7.2 BASES (continued)

ACTIONS E.1 (continued)

(continued) or more MSIVs inoperable while in MODE 1 requires entry into LCO 3.0.3.

F.1 With one MSIV inoperable in MODE 1, time is allowed to Alternately, the restore the component to OPERABLE status. Some repairs can Completion Time can be be made to the MSIV with the unit hot. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the probability determined in accordance of an accident occurring during the time period that would with the Risk Informed require closure of the MSIVs.

Completion Time Program.

Condition F is entered when one MSIV is inoperable in MODE 1, including when both actuator trains for one MSIV are inoperable. When only one actuator train is inoperable on one MSIV, Condition A applies.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that normally allowed for containment isolation valves that isolate a closed system penetrating containment. These valves differ from other containment isolation valves in that the closed system provides an additional means for containment Insert 7 isolation.

G.1 I H If the MSIV cannot be restored to OPERABLE within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition H would be entered. The Completion Time is reasonable, based on operating experience, to reach MODE 2, and close the MSIVs in an orderly manner and without challenging unit systems.

I I H.1 and H.2 I Condition H is modified by a Note indicating that separate Condition entry is allowed for each MSIV.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to OPERABLE status or closed. When closed, the MSIVs are already in the position required by the assumptions in the safety analysis.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.2-7 REVISION 59

Insert 7: B 3.7.2-7 G.1 With two or more MSIVs inoperable, the Required Action is to restore all but one MSIV to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of main steam line isolation. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of sufficient required MSIVs. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent MSIV is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one MSIV is inoperable for any reason and additional MSIVs are found to be inoperable, or if two or more MSIVs are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

MSIVs B 3.7.2 BASES (continued) I I ACTIONS H.1 and H.2 (continued)

(continued)

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that allowed in Condition F.

Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, MSIV status indications available in the control room, and other administrative controls, to ensure these valves are in the closed position.

J J I.1 and I.2 If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is within the limit given in Reference 5 with each actuator train on an actual or simulated actuation signal and is within that assumed in the accident and containment analyses. This SR also verifies the valve closure time is in accordance with the Inservice Testing Program. This SR is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be full stroke tested at power.

The Frequency for this SR is in accordance with the Inservice Testing Program. This Frequency demonstrates the valve closure time at least once per refueling cycle.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.2-8 REVISION 54

MFIVs B 3.7.3 BASES (continued)

APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator.

In MODES 1, 2, 3, and 4, the MFIVs are required to be OPERABLE, except when they are closed and deactivated or isolated by a deactivated and closed power operated valve, in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed or isolated by a closed power operated valve, they are already performing their safety function.

In MODES 5 and 6, steam generator energy is low. Therefore, the MFIVs are not required.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each penetration flow path. With one or more MFIVs inoperable, action must be taken to restore A.1, A.2.1, and A.2.2 the MFIV(s) to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program OR to close or A.1 and A.2 isolate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

With one MFIV inoperable, action must be taken to close or isolate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these valves are closed or isolated, they are performing their required safety function (e.g., to isolate the line).

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time A.2.1 period that would require isolation of the MFW flow paths.

Inoperable MFIVs that are closed to comply with Required Action A.1 must be verified on a periodic basis to be reasonable closed. This is necessary to ensure that the assumptions in (editorial) the safety analysis remain valid. The seven day completion time is responsible, based on engineering judgement, MFIV status indications available in the control room, and other administrative controls, to ensure these valves are in the closed position.

7 (editorial) following isolation

______________________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.7.3-3 REVISION 37

MFIVs B 3.7.3 BASES B.1, B.2.1, and B.2.2 restore an MFIV to OPERABLE ACTIONS B.1 and B.2 status, or to (continued)

With two valves in If more than one MFIV in the same flow path cannot be restored to OPERABLE status, then there may be no system to the same flow path operate automatically and perform the required safety inoperable, action function. Under these conditions, valves in each flow path must be taken to must be restored to OPERABLE status, closed, or the flow restore one valve to path isolated within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This action returns the OPERABLE status system to the condition where at least one valve in each within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in flow path is performing the required safety function. The accordance with the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable to close an MFIV or Risk Informed otherwise isolate the affected flow path.

Completion Time Program OR isolate Inoperable MFIVs that cannot be restored to OPERABLE status within the Completion Time, but are closed or isolated, must the affected flow be verified on a periodic basis that they are closed or path. isolated. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, in view of valve status indications available in the control room, and other administrative controls to ensure that these valves are closed or isolated.

Insert 8 C.1 and C.2 If the MFIVs cannot be restored to OPERABLE status, closed, or isolated in the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.3-4 REVISION 0

Insert 8: B 3.7.3-4 The Condition is modified by two Notes. Note 1 states that RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

ADVs B 3.7.4 BASES ACTIONS A.1 The condition for this ACTION is modified by a Note that states separate Condition entry is allowed for each SG.

This is acceptable because only one SG is required for RCS heat removal after a design basis accident, and because this Condition provides the appropriate Required Action and Completion Time for one inoperable ADV line on each SG.

With one ADV line on a SG inoperable, action must be taken to restore that ADV line to OPERABLE status within 7 days to meet the LCO for each SG that has entered this Condition. The 7-day Completion Time takes into consideration the redundant capability afforded by the remaining OPERABLE ADV lines, the safety grade MSSVs, and the non-safety grade backup of the SBCS.

Alternately, a Completion Time can be determined in B.1 accordance with the Risk Informed Completion Time Program.

With two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs, action must be taken to restore one ADV line on each SG to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair inoperable ADV lines, based on the availability of the Steam Bypass Control System and MSSVs, and the low probability of an event occurring during this period that requires the ADV lines. Alternately, a Completion Time can be determined in Insert 9 accordance with the Risk Informed Completion Time NOTE:

Program.

Entry into Condition B for all four ADV lines simultaneously inoperable is not intended for voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.4-5 REVISION 58

Insert 9: B 3.7.4-5 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the last ADV intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two or more ADV lines are found inoperable with both ADV lines inoperable on one or more SGs and the last ADV line is found to be inoperable, or if all ADV lines are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

AFW System B 3.7.5 BASES APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE and to function in the event that the MFW System is lost. In addition, the AFW System is required to supply enough makeup water to replace steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4, the AFW System may be used for heat removal via the steam generator.

In MODES 5 and 6, the steam generators are not normally used for decay heat removal, and the AFW System is not required.

A note prohibits the application of LCO 3.0.4.b to an inoperable AFW Train. There is an increased risk associated with entering a MODE or other specified condition in the applicability with an AFW train inoperable and the provisions of LCO 3.0.4.b which allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

or in accordance with the Risk Informed ACTIONS A.1 Completion Time Program If one of the two steam supplies to the turbine driven AFW pumps is inoperable, or if a turbine driven pump is inoperable while in MODE 3 immediately following refueling (prior to MODE 2), action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time is reasonable based on the following reasons:

a. For the inoperability of a steam supply to the turbine-driven AFW pump, the 7 day Completion time is reasonable since there is a redundant steam supply line for the turbine driven pump.

b. For the inoperability of a turbine-driven AFW pump while in MODE 3 immediately subsequent to a refueling outage, the 7 day Completion time is reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of a steam supply line to the turbine-driven pump and an inoperable turbine-driven AFW pump while in MODE 3 immediately following a refueling outage, the 7 day Completion time is reasonable due to the availability of redundant OPERABLE motor driven AFW pumps.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.5-5 REVISION 42

AFW System B 3.7.5 BASES ACTIONS A.1 (continued)

Condition A is modified by a Note which limits the applicability of the Condition to when the unit has not entered MODE 2 following a refueling. Condition A allows the turbine-driven AFW pump to be inoperable for 7 days vice the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refueling and prior to the reactor being critical.

It should be noted that when in this Condition with one steam supply to the turbine driven AFW pump inoperable, that the AFA train of AFW is considered to be inoperable.

or in accordance with the Risk Informed B.1 Completion Time Program With one of the required AFW trains (pump or flow path) inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the AFW System, the time needed for repairs, and the low probability of a DBA event occurring during this period. Two AFW pumps and flow paths Insert 10 remain to supply feedwater to the steam generators.

D C.1 and C.2 , B.1, or C.1 D When either Required Action A.1 or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in MODES 1, 2, and 3, the unit must be placed in a MODE in which the LCO does not apply.

To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

This Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply to the turbine driven AFW pump is inoperable, coincident with another (B or N) AFW train inoperable.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 63

Insert 10: B 3.7.5-6 C.1 With two AFW trains inoperable in MODE 1, 2, or 3, the Required Action is to restore at least one AFW train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of decay heat removal. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one AFW train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second AFW train is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one AFW train is inoperable for any reason and a second AFW train is found to be inoperable, or if two AFW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO. Although it is not required, the unit may continue to cool down and start the Shutdown Cooling System.

AFW System B 3.7.5 BASES ACTIONS C.1 and C.2 (continued)

Included as last In MODE 4, with two AFW trains inoperable, operation is paragraph in new "C.1" allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required above. (Insert 8) in accordance with the Note that modifies the LCO. Although it is not required, the unit may continue to cool down and start the SDC.

E D.1 E Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the conditions is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With all three AFW trains inoperable in MODES 1, 2, and 3, the unit is in a seriously degraded condition with no TS related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety grade equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.

F E.1 F Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the Condition is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With one AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status or to immediately verify, by administrative means, the OPERABILITY of a second train. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.5-7 REVISION 63

AFW System B 3.7.5 BASES F

ACTIONS E.1 (continued)

In MODE 4, either the reactor coolant pumps or the SDC loops can be used to provide forced circulation as discussed in LCO 3.4.6, "RCS Loops - MODE 4."

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW water and steam supply flow paths provides assurance that the proper flow paths exist for AFW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulations; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are normal tests of pump performance required by the ASME OM Code (Ref. 2). Because it is undesirable to introduce cold AFW into the steam generators while they are operating, this testing may be performed on recirculation flow. This test confirms one point on the pump design curve and can be indicative of overall performance. Such inservice tests confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance.

Performance of inservice testing, discussed in the ASME OM Code, (Ref. 2), at 3 month intervals satisfies this requirement.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.5-8 REVISION 63

EW System B 3.7.7 BASES LCO (continued) not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

APPLICABILITY In MODES 1, 2, 3, and 4, the EW System must be prepared to perform its post accident safety functions, primarily RCS heat removal by cooling the SDC heat exchanger.

When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EW System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.1 Required Action A.1 is modified by a Note indicating the requirement of entry into the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4," for SDC made inoperable by EW. This note is only applicable in Mode

4. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

With one EW train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE EW train is adequate to perform the heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during Insert 11 this period.

C or in accordance with the Risk C B.1 and B.2 Informed Completion Time Program train(s)

If the EW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.7-3 REVISION 1

Insert 11: B 3.7.7-3 B.1 With two EW trains inoperable, the Required Action is to restore at least one of the required EW trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety related components. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second EW train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one EW train is inoperable for any reason and a second EW train is found to be inoperable, or if two EW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

EW System B 3.7.7 BASES C

ACTIONS B.1 and B.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EW flow path provides assurance that the proper flow paths exist for EW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.

This SR is modified by a Note indicating that the isolation of the EW components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the EW System. Isolation of the EW System to the Essential Chiller, while rendering the Essential Chiller inoperable, is acceptable and does not impact the OPERABILITY of the EW System. Isolation of the EW System to the SDC system heat exchanger is not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.2 This SR verifies proper automatic operation of the EW valves on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under (continued)

PALO VERDE UNITS 1,2,3 B 3.7.7-4 REVISION 56

ESPS B 3.7.8 or in accordance with the Risk Informed Completion Time Program BASES ACTIONS A.1 With one ESPS train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE ESPS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the ESPS train could result in loss of ESPS function. Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions of LCO 3.8.1, "AC Sources Operating,"

must be entered when the inoperable ESPS train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4," should be entered if an inoperable ESPS train results in an inoperable SDC System. This note is only applicable in MODE 4. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

Insert 12 C C B.1 and B.2 train(s)

If the ESPS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual and power operated, valves in the ESPS flow path ensures that the proper flow paths exist for ESPS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This (continued)

PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION 1

Insert 12: B 3.7.8-3 B.1 With two ESPS trains inoperable, the Required Action is to restore at least one of the required ESPS trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety related components. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second ESPS train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one ESPS train is inoperable for any reason and a second ESPS train is found to be inoperable, or if two ESPS trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

EC System B 3.7.10 BASES APPLICABILITY (continued) When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EC System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

or in accordance with the Risk Informed Completion ACTIONS A.1 editorial change Time Program If one EC train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, one OPERABLE ECW train is adequate to perform the cooling function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the low probability of an event occurring during this time and the 100% capacity OPERABLE EC train.

Insert 13 C C B.1 and B.2 train(s)

If the EC train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EC flow path provides assurance that the proper flow paths exist for EC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.10-3 REVISION 1

Insert 13: B 3.7.10-3 B.1 With two EC trains inoperable, the Required Action is to restore at least one train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety-related air handling systems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second EC train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one EC train is inoperable for any reason and a second EC train is found to be inoperable, or if two EC trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

AC Sources Operating B 3.8.1 BASES ACTIONS A.2 (continued)

Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

Alternatively, a Completion Time can be determined in A.3 accordance with the Risk Informed Completion Time Program.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if an offsite circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of redundant required features. These features require Class 1E power from PBA-S03 or PBB-S04 ESF buses to be OPERABLE, and are identical to those specified in ACTION A.2. Mode applicability is as specified in each appropriate TS section. Redundant required feature failures consist of

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-9 REVISION 63

AC Sources Operating B 3.8.1 BASES Alternatively, a Completion Time can be determined in accordance ACTIONS B.4 (continued) with the Risk Informed Completion Time Program.

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 10 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

When utilizing an extended DG Completion Time (a Completion Time greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and less than or equal to 10 days), the compensatory measures listed below shall be implemented. For planned maintenance utilizing an extended Completion Time, the compensatory measures shall be implemented prior to entering Condition B. For an unplanned entry into an extended Completion Time, the compensatory measures shall be implemented without delay.

1. The redundant DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified OPERABLE (as required by TS) and no discretionary maintenance activities will be scheduled on the redundant (OPERABLE) DG.

2. No discretionary maintenance activities will be scheduled on the station blackout generators (SBOGs).

3. No discretionary maintenance activities will be scheduled on the startup transformers.

4. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit utilizing the extended DG Completion Time.

5. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled.

Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded approach according to risk significance.

6. The SBOGs will not be used for non-safety functions (i.e.,

power peaking to the grid).

_______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-12 REVISION 63

AC Sources Operating B 3.8.1 BASES ACTIONS B.4 (continued)

7. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

Additionally, DG outages will not be scheduled when severe weather conditions and/or unstable grid conditions are predicted or present.

8. All maintenance activities associated with the unit that is utilizing the extended DG Completion Time will be assessed and managed per 10 CFR 50.65 (Maintenance Rule).

9. The functionality of the SBOGs will be verified by ensuring that the monthly start test has been successfully completed within the previous four weeks before entering the extended DG Completion Time.

10. The OPERABILITY of the steam driven auxiliary feedwater pump will be verified before entering the extended DG Completion Time.

11. The system dispatcher will be contacted once per day and informed of the DG status, along with the power needs of the facility.

12. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the extended DG Completion Time, an operator will be available locally at the SBOG should local operation of the SBOG be required as a result of on-site weather related damage.

13. No discretionary maintenance will be allowed on the main and unit auxiliary transformers associated with the unit.

If one or more of the above compensatory measures is not met while in the extended completion time, the corrective action program shall be entered, the risk managed in accordance with the Maintenance Rule, and the compensatory measure(s) restored without delay.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-13 REVISION 63

AC Sources Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable. However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and

b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

Condition C applies only when the offsite circuits are unavailable to commence automatic load sequencing in the event of a design basis accident (DBA). In cases where the offsite circuits are available for sequencing, but a DBA could cause actuation of the Degraded Voltage Relays, Condition G applies for Class 1E bus(es) with single stage time delay DVRs and inverse time delay LVRs.

Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-15 REVISION 64 CORRECTED

AC Sources Operating B 3.8.1 BASES ACTIONS D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to a train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

Alternatively, a According to Regulatory Guide 1.93 (Ref. 6), operation may Completion Time can continue in Condition D for a period that should not exceed 12 be determined in hours.

accordance with the In Condition D, individual redundancy is lost in both the offsite Risk Informed electrical power system and the onsite AC electrical power system.

Completion Time Since power system redundancy is provided by two diverse sources Program. of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. Alternatively, a Completion Time can be E.1 determined in accordance with the Risk Informed Completion Time Program.

With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC

_______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-16 REVISION 63 CORRECTED

AC Sources Operating B 3.8.1 BASES ACTIONS E.1 (continued) power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Alternatively, a Completion Time can be Insert 14 determined in accordance with the Risk Informed F.1 and F.2 Completion Time Program.

The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated ESF bus. Therefore, loss of an ESF bus sequencer affects every major ESF system in the load group. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining sequencer OPERABILITY. This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the sequencer is inoperable is minimal. Required Action F.2 is intended to provide assurance that a single failure of a DG Sequencer will not result in a complete loss of safety function of critical redundant required features.

Alternatively, a Completion Time can be determined in accordance with the Risk G.1 and G.2 Informed Completion Time Program.

A Note indicates that Condition G is not applicable for Class 1E bus(es) provided with a two stage time delay for the Degraded Voltage Relays (DVR) and a fixed time delay Loss of Voltage Relays (LVR). The DVRs are being modified to install a two stage time delay design: one short stage time delay for when a SIAS is present and a second long stage time delay when no SIAS is present. The LVRs are being modified to replace the existing mechanical inverse time delay relays with fixed time delay relays.

Condition G is not applicable to Class 1E bus DVRs and LVRs that have been modified. The installation of the two stage time delays ensures automatic actuation of the DVRs within the assumptions of the accident analysis should the offsite source post-trip voltage be degraded. Conditions A and C remain applicable to Class 1E buses that have been modified. The more restrictive requirements of Condition G reflect the single stage time delay DVR design not being consistent with the time delay assumptions of the accident analysis.

______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-17 REVISION 64 CORRECTED

Insert 14: B 3.8.1-17 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DG train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one DG train is inoperable for any reason and a second DG train is found to be inoperable, or if two DG trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

AC Sources Operating B 3.8.1 Insert 15 BASES I

ACTIONS H.1 and H.2 (continued)

I If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

I.1 Condition I corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and testing REQUIREMENTS of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SR for demonstrating OPERABILITY of the DGs are based on the recommendations of Regulatory Guide 1.9 (Ref. 3), unless otherwise noted in the Updated FSAR Section 1.8.

The DG capabilities (starting and loading) are required to be met from a variety of initial conditions such as DG in standby condition with the engine hot (SR 3.8.1.15) and DG in standby condition with the engine at normal keep-warm conditions (SR 3.8.1.2, SR 3.8.1.7 and SR 3.8.1.19). Although it is expected that most DG starts will be performed from normal keep-warm conditions, DG starts should be performed with the jacket water cooling and lube oil temperatures within the lower to upper limits of DG OPERABILITY, except as noted above. Rapid cooling of the DG down to normal keep-warm conditions should be minimized.

_______________________________________________________________________ (continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-22 REVISION 41

Insert 15: B 3.8.1-22 H.1 With three or more required AC sources inoperable, the Required Action is to restore the required AC source(s) to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain some level of redundancy in the AC electrical power supplies. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of required AC sources. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the third or a subsequent required AC source is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two required AC sources are inoperable for any reason and additional required AC sources are found to be inoperable, or if three or more required AC sources are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

DC Sources Operating B 3.8.4 or in accordance with the Risk Informed Completion Time Program BASES ACTIONS Required Action A.3 limits the restoration time for the (continued) inoperable battery charger to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used. The backup class 1E charger is used to restore OPERABILITY as no balance of plant non-class 1E battery charger exists. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.

B.1 Condition B represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. This condition is exclusive of the status of one battery charger.

It is therefore, imperative that the operators attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected subsystem. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an inoperable DC distribution subsystem.

If one of the required DC electrical power subsystems is inoperable for reasons other than Condition A, the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure would, however, result in the complete loss of the remaining 125 VDC electrical power subsystem with attendant loss of ESF functions, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.4-7 REVISION 61

DC Sources Operating B 3.8.4 Insert 16 BASES D D ACTIONS C.1 and C.2 (continued)

If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).

SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.17 volts per cell (Vpc) times the number of connected cells or 130.2 V for a 60 cell battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 and SR 3.8.4.5 Deleted (continued)

PALO VERDE UNITS 1,2,3 B 3.8.4-8 REVISION 61

Insert 16: B 3.8.4-8 C.1 With two DC electrical power subsystems inoperable, the Required Action is to restore at least one DC electrical power subsystem to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain control power for the AC emergency power system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required DC electrical power subsystem. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DC electrical power subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one DC electrical power subsystem is inoperable for any reason and a second DC electrical power subsystem is found to be inoperable, or if two DC electrical power subsystem are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Inverters Operating B 3.8.74 BASES ACTIONS A.1 (continued) based on a Required Action A.1 allows 7 days to fix the inoperable inverter and return it to service. The 7 day limit is a combination of risk informed Completion Time based on a plant specific risk deterministic defense- analysis, taking into consideration the time required to in-depth and safety repair an inverter and the additional risk to which the unit margin inherent in the is exposed because of the inverter inoperability. This has electrical distribution to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a system with risk shutdown might entail. When the AC vital instrument bus is insights from the powered from its constant voltage source, it is relying upon station's internal interruptible AC electrical power sources (offsite and events PRA model. onsite). The uninterruptible inverter source to the AC Alternatively, a vital instrument buses is the preferred source for powering instrumentation trip setpoint devices.

Completion Time can be determined in Planned inverter maintenance or other activities that accordance with the require entry into Required Action A.1 will not be Risk Informed undertaken concurrent with the following:

Completion Time

a. Planned maintenance on the associated train Diesel Program. Generator (DG): or

b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.

These actions are taken because it is recognized that with a required inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated DG Insert 17 following a loss of offsite power event.

B.1 and B.2 C

C If the required inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

PALO VERDE UNITS 1,2,3 B 3.8.7-4 REVISION 63

Insert 17: B 3.8.7-4 B.1 With two or more required inverters inoperable, the Required Action is to restore all but one required inverter to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain AC electrical power to the vital buses. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required inverter. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent required inverter is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one required inverter is inoperable for any reason and additional required inverters are found to be inoperable, or if two or more required inverters are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Distribution Systems Operating B 3.8.9 BASES (continued)

ACTIONS A.1 With one or more required AC buses, load centers, or motor control centers (see Table B 3.8.9.-1), except AC vital instrument buses, in one subsystem inoperable, the remaining AC electrical power distribution subsystem in the other train is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining power distribution subsystems could result in the minimum required ESF functions not being supported.

Therefore, the required AC buses, load centers and motor control centers must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

or in accordance with the Risk Informed Condition A worst scenario is one train (PBA or PBB) without AC power (i.e., no offsite power to the train and the Completion Time associated DG inoperable). In this condition, the unit is Program more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remaining train by stabilizing the unit, and on restoring power to the affected train. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this condition is acceptable because of:

a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations and actions necessary to restore power to the affected train, to the actions associated with taking the unit to shutdown within this time limit; and

b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.

B.1 With AC vital instrument bus(es) (Channels A or C, or Channels B or D) (see Table B 3.8.9-1) in one train inoperable, the remaining OPERABLE AC vital bus electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall (continued)

PALO VERDE UNITS 1,2,3 B 3.8.9-4 REVISION 63

Distribution Systems Operating B 3.8.9 BASES ACTIONS B.1 (continued) reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, the required AC vital instrument buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated inverter via inverted DC voltage or the Class 1E constant voltage regulator.

Alternatively, a Completion Time Condition B represents one train without adequate AC vital can be determined instrument bus power; potentially both the DC source and the associated AC source are nonfunctioning. In this situation, in accordance with the unit is significantly more vulnerable to a complete loss the Risk Informed of all noninterruptible power. It is, therefore, imperative Completion Time that the operator's attention focus on stabilizing the unit, Program. minimizing the potential for loss of OPERABILITY to the remaining vital instrument buses, and restoring power to the affected electrical power distribution subsystem.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate AC vital instrument power. Taking exception to LCO 3.0.2 for components without adequate AC vital instrument power, which would have the Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared inoperable, is acceptable because of:

a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) and not allowing stable operations to continue;

b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate AC vital instrument power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and

c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time takes into account the importance to safety of restoring the AC vital instrument bus to OPERABLE status, the redundant capability afforded by the other OPERABLE vital instrument buses, and the low probability of a DBA occurring during this period.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.9-5 REVISION 63

Distribution Systems Operating B 3.8.9 BASES ACTIONS C.1 With DC bus(es) in one train (see Table B 3.8.9-1) inoperable, the remaining DC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.

The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the required DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated battery or battery charger.

Alternatively, a Completion Time Condition C represents one train without adequate DC power; potentially both with the battery significantly degraded and can be determined the associated charger nonfunctioning. In this situation, in accordance with the unit is significantly more vulnerable to a complete loss the Risk Informed of all DC power. It is, therefore, imperative that the Completion Time operator's attention focus on stabilizing the unit, Program. minimizing the potential for loss of power to the remaining DC buses and restoring power to the affected DC electrical power distribution subsystem.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components which would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown) while allowing stable operations to continue;

b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and

c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.9-6 REVISION 63

Distribution Systems Operating B 3.8.9 BASES Insert 18 E E ACTIONS D.1 and D.2 (continued)

If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost. When more than one Condition is entered, and this results in the loss of a required safety function, the plant is in a condition outside the accident analysis. Therefore, no additional time is justified for continued operation.

LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital instrument bus electrical power distribution systems are functioning properly, with the required circuit breakers closed and the buses energized. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus.

The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.9-7 REVISION 63

Insert 18: B 3.8.9-7 D.1 With two or more electrical power distribution subsystems inoperable, the Required Action is to restore electrical power distribution subsystem(s) to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent electrical power distribution subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service.

The Required Action is only applicable if one electrical power distribution subsystem is inoperable for any reason and a second electrical power distribution subsystem is found to be inoperable, or if two or more electrical power distribution subsystems are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 4 License Conditions and Regulatory Commitment

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 4 License Conditions and Regulatory Commitment License Conditions APS proposes the following change to the license conditions:

1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.

2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Additionally, APS requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.

Regulatory Commitment The commitment contained in this Attachment 4 supersedes the commitments provided in the original LAR (ADAMS Accession Number ML15218A300).

1. APS will resolve the eight not closed finding level facts and observations (F&O) listed in Attachment 6 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (ADAMS Accession Number ML17079A427). The not closed finding level F&O will be closed prior to utilizing the PRA models for use in the RICT Program.

4-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 5 List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions Section 4.0, item 2 of the NRC final safety evaluation (reference 1 of this attachment) for NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 2 of this attachment) identifies the following needed content:

The license amendment request (LAR) will provide identification of the technical specifications TS limiting conditions of operation (LCO) and action requirements to which the RMTS will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSC) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions [i.e., 50.46 emergency core cooling system (ECCS) flow rates] for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This attachment provides confirmation that the Palo Verde Nuclear Generating Station (PVNGS) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the risk-informed completion times (RICT) program to the proposed scope TS LCO conditions, and provides the information requested for Section 4.0, item 2 of the NRC final safety evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program.

The PVNGS PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.

Table A5-1, In Scope TS/LCO Conditions to Corresponding PRA Functions, lists each TS LCO Condition to which the RICT program is proposed to be applied, and documents the following information regarding the TS with the associated safety analyses, the analogous PRA functions, and the results of the comparison:

Column "TS LCO/Condition": Lists all of the LCOs and condition statements within the scope of the submittal.

Column "SSCs Covered by TS LCO/Condition": Lists the SSCs addressed by each action requirement.

Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO/conditions are included in the PRA.

Column "Function Covered by TS LCO/Condition": Contains a summary of the required functions from the design basis analyses.

Column "Design Success Criteria": Lists a summary of the success criteria from the design basis analyses.

Column "PRA Success Criteria": Lists the function success criteria modeled in the PRA.

5-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5

Column "Disposition": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A.

The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than overly conservative, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to Capability Category II of the PRA standard as required by NEI 06-09-A.

Examples of calculated RICTs are provided for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable) in this Attachment under Table A5-2, Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate. Actual RICT values will be calculated based on the actual plant configuration using a current revision of the PRA model which represents the as-built/as-operated condition of the plant, as required by NEI 06-09-A and the NRC final safety evaluation, and may differ from the RICTs presented.

5-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.3.6 ESFAS Logic and Manual Trip 4 Manual Trip Channels Yes Initiate safety systems to protect against violating core design 2 of 4 channels Same SSCs are modeled consistent with the TS scope and so can be directly limits and RCS pressure boundary, and to mitigate accidents. evaluated using the CRMP tool model.

Condition B - One or more 4 Initiating Logic Channels Yes 2 of 4 channels Functions with one Manual Trip or The success criteria in the PRA are consistent with the design basis Initiation Logic channel inoperable. criteria.

3.3.6 ESFAS Logic and Manual Trip 2 Actuation Logic Channels Yes Initiate safety systems to protect against violating core design 1 of 2 channels Same SSCs are modeled consistent with the TS scope and so can be directly limits and RCS pressure boundary, and to mitigate accidents. evaluated using the CRMP tool model.

Condition D - One or more Functions with one Actuation Logic The success criteria in the PRA are consistent with the design basis channel inoperable. criteria.

3.4.10 Pressurizer Safety Valves 4 Pressurizer Safety Valves Yes Prevent RCS pressure from exceeding safety limit. 4 of 4 Pressurizer Safety Valves 4 of 4 Pressurizer Safety SSCs are modeled consistent with the TS scope and so can be directly Valves (PSV) for limiting evaluated using the CRMP tool model.

Condition A - One pressurizer anticipated transient safety valve inoperable. without scram (ATWS); 1 of 4 PSVs for non ATWS scenarios 3.4.12 Pressurizer Vents 4 Pressurizer Vent Paths Yes Depressurize the RCS during a steam generator tube rupture 1 of 4 Pressurizer Vent Paths Same SSCs are modeled consistent with the TS scope and so can be directly (SGTR) with loss of offsite power (LOP). evaluated using the CRMP tool model.

Condition A - Two or three required pressurizer vent paths inoperable. The success criteria in the PRA are consistent with the design basis criteria.

3.4.12 Pressurizer Vents See LCO Condition 3.4.12.A Condition B - All pressurizer vent paths inoperable.

3.5.1 SITs 4 Safety Injection Tanks Yes Emergency core cooling system (ECCS) injection during a 3 of 4 SITs 2 of 3 intact cold legs SSCs are modeled consistent with the TS scope and so can be directly (SITs) large loss-of-coolant accident (LOCA). (assumed one SIT lost evaluated using the CRMP tool model.

Condition C - Two or more SITs out break) for large inoperable for reasons other than LOCA; 4 of 4 SITs for Two SITs are required to inject borated water into the RCS for large Condition A. small LOCA during a LOCAs. The UFSAR requirement of 3 SITs is based on the extremely failure of both HPSI conservative 10CFR50 App. K analysis criteria. Best estimate analysis trains in WCAP-15701 [see Table 6.1-6] (Reference 3 of this Attachment) by Combustion Engineering has shown that 1 SIT with either one train of HPSI or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited for large LOCAs in the PRA model.

Note that for small LOCAs with failure of both high pressure safety Injection (HPSI) trains, the PRA credits operator manual depressurization and requires 4 of 4 SITs to inject. This scenario is beyond design basis due to failure of both HPSI trains, which is assumed to be available in the design basis small LOCA scenarios.

5-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.5.3 ECCS Operating 2 Low Pressure Safety Yes The Emergency Core Cooling System (comprised of the LPSI 1 of 2 LPSI subsystems Same SSCs are modeled consistent with the TS scope and so can be directly Injection (LPSI) subsystems and HPSI subsystems) provides core cooling and negative evaluated using the CRMP tool model.

Condition A - One LPSI subsystem (Train A and Train B) reactivity to ensure the reactor core is protected after design inoperable. basis accidents during both phases of ECCS Operation The success criteria in the PRA are consistent with the design basis Associated flowpaths (piping, (injection and recirculation). criteria.

valves, instruments and controls) 3.5.3 ECCS Operating 2 High Pressure Safety Yes The Emergency Core Cooling System (comprised of the LPSI 1 of 2 HPSI trains Same SSCs are modeled consistent with the TS scope and so can be directly Injection (HPSI) trains (Train and HPSI subsystems) provides core cooling and negative evaluated using the CRMP tool model.

Condition B - One or more trains A and Train B) reactivity to ensure the reactor core is protected after design inoperable for reasons other than basis accidents during both phases of ECCS Operation The success criteria in the PRA are consistent with the design basis Condition A. 2 Low Pressure Safety (injection and recirculation). 1 of 2 ECCS trains (HPSI and LPSI) Same criteria.

AND Injection (LPSI) trains (Train A At least 100% of the ECCS flow and Train B) equivalent to a single OPERABLE ECCS train available. Associated flowpaths (piping, valves, instruments and controls) 3.5.5 Refueling Water Tank (RWT) RWT Yes Supply borated water to ECCS and CS system during LOCA 1 of 1 RWT Same SSCs are modeled consistent with the TS scope and so can be directly injection phase for: evaluated using the CRMP tool model.

Condition B - RWT inoperable for reasons other than Condition A. (a) containment cooling and depressurization The success criteria in the PRA are consistent with the design basis criteria.

(b) core cooling and replacement inventory (c) negative reactivity for reactor shutdown 3.6.2 Containment Air Locks 2 air locks (personnel and No Airlock leakage within limits. 2 of 2 air locks isolable Not modeled SSCs for the containment air locks can be evaluated by a bounding emergency), each with assessment as permitted by NEI 06-09-A. In this case containment is Condition C - One or more interlock mechanisms conservatively considered failed and LERF is set to the base CDF value.

containment air locks inoperable for reasons other than Condition A or B.

5-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.6.3 Containment Isolation Valves 2 containment isolation valves Yes Each containment penetration isolated within the limits 1 of 2 containment isolation valves 1 of 2 containment The PRA does not explicitly model the impact of excessive stroke time.

on each penetration assumed in the safety analysis. or isolation devices per penetration isolation valves per This condition can be addressed for the RICT Program by removing the Condition A - One or more penetration for: inoperable containment isolation valve from service if it is open.

penetration flow paths with one containment purge; Therefore, this LCO condition can be evaluated using the CRMP tool required containment isolation valve radwaste drain; model.

inoperable except for purge valve charging; letdown; leakage not within limit. reactor drain tank (RDT) Any individual penetrations not explicitly modeled in the PRA have been discharge; RDT Makeup; evaluated to be less than the 1.27 diameter effective LERF threshold RDT vent; nitrogen for PVNGS. Multiple open penetrations can be modeled by failing a supply; instrument air surrogate penetration found in the PRA model.

and reactor coolant pump (RCP) seal The success criteria in the PRA are consistent with the design basis bleedoff criteria.

3.6.3 Containment Isolation Valves See LCO Condition 3.6.3.A Condition B - One or more penetration flow paths with two required containment isolation valves inoperable except for purge valve leakage not within limit.

3.6.3 Containment Isolation Valves 1 containment isolation valve Yes Each containment penetration isolated within the limits 1 of 2 containment isolation barriers Same The PRA does not explicitly model the impact of excessive stroke time.

on each penetration line with assumed in the safety analysis. Redundant function also per penetration Any individual penetrations not explicitly modeled in the PRA have been Condition C - One or more a closed system performed by closed system inside containment. evaluated to be less than the 1.27 diameter effective LERF threshold penetration flow paths with one for PVNGS. Multiple open penetrations can be modeled by failing a required containment isolation valve surrogate penetration found in the PRA model.

inoperable.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

5-5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.6.3 Containment Isolation Valves 4 containment purge Yes Purge valve and blind flange leakage rates within limits for 1 of 2 purge valves per penetration Same Any individual penetrations not explicitly modeled in the PRA have been penetrations (56, 57, 78 and each penetration. within purge valve leakage limit. evaluated to be less than the 1.27 diameter effective LERF threshold Condition D - One or more 79), each with 2 valves in Blind flange within purge valve for PVNGS. Multiple open penetrations can be modeled by failing a penetration flow paths with one or series. Two penetrations are leakage limits when the blind flange surrogate penetration found in the PRA model.

more containment purge valves not 8 inch diameter and two is used in place of purge valve.

within leakage limits. penetrations are 42 inch SSCs are modeled consistent with the TS scope and so can be directly diameter. evaluated using the CRMP tool model.

Blind Flange can be used as an alternate containment The success criteria in the PRA are consistent with the design basis isolation device for criteria.

penetrations 56 and 57 per TS 3.6.3 note 5.

3.6.6 Containment Spray (CS) 2 CS trains Yes Containment atmosphere cooling to limit post-accident 1 of 2 CS trains Same CS is credited in PRA for containment heat removal. However, iodine System pressure and temperature. removal is not a mitigating function to prevent core damage or large early release.

Condition A - One containment Iodine removal to reduce the release of fission product spray train inoperable. radioactivity from containment to the environment. The success criteria in the PRA are consistent with the design basis criteria.

3.7.2 Main Steam Isolation Valves 4 MSIVs Yes Isolate steam flow from the secondary side of the steam 1 of 4 MSIVs fail to close Same SSCs are modeled consistent with the TS scope and so can be directly (MSIVs) generators following a high energy line break (HELB). evaluated using the CRMP tool model.

Condition F - One MSIV inoperable in MODE 1.

3.7.2 MSIVs See LCO Condition 3.7.2.A Condition G - Two or more MSIVs inoperable in MODE 1.

3.7.3 Main Feedwater Isolation 4 economizer MFIVs and 4 No Isolate Main Feedwater (MFW) flow to the secondary side of 1 of 4 MFIVs fail to close Not modeled The PRA models the failure of the two downcomer paths (each path with Valves (MFIVs) downcomer MFIVs. There are the steam generators following a High Energy Line Break 2 MFIVs) to provide sufficient flow of feedwater to the steam generators.

a total of 8 MFIVs, with 2 (HELB). The closure of the MFIVs to prevent Containment failure or RCS Condition A - One or more MFIVs redundant MFIVs on each of overcooling is not explicitly modeled in the current PRA due to the inoperable. the 4 piping segments. redundancy of the MFIVs and low likelihood of the applicable initiating events. However, to address this condition for a RICT, the PRA will be adjusted to explicitly model the risk significance of a MFIV failure to close on Containment integrity and RCS overcooling. Failure of both MFIVs to close for the affected initiating events will be assumed to result in core damage and Containment failure.

3.7.3 MFIVs See LCO Condition 3.7.3.A Condition B - Two valves in the same flow path inoperable.

5-6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.7.4 Atmospheric Dump Valves 4 ADV lines (two per SG, Yes Cool unit to Shutdown Cooling (SDC) entry conditions. 1 of 4 ADVs Same except for rapid The success criteria in the PRA is consistent with the design basis (ADVs) each with ADV and block depressurization of RCS criteria, and more conservative for mitigation of rapid depressurization of valve) to SDC conditions, then RCS to SDC conditions scenarios.

Condition A - One required ADV line 2 of 4 ADVs inoperable. SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

3.7.4 ADVs See LCO Condition 3.7.4.A Condition B - Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs.

3.7.5 Auxiliary Feedwater (AFW) 2 steam lines with associated Yes Provide steam to turbine-driven AFW pump. 1 of 2 steam lines Same SSCs are modeled consistent with the TS scope and so can be directly System supply valves for the turbine evaluated using the CRMP tool model.

driven AFW pump Condition A - One steam supply to The success criteria in the PRA are consistent with the design basis turbine driven AFW pump criteria.

inoperable.

3.7.5 AFW System 1 safety related (SR) motor- Yes Supply feedwater to the SGs to remove RCS decay heat. 1 SR motor-driven train or 1 SR 1 of 3 trains (1 SR The operability of the non-safety related (SR) motor driven AFW pump is driven train turbine-driven train motor-driven train, 1 SR important from a risk perspective; this pump is not credited in the Condition B - One AFW train 1SR turbine-driven train turbine-driven train, or 1 PVNGS Accident Analyses. The difference between the Design Success inoperable for reasons other than 1 non SR motor driven train non SR motor driven Criteria and PRA Success Criteria is due to the design basis being Condition A. train) highly conservative whereas the PRA is realistic.

Associated flow paths (piping, valves, instruments and SSCs are modeled consistent with the TS scope and so can be directly controls) evaluated using the CRMP tool model.

3.7.5 AFW System See LCO Condition 3.7.5.A and 3.7.5.B Condition C - Two AFW trains inoperable.

5-7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.7.7 Essential Cooling Water (EW) 2 trains, each with 1 pump, 1 Yes Heat sink for the removal of process and operating heat from 1 of 2 trains Same The PRA also credits EW to Nuclear Cooling as a backup for cooling System surge tank , 1 heat exchanger safety related components during a Design Basis Accident RCP seals.

and associated flow paths (DBA) or transient.

Condition A - One EW train (piping, valves, instruments SSCs are modeled consistent with the TS scope and so can be directly inoperable. and controls) evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

3.7.7 Essential Cooling Water (EW) See LCO Condition 3.7.7.A System Condition B - Two EW trains inoperable.

3.7.8 Essential Spray Pond System 2 trains, each with 1 pump, 1 Yes Heat sink for removal of process and operating heat from the 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly EW heat exchanger and EW system. evaluated using the CRMP tool model.

Condition A - One ESPS train associated flow paths (piping, inoperable. valves, instruments and The success criteria in the PRA are consistent with the design basis controls) criteria.

3.7.8 Essential Spray Pond System See LCO Condition 3.7.8.A Condition B - Two ESPS trains inoperable.

3.7.10 Essential Chilled Water 2 trains, each with 1 pump, 1 Yes Heat transfer system to the Ultimate Heat Sink for the removal 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly System surge tank , 1 heat exchanger of process and operating heat from selected safety related air evaluated using the CRMP tool model.

and associated flow paths handling systems during a Design Basis Accident (DBA) or Condition A - One EC train (piping, valves, instruments transient. The success criteria in the PRA are consistent with the design basis inoperable. and controls) criteria.

3.7.10 Essential Chilled Water See LCO Condition 3.7.10.A System Condition B - Two EC trains inoperable.

3.8.1 AC Sources - Operating 2 offsite circuits, each with Yes Supply power from the transmission network to the 4.16 kV 1 of 2 offsite circuits Same SSCs are modeled consistent with the TS scope and so can be directly breakers, transformers, Class 1E buses. evaluated using the CRMP tool model.

Condition A - One required offsite switches, interrupting devices, circuit inoperable. cabling and controls The success criteria in the PRA are consistent with the design basis criteria.

3.8.1 AC Sources - Operating 2 diesel generators (DGs) Yes Upon loss of preferred power, supply the ESF loads in 1 of 2 DG Same SSCs are modeled consistent with the TS scope and so can be directly sufficient time to mitigate the consequences of a DBA. evaluated using the CRMP tool model.

Condition B - One Diesel Generator (DG) inoperable. The success criteria in the PRA are consistent with the design basis criteria.

Two Station Blackout Generators (SBOG) are also credited in the PRA model.

5-8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.8.1 AC Sources - Operating See LCO Condition 3.8.1.A Condition C - Two required offsite circuits inoperable.

3.8.1 AC Sources - Operating See LCO Condition 3.8.1.A and 3.8.1.B SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

Condition D - One required offsite circuit inoperable. The success criteria in the PRA are consistent with the design basis AND criteria.

One DG inoperable.

Two Station Blackout Generators (SBOG) are also credited in the PRA model.

3.8.1 AC Sources - Operating See LCO Condition 3.8.1.B Condition E - Two DGs inoperable.

3.8.1 AC Sources - Operating 2 automatic load sequencers Yes Return loads to service within time limits after initiating signal, 1 of 2 automatic load sequencers Same SSCs are modeled consistent with the TS scope and so can be directly in predetermined sequence to prevent over-loading the power evaluated using the CRMP tool model.

Condition F - One automatic load source by automatic load application.

sequencer inoperable. The success criteria in the PRA are consistent with the design basis criteria.

3.8.1 AC Sources - Operating See LCO Condition 3.8.1.A and 3.8.1.B SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

Condition H - Three or more required AC sources inoperable. The success criteria in the PRA are consistent with the design basis criteria.

Two Station Blackout Generators (SBOG) are also credited in the PRA model.

3.8.4 DC Sources - Operating 2 Class 1E DC electrical Yes Provide control power to AC emergency power system, motive 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be power subsystems (Train A and control power to selected safety related equipment and directly evaluated using the CRMP tool model.

Condition A - One battery charger and Train B), each with 2 DC preferred AC vital instrument bus power (via inverters).

on one subsystem inoperable. batteries, a battery charger for The success criteria in the PRA are consistent with the design basis each battery, associated criteria.

control equipment and interconnecting cabling 3.8.4 DC Sources - Operating 2 Class 1E DC electrical Yes Provide control power to AC emergency power system, motive 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be directly power subsystems (Train A and control power to selected safety related equipment and evaluated using the CRMP tool model.

Condition B - One DC electrical and Train B), each with 2 DC preferred AC vital instrument bus power (via inverters).

power subsystem inoperable for batteries, a battery charger for The success criteria in the PRA are consistent with the design basis reasons other than Condition A. each battery, associated criteria.

control equipment and interconnecting cabling 5-9

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions SSCs SSCs Covered by TS LCO/

TS LCO / Condition Modeled Function Covered by TS LCO/Condition Design Success Criteria PRA Success Criteria Disposition Condition in PRA 3.8.4 DC Sources - Operating 2 Class 1E DC electrical See LCO Condition 3.8.4.A and 3.8.4.B power subsystems (Train A Condition C - Two DC electrical and Train B), each with 2 power subsystems inoperable. channels per subsystems 3.8.7 Inverters - Operating 2 Inverters per Train (A and Yes Provide the preferred source of power for the AC vital buses. 1 of 2 inverter trains Same SSCs are modeled consistent with the TS scope and so can be directly B) This is an uninterruptible power for the instrumentation and evaluated using the CRMP tool model.

Condition A - One required inverter controls of the reactor protection system (RPS) and ESFAS.

inoperable. The success criteria in the PRA are consistent with the design basis criteria.

3.8.7 Inverters - Operating 2 inverters per Train (A and See LCO Condition 3.8.7.A B), each with 2 channels per Condition B - Two or more required train inverters inoperable.

3.8.9 Distribution Systems - 2 subsystems [4.16 kV Yes Provide necessary power to ESF systems. 1 of 2 AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly Operating Engineered Safety Feature evaluated using the CRMP tool model.

(ESF) buses, secondary AC Condition A - One AC electrical electrical power distribution The success criteria in the PRA are consistent with the design basis power distribution subsystem panels, load centers and criteria.

inoperable. motor control centers]

3.8.9 Distribution Systems - 2 subsystems (Train A and Yes Provide necessary power to ESF systems. 1 of 2 vital AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly Operating Train B), each with 2 evaluated using the CRMP tool model.

channels per subsystems Condition B - One AC vital The success criteria in the PRA are consistent with the design basis instrument bus electrical power criteria.

distribution subsystem inoperable.

3.8.9 Distribution Systems - 2 subsystems (Train A and Yes Provide necessary power to ESF systems. 1 of 2 vital DC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly Operating Train B), each with 2 evaluated using the CRMP tool model.

channels per subsystems Condition C - One DC electrical The success criteria in the PRA are consistent with the design basis power distribution subsystems criteria.

inoperable.

3.8.9 Distribution Systems - See LCO Condition 3.8.9.A through 3.8.9.C Operating Condition D - Two or more electrical power subsystems inoperable.

5-10

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate RICT Calculated - RICT Calculated - Loss of Function TS LCO Condition Low Estimate1 High Estimate1 (Yes/No/Maybe)

Condition B - One or more Functions with one Manual Trip or Initiation 30 day backstop10 30 day backstop No Logic channel 3.3.6 ESFAS Logic and inoperable.

Manual Trip Condition D - One or more Functions with one 2 days8,9,11 30 day backstop No Actuation Logic channel inoperable.

Condition A - One 3.4.10 Pressurizer pressurizer safety valve 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 Safety Valves inoperable.

Condition A - Two or three required 30 day backstop 30 day backstop No pressurizer vent paths 3.4.12 Pressurizer Vents inoperable.

Condition B - All pressurizer vent paths 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 inoperable.

Condition C - Two or more SITs inoperable for 3.5.1 SITs 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 reasons other than Condition A.

Condition A - One LPSI 30 day backstop 30 day backstop No subsystem inoperable.

Condition B - One or more trains inoperable for reasons other than 3.5.3 ECCS Operating Condition A.

AND 27 days 30 day backstop No At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

Condition B - RWT 3.5.5 RWT inoperable for reasons 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 other than Condition A.

Condition C - One or more containment air 3.6.2 Containment Air locks inoperable for 9 days9 30 day backstop No Locks reasons other than Condition A or B.

5-11

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate RICT Calculated - RICT Calculated - Loss of Function TS LCO Condition Low Estimate1 High Estimate1 (Yes/No/Maybe)

Condition A - One or more penetration flow paths with one required containment isolation 10 days9 30 day backstop No valve inoperable except for purge valve leakage not within limit.

Condition B - One or more penetration flow paths with two required containment isolation 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 3.6.3 Containment valves inoperable except Isolation Valves for purge valve leakage not within limit.

Condition C - One or more penetration flow paths with one required 9 days9 30 day backstop No containment isolation valve inoperable.

Condition D - One or more penetration flow paths with one or more 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 9 days9 Maybe12 containment purge valves not within leakage limits.

Condition A - One 3.6.6 Containment Spray containment spray train 30 day backstop 30 day backstop No System inoperable.

Condition F - One MSIV 30 day backstop 30 day backstop No inoperable in MODE 1.

3.7.2 MSIVs Condition G - Two or more MSIVs inoperable 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 in MODE 1.

Condition A - One or 9 days9 9 days9 No more MFIVs inoperable.

3.7.3 MFIVs Condition B - Two valves in the same flow 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 path inoperable.

Condition A - One 3.7.4 ADVs required ADV line 30 day backstop 30 day backstop No inoperable.

5-12

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate RICT Calculated - RICT Calculated - Loss of Function TS LCO Condition Low Estimate1 High Estimate1 (Yes/No/Maybe)

Condition B - Two or more ADV lines inoperable with both 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 30 day backstop Maybe3 ADV lines inoperable on one or more SGs.

Condition A - One steam supply to turbine 30 day backstop 30 day backstop No driven AFW pump inoperable.

Condition B - One AFW 3.7.5 AFW System train inoperable for 23 days 30 day backstop No reasons other than Condition A.

Condition C - Two AFW 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 2 days Maybe13 trains inoperable.

Condition A - One EW 30 day backstop 30 day backstop No 3.7.7 Essential Cooling train inoperable.

Water (EW) System Condition B - Two EW 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 trains inoperable.

Condition A - One 30 day backstop 30 day backstop No 3.7.8 Essential Spray ESPS train inoperable.

Pond System Condition B - Two 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 ESPS trains inoperable.

Condition A - One EC 30 day backstop 30 day backstop No 3.7.10 Essential Chilled train inoperable.

Water System Condition B - Two EC 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 trains inoperable.

Condition A - One required offsite circuit 30 day backstop 30 day backstop No inoperable.

Condition B - One Diesel Generator (DG) 30 day backstop 30 day backstop No inoperable.

Condition C - Two required offsite circuits 30 day backstop 30 day backstop No 3.8.1 AC Sources - inoperable.

Operating Condition D - One required offsite circuit inoperable 30 day backstop 30 day backstop No AND one DG inoperable.

Condition E - Two DGs 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 inoperable.

5-13

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate RICT Calculated - RICT Calculated - Loss of Function TS LCO Condition Low Estimate1 High Estimate1 (Yes/No/Maybe)

Condition F - One automatic load 19 days 30 day backstop No sequencer inoperable.

Condition H - Three or more required AC 11 hrs5 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 sources inoperable.

Condition A - One battery charger on one 30 day backstop 30 day backstop No subsystem inoperable.

Condition B - One DC electrical power 3.8.4 DC Sources -

subsystem inoperable 3 days 6 days No Operating for reasons other than Condition A.

Condition C - Two DC electrical power less than 1 hr6 less than 1 hr6 Yes2 subsystems inoperable.

Condition A - One required inverter 30 day backstop 30 day backstop No 3.8.7 Inverters - inoperable.

Operating Condition B - Two or more required inverters 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 30 day backstop Maybe4 inoperable.

Condition A - One AC electrical power 6 days 22 days9 No distribution subsystem inoperable.

Condition B - One AC vital instrument bus electrical power 30 day backstop 30 day backstop No 3.8.9 Distribution distribution subsystem Systems - Operating inoperable.

Condition C - One DC electrical power 3 days 6 days No distribution subsystems inoperable.

Condition D - Two or more electrical power less than 1 hr7 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes2 subsystems inoperable.

5-14

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 Notes:

1. RICTs are based on the internal events, internal flood, internal fire and seismic PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest number of days for illustrative purposes.

2. This is considered a loss of specified safety function. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered PRA functional as defined in section 2.3.1 of NEI 06-09-A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. This is considered a loss of specified safety function only if all four ADVs are inoperable. Therefore if all four ADVs are inoperable then the RICT for this loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. If two inverters on the same train remain operable, there is NOT a loss of safety function. However, when there is a loss of safety function the RICT for a loss of function condition may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

5. This was evaluated with both Diesel Generators and sources of offsite power being impacted to account for the "or more" condition of the LCO.

6. This was evaluated with both Class 1E DC electrical power subsystems [Train A and Train B - (all four channels)] being impacted.

7. This was evaluated with all AC Safety, DC and AC vital instrument buses being impacted to account for the "or more" condition of the LCO.

8. This was evaluated with all Train A engineered safety features actuation system (ESFAS) signals being impacted to account for the "or more" condition with one Actuation Logic channel of the LCO and thus is a bounding value.

9. The limiting RICT for this TS was from the LERF calculation.

10. The ESFAS is made up of 4 quality class input channels, 6 channels of Matrix Logic, 4 channels of Initiation Logic, 2 channels of Actuation Logic, and 4 channels of Manual Trip for 7 Functions; Safety Injection Actuation Signal (SIAS), Containment Isolation Actuation Signal (CIAS), Recirculation Actuation Signal (RAS), Containment Spray Actuation Signal (CSAS), Main Steam Isolation Signal (MSIS), Auxiliary Feedwater Actuation Signal to SG-1 (AFAS-1), and Auxiliary Feedwater Actuation Signal to SG-2 (AFAS-2). This was evaluated with both trains of SIAS, CIAS, CSAS, AFAS, MSIS, and RAS being impacted (increased failure probabilities) to account for the "or more" condition of the LCO.

11. For one actuation logic channel inoperable, the initiated equipment for one train of SIAS, CIAS, CSAS, or MSIS are assumed failed, and the initiation relay for one train of AFAS and RAS is failed.

12. This is considered a loss of function condition if more than one purge valve is inoperable.

5-15

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5

13. This is considered a loss of function condition when two class (i.e. safety related)

AFW pumps are inoperable. If one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function.

References:

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No. ML071200238) dated May 17, 2007

2. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)

3. WCAP-15701, Determination of Realistic LOCA Success Criteria and Selected LOCA Based HRAs for PSA Applications, Revision 0, dated June 2002 5-16

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 6 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Introduction NEI 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 1 of this attachment),

section 2.3.4 states that the probabilistic risk assessment (PRA) shall be reviewed to the guidance of regulatory guide (RG) 1.200, Revision 2 (reference 2 of this attachment), for a PRA which meets Capability Category II for the supporting requirements (SRs) of the internal events at power PRA standard, and that deviations from these capability standards shall be justified and documented. APS has performed its review of the PRA to the guidance in RG 1.200, Revision 2. Section 4.0, item 3 of the NRC final safety evaluation (reference 3 of this attachment), for NEI 06-09-A requires the license amendment request (LAR) to include a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RMTS, including the resolution or disposition of any identified deficiencies (i.e., findings and observations from peer reviews). The scope of this information includes the internal events PRA model, and other models for which additional standards have been endorsed by a revision to RG 1.200.

The following sections demonstrate that the quality and level of detail of the processes used in the risk-informed completion times (RICTs) are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models described within this LAR are the same as those described within the APS submittal of the LAR dated July 31, 2015, to revise the PVNGS TS to allow RICT (reference 29 of this attachment), with routine maintenance updates applied. Changes and plant modifications previously identified in reference 29 that were required to achieve an overall core damage frequency (CDF) and large early release frequency (LERF) consistent with NRC RG 1.174 (reference 31 of this attachment) have been completed.

Internal Events and Internal Flooding PRA The PVNGS RICT process for the internal events and internal flooding hazards will use peer reviewed plant-specific Internal Events and Internal Flooding PRA models in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA models used in this application reflects the as-built and as operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the Internal Events and Internal Flooding PRA models. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Events and Internal Flooding PRA models.

Seismic PRA The PVNGS RICT process for seismic hazards will use a peer reviewed plant specific Seismic PRA model in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the seismic hazards for the seismic PRA. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Seismic PRA model.

6-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Fire PRA The PVNGS RICT process for fire hazards will use a peer reviewed plant specific Internal Fire PRA model in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Industry consensus methods were utilized in the development of the Internal Fire PRA model. While APS was not an applicant to implement national fire protection association standard (NFPA) 805 in accordance with 10 CFR 50.48, the Internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes NRC approved methods. As part of the ongoing PRA maintenance and update process described in Attachment 11 of this enclosure, APS will address Internal Fire PRA methods approved by the NRC since the development of the Internal Fire PRA. Note that APS does not credit incipient fire detection systems in the Internal Fire PRA model. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Fire PRA model.

Other External Hazards PRA The PVNGS RICT process for the external hazards will use a peer reviewed plant-specific screening in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). Each external hazard was evaluated with respect to applicability and/or risk. The ASME PRA Standard RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (reference 4 of this attachment) outlines preliminary and progressive screening approaches that are acceptable for this task. The screening started with the top approach and progressed downward until the hazard in question screened with respect to risk. If none of the screening approaches were successful, then the hazard was analyzed using a detailed PRA approach that meets applicable requirements in the ASME PRA Standard RA-Sa-2009. Implicit in these screening criteria (ones that do not present a quantitative measure) is the assumption that successfully meeting a criterion for screening indicates that the bounding CDF from that hazard is considered to be lower than 1E-6 per year. Attachment 8 of this enclosure provides a summary of the other external hazards screening results and the progressive screening approach for addressing external hazards.

PRA Review Process Results The PRA models described above with the exception of the seismic PRA have been peer reviewed per NEI guidance endorsed in RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 2 of this Attachment) consistent with NRC RIS 2007-06, Regulatory Guide 1.200 Implementation (reference 32 of this attachment). The Seismic PRA was peer reviewed per NEI 12-13 (reference 27 of this attachment) since RG 1.200 Revision 2 did not endorse any seismic PRA peer review guidance (since NEI 12-13 was issued after RG 1.200 Revision 2)

The Internal Events PRA model was peer reviewed in July 1999 by the combustion engineering owners group (CEOG) prior to the issuance of Regulatory Guide 1.200 (reference 7 of this attachment). As a result, a self-assessment of the Internal Events PRA model was conducted by APS in March 2011 (reference 6 of this attachment) in accordance with Appendix B of RG 1.200, Revision 2 (reference 2 of this attachment), to address the PRA quality requirements not considered in the CEOG peer review. APS conducted a full scope Internal Flooding PRA model peer review (reference 8 of this attachment) in November 2010, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).

6-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 The Internal Events PRA quality (including the CEOG peer review and self-assessment results) has previously been reviewed by the NRC in requests to extend the Inverter Technical Specification Completion Time dated September 29, 2010 (reference 33 of this attachment), and to implement TSTF-425, Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b, December 15, 2011 (reference 5 of this attachment). All PRA upgrades [as defined by the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment)] implemented since conduct of the CEOG peer review in 1999 have been peer reviewed.

APS conducted a full scope Internal Fire PRA model peer review (reference 10 of this attachment) in December 2012 in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). APS conducted a second focused scope peer review of the Internal Fire PRA in December 2014 (reference 11 of this attachment), to address ASME PRA Standard (reference 4 of this attachment) supporting requirements determined not met to Capability Category II in the first peer review, not just the associated facts and observations (F&Os) from the first peer review. Thus, the second peer review generated new F&Os which replaced in their entirety the finding level F&Os from the first peer review.

APS conducted a full scope Seismic PRA model peer review (reference 34 of this attachment) in February 2013, in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). APS conducted a full scope External Hazards screening peer review (reference 35 of this attachment) in December 2011, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).

An F&O closure peer review was performed in June 2017, in accordance with NRC letter dated May 3, 2017 (reference 12 of this attachment) to assess the closure of all PRA Model finding level F&Os from these peer reviews (reference 13 of this attachment) that were not otherwise addressed by focused scope peer reviews that re-reviewed the associated ASME PRA supporting requirements in their entirety. The F&O closure review was conducted to ensure the findings had been satisfactorily resolved to meet the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment) to Capability Category II, the sub-element criteria for the CEOG from Internal Events PRA peer review (reference 7 of this attachment), and RG 1.200, Revision 2 (reference 2 of this attachment).

The F&O closure peer review assessed the sixty finding level F&Os from the prior peer reviews and concluded that all were closed with the exception of eight findings. Of the eight not closed findings, six were assessed as partially closed, and two were assessed as open.

The eight not closed findings and their dispositions are described in Table A6-1, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process. During the closure review, a concurrent focused scope peer review was also performed for two separate F&O resolutions that were considered an upgrade per ASME PRA Standard (reference 4 of this attachment). The two F&O resolutions that were considered:

HR-03, common cause miscalibration errors modeled in HRA calculator using Techniques for Human Error Rate Prediction (THERP) approach

SHA-E1-01, use of site specific data collected as part of Near Term Task Force (NTTF) 2.1 analysis 6-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 No new F&Os were identified for the two F&Os for which a concurrent focus scope peer review was performed.

APS has committed in Attachment 4 of this enclosure to resolve the eight not closed finding level F&Os listed in Table A6-1 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (Reference 12 of this Attachment). These not closed finding level F&Os will be closed prior to utilizing the PRA models for RICT. Resolution of the not closed finding level F&Os is not expected to have a significant impact on overall CDF or LERF based on the dispositions described in Table A6-1.

6-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement IE-07 (B) / The Interfacing Systems Loss Status: Partially Closed. The Closure Review Team IE-12 of Coolant Accident (ISLOCA) recommendation will be addressed by treatment for the shutdown Basis: Insufficient justification is provided in Impact 200- 84.pdf to evaluating all ISLOCA failure modes of Internal cooling suction line appears to demonstrate that the frequency of the scenario in question is negligible. The the shutdown cooling system piping.

resolution of this finding only provides qualitative argument that this ISLOCA Events have some questionable Justification for screening out any assumptions. First, it is scenario will require failure of two MOVs, failure to open of the LTOP valve, negligible scenarios will be provided.

assumed that the Low and failure of the warmup piping or the bypass valve. No quantitative values Leakage, spurious operation, and Temperature Over Pressure and LTOP valve capacity were provided to demonstrate that the frequency of catastrophic failure modes of valves will (LTOP) valve would always this scenario is negligible. Note that the likelihood of failure of the piping be considered, as well as the LTOP relief open. While this is the most outside containment is relatively high. Furthermore, it is not clear if the valve failure to open or exceedance of likely scenario, the LTOP valve capacity of the LTOP valve is sufficient to relieve the relatively large flow that the relief capacity.

can fail to open. Qualitative may result from the catastrophic ruptures of the two upstream MOVs. Finally, arguments were made that ISLOCA may also result from leakage of both of the two upstream MOVs, or a These changes are not expected to have should this happen, the combination of leakage and rupture of the two upstream MOVs, in conjunction a significant impact on total CDF or LERF resulting LOCA would be inside with failure of the LTOP valve to open and failure of the downstream piping. since the current internal events containment (primarily based This scenario would have a greater frequency than catastrophic ruptures of contribution to total CDF and LERF is less on relative pipe lengths). This both MOVs because the frequency of MOV leakage is significantly greater than than 2% and 0.5%, respectively. While ignores the fact that the high its catastrophic rupture. the resulting LERF contribution from stress points and stress these scenarios may not be negligible, Recommendation: Provide additional justifications (including the capacity of they are expected to be minimal based concentration points are the LTOP valve, all of the possible failure mode combinations and their outside containment. on industry operating experience.

probabilities of occurrence, LERF value, etc.) to demonstrate that the Furthermore, the shutdown frequency of the scenario in question is indeed negligible compared to the These changes will be implemented and cooling warmup crossover LERF. the finding verified closed by a piping was not considered. subsequent F&O Closure Review as a pre-requisite to RICT implementation.

6-5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement AS-03 (B) / There are some differences Status: Open. The Closure Review Team AS-24 between treatment of a small recommendation will be addressed by LOCA associated with a pipe Basis: Containment heat removal (CHR) is only asked in the small LOCA event modeling CHR in the small LOCA event Internal break and an induced small tree when the success path is relying on high pressure sump recirculation tree, and event scenarios with failure of (HPSR) with a failure of the operators to depressurize and cooldown with Events LOCA (pressurizer safety valve the PSV to reseat. MAAP analyses will be reclosure) in the transient successful SG heat removal. In this case the RCS remains at temperature so performed to include PSV failure to reseat event trees. For example: that there is substantial heat transfer to the containment. Table 4 of 13-NS- in the small break sizes and determine B065 R007 (Reference 14 of this Attachment) presents MAAP results for LOCA the necessity of CHR for long-term stable

In the small LOCA event tree, cases with failure of CHR from spray recirculation. Based on a reply to the end-state.

successful high pressure reviewers question, Table 4 indicates that <2 diameter breaks may just injection and recirculation require CHR because s1_2_1a with SG cooling and failure of SG These changes are not expected to have lead to questioning whether depressurization exceeds a containment pressure of 50 psig at just 6.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . a significant impact on total CDF or LERF containment heat removal is Smaller holes as represented by case s1_1_1a for a 1 break do not exceed since the current internal events successful. In the Transient even 50 psig until 22.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The ultimate containment failure pressure is contribution to total CDF and LERF is less Type 2 and Transient Type 3 141 psig (i.e. 50% chance of failure) so assuming failure at 50 psig as a basis than 2% and 0.5%, respectively. The event trees, RCS integrity for success is conservative. It is therefore also conservative to assume that all likelihood of a small LOCA with a loss of can be lost if pressurizer small LOCA sizes (3/8 to 2.35) require CHR under these circumstances. The CHR for longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is very safety valves do not reset small LOCA event tree may also need to ask CHR in cases where the SGs are small.

after lifting. In the sequences not depressurized; i.e. sequences 1 and 3.

from these event trees where These changes will be implemented and high pressure injection and For a loss of main feedwater pumps (Type2), containment heat removal is not the finding verified closed by a recirculation are successful, asked for any sequences. Either SG cooling prevents the PSV from lifting at all subsequent F&O Closure Review as a pre-the question relating to so there is no LOCA or the operators depressurize the RCS for alternate AFW requisite to RICT implementation.

containment heat removal is (at low pressure) though the PSVs are assumed to lift and may fail to reseat.

not asked. Failure of at least one PSV to reseat (equivalent hole size of 2.3) requires HPSI but the SGs are at low temperature in this scenario so CHR is currently assumed not required for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Consideration should be given to containment failure at later times which may lead to subsequent core damage due to failure of sump recirculation at the time of containment failure.

6-6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement AS-03 (B) /

In the small LOCA event tree, For a loss of condenser vacuum (Type3), its similar to the type2 event tree.

AS-24 RCS depressurization and use Therefore, for LOCA scenarios with a hole size no larger than 2.3 equivalent of low pressure injection and in diameter, with or without SG depressurization, further justification is Internal recirculation are considered if needed to not require CHR to protect the containment.

Events (cont.) high pressure injection or recirculation fail. In the The following information is useful in reviewing the documents associated with Transient Type 2 and this F&O. Page 337, Figure 3.27.4 of 13-NS-B061, Revision 5 (Reference 15 of Transient Type 3 event trees, this Attachment) is the small LOCA event tree. Type 2 initiators with RT consideration of RCS before turbine trip only challenge the PSVs if all SG cooling is lost. Event tree depressurization and use of for loss of main feedwater pumps in 3.9.4 on Page 130 shows that low pressure systems is not containment heat removal is not asked because if secondary heat removal is included because the lost, core damage is assumed. Type 3 initiators are where turbine trips first likelihood of high pressure and may challenge the PSVs. Figure 3.6.4 on page 102 shows the loss of injection or high pressure condenser vacuum ET which is type 3 initiator. Containment heat removal is recirculation are small. It not asked. Type 2 and type 3 initiators presently have about the same would seem that this contribution to CDF for internal events, as does small LOCA; i.e. around 12%.

assumption should apply to Recommendation: Perform a set of MAAP sensitivity analyses assuming a both cases, or not. stuck open PSV with equivalent hole diameter of 2.3 to investigate the possibility of success without CHR. Expand the discussions in the MAAP report to better describe the basis for the 2 hole size as the critical break size.

Further, the assumed mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months may be too short for consideration of containment failure. A loss of CHR that results in an exceedance of the pressure capacity at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is not a stable state at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and is still of concern. In other words, breaks with sizes smaller than 2 may also require CHR under the circumstances postulated in this F&O.

One possibility is to add the events asking for CHR to the event trees for small LOCA, type2, and type3 initiators to see if the change in assumed success criteria makes any difference to CDF.

The saturation temperatures corresponding to 50 psig is approximately 300°F.

If it can be shown that SG cooldown limits the exiting RCS coolant temperature to less than these values prior to reaching 50 psig, then containment integrity should be assured.

6-7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement 1-1/ As noted in SRs IFSO-A1, IFSO- Status: Partially Closed. The Closure Review Team A3, and IFSO-A5, some areas of recommendation will be implemented as IFSO-B2 the documentation do not provide Basis: The documentation (Sections 4.2.5 and 4.2.6 of Study 13- NS-C094, written.

sufficient detail about the process Revision 1, and footnote in Table C.1 of 13-NS-C093 Revision 1) have been Internal used. Specific items for which revised to address the Findings. Section 4.2.6 of Study 13- NS-C094 These changes are not expected to have Flooding improved documentation is (Reference 17 of this Attachment), Revision 1 discusses the flood sources in a significant impact on CDF or LERF since needed include: the TB and the impact of these flood sources, if any, on equipment in TB that the current internal flood contribution to are modeled in the PRA. The rationale for not including the temperature and total CDF and LERF is less than 0.7% and

a. Documentation of sources in pressure of fluid systems based on Assumption 2 of PRA Study 13-NS-C096 0.2%, respectively.

the Turbine Building.

Revision 2 (Reference 18 of this Attachment) must be supported by the fact

b. The basis for screening Preliminary review indicates that steam that there will be no propagation of steam (due to HELB) from the location of sources in the Fuel, propagation will have minimal impact on Radwaste, and Turbine the piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s). Also, for feedwater line break in the impacted PRA equipment in adjacent Buildings (i.e., the way in locations.

which the specified criteria TB, it must be verified that this event will not impact other PRA equipment are met for each source is such as the instrument air system due to steam and humidity. These changes will be implemented and not documented). For the finding verified closed by a Recommendation: Verify and document the fact that propagation of steam example, a walkdown during subsequent F&O Closure Review as a pre-the peer review revealed (due to a HELB) will not occur from the location of piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s) requisite to RICT implementation.

that there is section of the wet pipe fire protection (FP) and that a feedwater line break in the TB will not impact other PRA equipment system running above the such as the instrument air system due to steam and humidity.

turbine cooling water (TC) pumps that could potentially spray both pumps. It is not clear based on 13-NS-C093 (Reference 16 of this Attachment) and 13-NS-C094 (Reference 17 of this Attachment) that this impact was considered and dispositioned. Likewise, feedline breaks in the turbine building are assumed to be bounded by the loss of main feedwater initiating event, but may have different impacts such as loss of instrument air due to humidity impacts.

c. The temperature and pressure of flood sources.

6-8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement 1-2/ Potential flooding mechanisms Status: Partially Closed. The Closure Review Team IFEV-A7 are primarily limited to failures recommendation will be implemented as of components. Human-induced Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 written.

Internal flooding is screened based on (Reference 19 of this Attachment) addressed the finding with the discussion of the potential for human and maintenance induced flooding events. These changes are not expected to have Flooding plant maintenance practices (see 13 NS-C093 (Reference 16 Maintenance activities/procedures were reviewed and a search of plant a significant impact on CDF or LERF since of this Attachment), Section operating experience (APS PVAR/CRDR database, plat trip history and LERs) the current internal flood contribution to 3.2, Item 4 and 13-NS-C097 using flood-related keywords for flooding events was performed as total CDF and LERF is less than 0.7% and (Reference 19 of this documented in this section (4.1) of the System Study. 0.2%, respectively.

Attachment), Section 3.5). This It is stated in Section 3.5 of study 13-NS-C097 Revision 2 (Reference 19 of There have been a very limited number does not indicate that there this Attachment) that maintenance activities, which involve the replacement of human induced flood events that were was any search of plant of pumps or cleaning of heat exchangers, have the potential to induce a screened out.

operating experience and plant significant flooding event are not performed on-line at the plant. However, maintenance procedures to there was a PVNGS event that involved the plugging of the condenser tubes These changes will be implemented and verify no potential for human- during plant operation. There is also a potential for on-line heat exchanger the finding verified closed by a induced flood mechanisms. tube plugging if a heat exchanger tube leak is detected. Such events were not subsequent F&O Closure Review as a pre-considered in the discussion of maintenance/human induced flooding in requisite to RICT implementation.

Section 3.5 of Study 13-NS-C097 Revision 2 (Reference 19 of this Attachment).

Recommendation: To be consistent with the state of the industry practice, identify and evaluate human-induced floods during plant operation for scenarios that may result from risk-significant maintenance activities (e.g.,

plugging of the condenser tubes and heat exchanger tubes), and include applicable maintenance-induced failure modes in the next update of the internal flooding PRA to incorporate the revised system pipe break frequency values from EPRI Report 3002000079, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment, Revision 3 (Reference 20 of this Attachment).

6-9

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement 1-3/ RG 1.200 Revision 2 (Reference Status: Partially Closed. The Closure Review Team IFSN-A6 2 of this Attachment) recommendation will be implemented as documents a qualified Basis: Assumption 2 in Section 3.1.3 of 13-NS-C096 (Reference 18 of this written.

Internal acceptance of this supporting Attachment) states that All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, These changes are not expected to have Flooding requirement (SR). The NRC resolution states that to meet steam, jet impingement, pipe whip, humidity, condensation and temperature a significant impact on CDF or LERF since Capability Category II, the concerns except when component design (e.g., water-proofing), spatial the current internal flood contribution to impacts of flood-induced effects, low pressure source potential or other reasonable judgment could be total CDF and LERF is less than 0.7% and mechanisms that are not used for limiting the effect. This assumption is appropriate and effectively 0.2%, respectively.

formally addressed (e.g., using bounds the potential impacts from jet impingement, pipe whip, spray, submergence, etc. However, this assumption of susceptible equipment failure These changes will be implemented and the mechanisms listed under the finding verified closed by a Capability Category III of this in the flood originating room does not always bound the impact of humidity, condensation, and temperature concerns because of the potential propagation subsequent F&O Closure Review as a pre-requirement) must be requisite to RICT implementation.

qualitatively assessed using of the flooding effects (e.g., steam). From this consideration, the assumption conservative assumptions. is nonconservative.

Recommendation: For the applicable flood scenarios in relevant locations, evaluate the effects of humidity, condensation, and temperature by considering the possible propagation from the initiating room to all connecting rooms. Also see F&O 1-1.

6-10

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement 1-4/ There is no evidence in 13-NS- Status: Partially Closed. The Closure Review Team IFEV-A6 C097 (Reference 19 of this recommendation will be implemented as Attachment) that a search was Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 written.

Internal made for plant-specific (Reference 19 of this Attachment) addressed the finding on lack of search for plant-specific operating experience, plant design features, and conditions that These changes are not expected to have Flooding operating experience, plant design features, and conditions may impact flood likelihood with a discussion of the search of flood type a significant impact on CDF or LERF since that may impact flood events in the PVNGS Site Work Management System database and License the current internal flood contribution to likelihood and no Bayesian total CDF and LERF is less than 0.7% and Event Reports. It also discusses the review of the PVNGS maintenance 0.2%, respectively.

updating was performed. procedures on flood prevention guidelines and the potential of maintenance However, adjustments are induced flooding. No Bayesian update was performed on the flood initiating There have been a very limited number made to some initiating event event frequency due to insufficient flood data at PVNGS. However there were of flood events that were screened out.

frequencies based on system a few events associated with leaks/flooding that were screened based on the run times to account for impact of those events on safety-related or PRA equipment. The criteria for These changes will be implemented and differences between impacts screening of flooding events based on impact may not be applicable to the the finding verified closed by a when the pumps are running or screening of flood events performed for the purpose of evaluating the subsequent F&O Closure Review as a pre-in standby. likelihood of flooding. requisite to RICT implementation.

Recommendation: Develop criteria for screening of flood events for the purpose of evaluating the likelihood of flooding or flooding frequency. The criteria may be in terms of potential spatial impact of the flood event. Use the criteria to re-evaluate the flooding events at PVNGS for the purpose of flood frequency update. Unscreened flooding events should then be used for updating the applicable flooding frequency.

6-11

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement SHA-E2-01 / The evaluation and Status: Open. The updated seismic hazard curves SHA-E2 incorporation of uncertainties in provided by LCI (2015b) and associated the site response velocity Basis: Finding SHA-E2 is considered as Open. The technical basis for this impacts on fragilities will be incorporated Seismic profile may not be properly conclusion is summarized below and is supported by the documentation as into the seismic PRA.

incorporated because of found in LCI Report 2211-PR-07-Rev. 4 (Reference 21 of this Attachment),

insufficient or unreviewable Seismic Hazard Evaluation for Palo Verde Nuclear Generating Station, dated These changes are not expected to have site-specific data and/or its 8/27/2013 (referred to as LCI, 2013), and LCI Report PC No. PV-001-PC-05, a significant impact on CDF or LERF documentation. Also, the site Rev. 0 (Reference 22 of this Attachment), Soil Hazard and GMRS/FIRS based on the NRC review of the updated response evaluation was Calculation for Palo Verde Nuclear Generating Station, dated 2/27/2015 seismic hazard curves LCI (2015b) which completed using a Senior (referred to as LCI, 2015b). LCI (2013) provides a set of soil hazard curves found the updated seismic hazard is Seismic Hazard Analysis fractiles and for peak ground acceleration (pga) a set of 96 aggregate pga bounded by the current design-basis safe Committee (SSHAC) Level 1 hazard curves. It is assumed that the aggregate pga hazard curves were shutdown earthquake at most (L1) process which does not derived for use as part of the seismic risk quantification. LCI (2013) provides frequencies above 1 Hertz and minor meet the ASME general an adequate summary of how the aggregate pga hazard curves were exceedances above 1 Hertz to be Capability Category II developed and compared to the pga hazard curve fractiles. LCI (2015b) considered de minimis ,ADAMS guidelines (Reference 4 of this provides an updated set of soil hazard curves in part based on the updated Accession No. ML16221A604 (Reference Attachment). site response evaluation completed at the Palo Verde site. LCI (2015b) 24 of this Attachment) provides sufficient technical material to understand how the site response results were combined with the soil hazard curves for rock site conditions to These changes will be implemented and produce and updated set of soil hazard curves for the Palo Verde site. Finding the finding verified closed by a SHA-E2 is related to the assessment of aleatory and epistemic uncertainties in subsequent F&O Closure Review as a pre-site response, and their subsequent impact on the derivation of soil hazard requisite to RICT implementation.

curves. The disposition to this finding states, A SSHAC L3 analysis was performed subsequent to the seismic PRA development as part of the NTTF response to the NRC 50.54f letter on Fukushima. The SSHAC L3 analysis produced a site hazard curve which is bounded by the SSHAC L1 hazard curve developed and used in the Seismic PRA model. Therefore, the issue is resolved by the updated SSHAC L3 hazard analysis.

While the updated probabilistic seismic hazard analysis completed for the Palo Verde site included SSHAC L3 seismic source characterization and ground motion characterization models, the site response analysis was not completed using an explicit SSHAC process. It is important to note that there is no mandate to complete the site response analysis following the SSHAC guidance; the approach and method documented in LCI [2015a and 2015b (References 23 and 22 of this Attachment)] is consistent with expectation documented as part of EPRI guidance (SPID) which has been endorsed by the NRC.

6-12

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement SHA-E2-01 / However, the seismic hazard curves provided by LCI (2015b) (Reference 22 of SHA-E2 this Attachment) were not explicitly compared to those derived in LCI (2013)

(Reference 21 of this Attachment) to corroborate the disposition provided. LCI Seismic (2015b) (Reference 22 of this Attachment) does not include updated hazard curve fractiles for pga that can be compared to either the pga fractiles or the (cont.) aggregate pga hazard curves as found in LCI (2013) (Reference 21 of this Attachment). Comparison of the mean pga hazard curves [Table 7.1 from LCI (2013) (Reference 21 of this Attachment) to Table 2 from LCI (2015b)]

indicates that the updated pga hazard has increased, thus it is not clear if the seismic risk quantification using the pga hazard curves form LCI (2013)

(Reference 21 of this Attachment) is appropriate. For example at a pga = 0.5g the mean hazard has increased from 1.72E-6 [Table 7.1 from LCI (2013)

(Reference 21 of this Attachment)] to 6.53E-6 Table 2 from LCI (2015b)

(Reference 22 of this Attachment)]. In summary, insufficient information has been provided to demonstrate that the updated pga soil seismic hazard curves is bounded by the pga soil hazard curve used in the Seismic PRA model.

Recommendation: Demonstrate that the updated set of soil pga hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil pga hazard curves used in the Seismic PGA model. If the updated set of soil pga hazard curves is greater than those used in the Seismic PRA model, the impact on Seismic risk quantification should be assessed.

6-13

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement SFR-F3-01 / The draft report LTR-RAM-II- Status: Partially Closed. The Closure Review Team SFR-F3 12-074 indicates that the draft recommendation will be implemented as relay assessment uses the Basis: In response to F&O SFR-F3-01, two documents were provided: 1) written.

Seismic IPEEE relay assessment as the Westinghouse Letter LTR-RAM-II-12-074 R002 - PV SPRA - Relay starting point but accounts for Assessment.pdf (Reference 25 of this Attachment), and 2) 11c4043-cal-028 These changes are not expected to have the updated seismic hazard rev0 (Reference 26 of this Attachment) Seis Frag for Sel Relays.pdf. These any impact on CDF or LERF since the curve at the site. However, the two documents were reviewed to support the conclusion that the previously recommendations are associated with report includes the following unaddressed relays have been addressed and are included in the SPRA model documentation changes to better explain statement in Section 2.3 and quantification. The following paragraphs provide the basis for the modeling rationale.

(Unaddressed Relays): conclusion that the reported fragilities are reasonable, and provide recommendations for completeness of documentation. These changes will be implemented and This list (unaddressed relays) the finding verified closed by a included 69 such relays. Of the Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this subsequent F&O Closure Review as a pre-relays that have been included Attachment) - PV SPRA incorporates into the existing relay database 288 requisite to RICT implementation.

in the SPRA, their seismic additional relays including the 69 previously unaddressed in the IPEEE. This fragility events are found in document develops the first round relay fragilities based on the relay analysis many of the dominant CDF performed as part of the plant IPEEE. Several relays, including some of the 69 cutsets. relays that were not addressed in IPEEE, are screened because they are not chatter sensitive. The relays for which chatter is not acceptable are assigned initial HCLPF values based on the IPEEE review level earthquake (RLE) PGA of 0.5 scaled in accordance with the location specific spectral acceleration ratios of the IPEEE ISRS and the SPRA ISRS. These initial HCLPF values are substantiated with walkdowns of host components. The reported initial quantification using these HCLPF and generic betas identified the dominant relay contributors. Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) - PV SPRA describes the modelling of the relays in the SPRA.

S&A Calculation 11c4043-cal-028 (Reference 26 of this Attachment) documents the detailed fragility analysis using separation of variable for 13 relays selected from the top contributors. The median capacity is based on the in-cabinet seismic demand on the relays associated with the SPRA ISRS, and EPRI relay GERS. The associated uncertainty parameters are obtained by using the separation of variables method. The resulting fragility parameters are scaled to conform to the revised seismic hazard and the revised GMRS.

We concur with the analysis and feel that the resulting fragilities are sufficiently realistic.

6-14

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding Description Closure Review Team Recommendation(s) Disposition F&O ID /

Requirement SFR-F3-01 / Finding SFR-F3-01 could be resolved on the basis that APS will take actions to SFR-F3 implement the recommendations provided below and update WEC Document LTRRAM-II-12-074 Rev. 2 (Reference 25 of this Attachment), and S&A Seismic Calculation 11c4043-cal-028 Rev. 0 (Reference 26 of this Attachment).

(cont.) Recommendation: The detailed fragility evaluation for dominant relay contributors should demonstrate that the seismic demand is an appropriate median based response, and that the important uncertainties are included in obtaining log standard deviations.

We recommend that the following be incorporated into the Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) for completeness:

1. During the closure review, the following information was communicated to the reviewers regarding the unaddressed relays via an e-mail: The initial fragilities for relays were estimated based on the IPEEE analysis for 0.5g RLE.

The 69 relays that were not addressed in Rev. 1 of the Relay Fragility Assessment were subsequently incorporated into the Relay Fragility Assessment Rev. 2. Twenty-nine of the 69 relays were screened out from modeling. However, 40 relays were modeled. They were assigned simplified fragilities based on walkdowns that were already performed on the parent cabinets. The above information in the e-mail communication should be documented in WEC Document LTR-RAM-II-12-074 Rev. 2.

2. In Table 34: Detailed Fragility Candidates, document the source of the factor SFbldg.

We also recommend that the following be incorporated into the S&A Calculation 11c4043-cal-028 rev0 (Reference 26 of this Attachment) for completeness of documentation:

1. Justify the use of Best Estimate ISRS as the median. In our opinion, the SSI analysis using BE soil properties, best estimate structure stiffness and a conservative estimate of best estimate structure damping results in a 84th percentile response.

2. The u associated with SSI is obtained using the BE, UB and LB envelop as the 84th and the BE alone as the median. Please explain the rationale that this results for the same building (Control Building) a wide range of SSI c from 0.09 to 0.22.

3. Explain why the uncertainties associated with structure stiffness and damping, time history simulation and earthquake component combination are ignored in the SOV calculations.

6-15

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6

References:

1. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009

3. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071200238) dated May 17, 2007

4. ASME/ANS RA-Sa-2009, Standard for Level I/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009

5. NRC Letter Palo Verde Nuclear Generating Station, Units 1,2, And 3 Issuance of Amendments Re: Adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b" (ADAMS Accession No.,

ML112620293), dated December 15, 2011

6. Palo Verde Engineering Evaluation 3579223 Revision 1, PRA Input to the Risk-Informed Task Force (RITS) 5b License Amendment, dated March 10, 2011

7. ABB Combustion Engineering letter to APS ST-99-542, Probabilistic Safety Assessment Peer Review for Palo Verde Nuclear Generating Station, dated July 12, 1999

8. Westinghouse Letter LTR-RAM-II-10-082, Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Palo Verde Nuclear Generating Station Probabilistic Risk Assessment, dated November 5, 2010

9. Not used.

10. Westinghouse Letter LTR-RAM-12-13, Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS PRA Standard for the Palo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment, dated January 2, 2013

11. Hughes Associates Report 001014-RPT-01, Palo Verde Nuclear Generating Station Fire PRA Focused-Scope Peer Review Report, Revision 0, dated January 22, 2015

12. NRC Letter U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-out of Facts and Observations (F&Os) (ADAMS Accession No., ML17079A427), dated May 3, 2017

13. ABS Consulting Report R-3882824-2037, Palo Verde Generating Stations PRA Finding Level Fact and Observation Closure Review, June 23, 2017.

14. 13-NS-B065, At-Power PRA MAAP 4.0.4 Analysis, Revision 7.

15. 13-NS-B061, At-Power PRA Event and Success Criteria, Revision 5.

6-16

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6

16. 13-NS-C093, Internal Flooding PRA - Input Data and Walkdown Validation, Revision 1.

17. 13-NS-C094, Internal Flooding PRA - Qualitative Screening Evaluation, Revision 1.

18. 13-NS-C096, Internal Flooding PRA - Characterization of Flood Scenarios, Revision 2.

19. 13-NS-C097, Internal Flooding PRA - Estimation of Initiating Event Frequencies, Revision 2.

20. EPRI Report 3002000079, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment, Revision 3.

21. LCI Report 2211-PR-07 (LCI 2013), Seismic Hazard Evaluation for Palo Verde Nuclear Generating Stating, Revision 4, dated August 2013.

22. LCI Report PC No. PV-001-PC-05 (LCI 2015b), Soil Hazard and GMRS/FIRS Calculation for Palo Verde Generating Station, Revision 0, dated February 2015.

23. LCI Report PC No. PV-001-PC-04 (LCI 2015a), Development of Site Profile and Amplification for Palo Verde Nuclear Generating Station, Revision 0, dated February 2015.

24. NRC Letter Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Staff Assessment of Information Provided Under Title 10 of the Code of Federal Regulations Part 50, Section 50.54(f), Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force review of Insights from the Fukushima Dai-ichi Accident and Staff Closure of Activities Associated with recommendation 2.1, Seismic (CAC NOS. MF5277, MF5278 and MF5279) (ADAMS Access Number ML16221A604), dated September 13, 2016.

25. LTR-RAM-II-12-074, PV SPRA - Relay Assessment, Revision 2.

26. 11C4043-CAL-028, Seismic Fragility for Selected Relays, Revision 0.

27. NEI 12-13, External Hazards PRA Peer Review Process Guidelines, August 2012.

28. NRC Letter U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, External Hazards PRA Peer Review Process Guidelines (ADAMS Accession No., ML12321A280), dated November 16, 2012.

29. License Amendment Request to Revise Technical Specifications to implement Risk-Informed Completion Times (ADAMS Accession Number ML15218A300), dated July 31, 2015.

30. NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, dated September 2005.

31. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated April 2015.

32. NRC Regulatory Issue Summary 2007-06 Regulatory Guide 1.200 Implementation, (ADAMS Accession No. ML070650428) dated March 22, 2007.

33. Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments Re: Changes To Technical Specification 3.8.7, Inverters-Operating (ADAMS Accession Number ML102670352), dated September 29, 2010.

6-17

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6

34. Westinghouse Letter to APS CVER-13-028, Transmittal of Palo Verde Seismic PRA -

Final Peer Review Report, February 14, 2013.

35. Palo Verde Nuclear Generating Station Other External Hazards PRA Peer Review Report, December 2011.

6-18

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 7 ATTACHMENT 7 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This attachment is not applicable to the PVNGS submittal. APS proposal solely uses PRA models in its Risk-Informed Completion Time Program for which there are standards endorsed by the NRC in Regulatory Guide 1.200, Revision 2.

7-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 8 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models Introduction Section 5.0, Item 5 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a justification for excluding any risk sources determined to be insignificant to the calculation of configuration-specific risk, and provide a discussion of any conservative or bounding analyses to be applied to the calculation of risk-informed completion times (RICTs) for sources of risk not addressed by the PRA models.

Scope NEI 06-09-A and the associated Pressurized Water Reactor Owners Group (PWROG) guidance (Reference 2 of this Attachment) do not provide a specific list of hazards to be considered in an RICT Program. However, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (Reference 3 of this Attachment), provides guidance on how to treat uncertainties associated with PRA in risk-informed decision making relative to hazards that are not considered in the PRA model.

Specifically, Section 6.3.3.1 of NUREG-1855 provides the following list of external hazards that should be addressed either via a bounding analysis or included in a PRA calculation:

Aircraft impacts

External flooding

Extreme winds and tornados (including generated missiles)

External fires (addressed in Table A8-1, Screening Summary of External Hazards, by the following two External Hazards: Forest or Range Fire and Industrial or Military Facility Accident)

Accidents from nearby facilities

Pipeline accidents (e.g., natural gas)

Release of chemicals stored at the site

Seismic events

Transportation accidents

Turbine-generated missiles The scope of this Attachment considers the above hazards for PVNGS, except for seismic events which are addressed by the PRA model.

Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of risk-managed TSs. Consistent with NUREG-1855, the process includes the ability to address external hazards by:

Screening the hazard based on a low frequency of occurrence 8-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8

Bounding the potential impact and including it in the decision-making

Developing a PRA model to be used to calculate RICTs and associated Risk Management Action Times (RMATs)

ASME/ANS PRA Standard RS-S-2008 (Reference 4 of this Attachment) has endorsed the following set of five external hazard screening criteria:

1) The hazard would result in equal or lesser damage than the events for which the plant has been designed. This requires an evaluation of plant design bases to estimate the resistance of plant structures and systems to a particular external hazard.

2) The hazard has a significantly lower mean frequency of occurrence than another event (taking into account the uncertainties in the estimates of both frequencies),

and the hazard could not result in worse consequences than the other event.

3) The hazard cannot occur close enough to the plant to affect it. Application of this criterion needs to take into account the range of magnitudes of the hazard for the recurrence frequencies of interest.

4) The hazard is included in the definition of another event.

5) The hazard is slow in developing, and it can be demonstrated that sufficient time exists to eliminate the source of the threat or to provide an adequate response.

The review of external hazards considers two aspects of the contribution to risk. The first is the contribution from the occurrence of beyond design basis conditions (i.e., winds greater than design). These beyond-design-basis conditions challenge the functionality of the systems, structures, and components (SSCs) to support safe shutdown of the plant. The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (i.e., high winds causing loss of offsite power). While the plant design basis assures that the safety-related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems and can impact configuration risk.

Note that when the effect of a particular hazard is not able to be mitigated using the plant SSCs, then there is no impact on the changes in risk calculated to support the RICT Program, and these hazards can be screened out of the RICT Program as well. Only events which create a demand for mitigation equipment are potentially relevant to the RICT Program.

The review and disposition of each external hazard is addressed in Table A8-1.

8-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Airport hazard meets 1975 Standard PS2 Review Plan (SRP) requirements.

Aircraft Impact Y PS4 Additionally, airways hazard bounding analysis per NUREG-1855 is < 1E-6/y.

Not applicable to the site because of Avalanche Y C3 climate and topography.

Sudden influxes not applicable to the plant design [closed loop systems for Essential Cooling Water System Biological Event Y C3, C5 (ECWS) and Component Cooling Water System (CWS)]. Slowly developing growth can be detected and mitigated by surveillance.

Not applicable to the site because of Coastal Erosion Y C3 location.

Plant design eliminates drought as a Drought Y C5 concern and event is slowly developing.

Plant design meets 1975 SRP External Flooding Y PS2 requirements.

The plant design basis tornado has a frequency < 1E-7/y. The spray pond Extreme Wind or PS2 Y nozzles (not protected against Tornado PS4 missiles) have a bounding median risk

< 1E-7/y.

Limited occurrence because of arid Fog Y C1 climate and negligible impact on the plant.

Not applicable to the site because of Forest or Range Fire Y C3 limited vegetation.

Limited occurrence because of arid Frost Y C1 climate.

Limited occurrence and bounded by C1 other events for which the plant is Hail Y C4 designed. Flooding impacts covered under Intense Precipitation.

Plant is designed for this hazard.

High Summer Y C1 Associated plant trips have not Temperature occurred and are not expected.

8-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

High Tide, Lake Level, Not applicable to the site because of Y C3 or River Stage location.

Covered under Extreme Wind or Hurricane Y C4 Tornado and Intense Precipitation.

Ice blockage causing flooding is not applicable to the site because of C3 location (no nearby rivers and climate Ice Cover Y C1 conditions). Plant is designed for freezing temperatures, which are infrequent and short in duration.

Explosive hazard impacts and control Industrial or Military room habitability impacts meet the Y PS2 Facility Accident 1975 SRP requirements (RGs 1.91 and 1.78).

PRAs addressing internal flooding have indicated this hazard typically results in CDFs 1E-6/y. Also, the Internal Flooding N None ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Flooding PRA.

PRAs addressing internal fire have indicated this hazard typically results in CDFs 1E-6/y. Also, the Internal Fire N None ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Fire PRA.

Not applicable to the site because of Landslide Y C3 topography.

Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for Lightning Y C1 these events. However, other causes are also included. The impacts are no greater than already modeled in the internal events PRA.

Low Lake Level or Not applicable to the site because of Y C3 River Stage location.

8-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Extended freezing temperatures are Low Winter C1 rare, the plant is designed for such Y

Temperature C5 events, and their impacts are slow to develop.

The frequency of meteorites greater Meteorite or Satellite than 100 lb striking the plant is Y PS4 Impact around 1E-8/y and corresponding satellite impacts is around 2E-9/y.

Pipelines are not close enough to Pipeline Accident Y C3 significantly impact plant structures.

Release of Chemicals Plant storage of chemicals meets 1975 Y PS2 in Onsite Storage SRP requirements.

Not applicable to the site because of River Diversion Y C3 location.

The plant is designed for such events.

C1 Also, a procedure instructs operators Sand or Dust Storm Y C5 to replace filters before they become inoperable.

Not applicable to the site because of C3 Seiche Y location. Onsite reservoirs and spray C1 ponds designed for seiches.

PRAs addressing seismic activity have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a Seismic Activity N None detailed PRA or Seismic Margins Assessment (SMA) for this hazard which is addressed in the PVNGS Seismic PRA.

The event damage potential is less C1 than other events for which the plant Snow Y C4 is designed. Potential flooding impacts covered under external flooding.

The potential for this hazard is low at Soil Shrink-Swell C1 the site, the plant design considers Y

Consolidation C5 this hazard, and the hazard is slowly developing and can be mitigated.

Not applicable to the site because of Storm Surge Y C3 location.

8-5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screening Screened?

Criterion Comment (Y/N)

(Note a)

Toxic gas covered under release of chemicals in onsite storage, industrial Toxic Gas Y C4 or military facility accident, and transportation accident.

Potential accidents meet the 1975 SRP requirements. Bounding analyses used for offsite rail shipment of chlorine gas PS2 and onsite truck shipment of Transportation PS4 Y ammonium hydroxide. Marine Accident C3 accident not applicable to the site C4 because of location. Aviation and pipeline accidents covered under those specific categories.

Not applicable to the site because of Tsunami Y C3 location.

Turbine-Generated Potential accidents meet the 1975 SRP Y PS2 Missiles requirements.

Not applicable to the site because of Volcanic Activity Y C3 location.

Waves associated with adjacent large bodies of water are not applicable to C3 Waves Y the site. Waves associated with C4 external flooding are covered under that hazard.

See references of this Attachment Note a - See Table A8-2, Progressive Screening Approach for Addressing External Hazards, for descriptions of the screening criteria.

8-6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments NUREG/CR-C1. Event damage potential 2300 and Initial Preliminary is < events for which plant is ASME/ANS Screening designed. Standard RA-Sa-2009 NUREG/CR-C2. Event has lower mean 2300 and frequency and no worse ASME/ANS consequences than other Standard RA-events analyzed.

Sa-2009 NUREG/CR-C3. Event cannot occur close 2300 and enough to the plant to affect ASME/ANS it. Standard RA-Sa-2009 NUREG/CR-2300 and Not used to screen.

C4. Event is included in the ASME/ANS Used only to include definition of another event.

Standard RA- within another event.

Sa-2009 C5. Event develops slowly, allowing adequate time to ASME/ANS eliminate or mitigate the Standard threat.

PS1. Design basis hazard ASME/ANS Progressive cannot cause a core damage Standard RA-Screening accident. Sa-2009 NUREG-1407 PS2. Design basis for the and event meets the criteria in ASME/ANS the NRC 1975 Standard Standard RA-Review Plan (SRP).

Sa-2009 PS3. Design basis event NUREG-1407 mean frequency is < 1E-5/y as modified and the mean conditional in ASME/ANS core damage probability is < Standard RA-0.1. Sa-2009 NUREG-1407 and PS4. Bounding mean CDF is ASME/ANS

< 1E-6/y.

Standard RA-Sa-2009 8-7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments NUREG-1407 Screening not successful.

and PRA needs to meet Detailed PRA ASME/ANS requirements in the Standard RA-ASME/ANS PRA Standard.

Sa-2009

See references of this Attachment References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk-Informed Completion Time and Risk Managed Action Time for RITSTF Initiative 48, August 2010

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 2009

4. American Society of Mechanical Engineers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Levei1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.

5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975

6. NUREG/CR-2300, PRA Procedures Guide, January 1983

7. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991 8-8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 9 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 Baseline Core Damage Frequency and Large Early Release Frequency Section 4.0, item 6 of the NRC final safety evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide the plant specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm that these are less than 1E-4/year and 1E-5/year respectively, thus assuring that the potential risk increases allowed under the RMTS program are consistent with Regulatory Guide (RG) 1.174, Revision 1 (Reference 2 of this Attachment). RG 1.174, Revision 2 (Reference 3 of this Attachment) issued by the NRC in May 2011, did not revise these limits.

This attachment demonstrates that the total CDF and total LERF are less than the guidance of RG 1.174, such that the risk metrics of NEI 06-09-A may be applied to the PVNGS Risk-Informed Completion Time (RICT) Program.

Table A9-1, Total Unit 1/2/3 Baseline Average CDF/LERF, provides the CDF and LERF values that resulted from a quantification of the baseline average annual models (References 4, 5, 6, 7, and 8 of this Attachment), which include contributions from internal events, internal flooding, internal fire, and seismic hazards. Other external hazards are below accepted screening criteria and do not contribute significantly to the totals.

The CDF and LERF for each unit at PVNGS are the same because each unit is nearly identical to the others by design and through the modification process. There are small differences between the units that have been evaluated and found to have minimal risk significance.

Examples include:

Unit 1 has a manual transfer switch between each of its four trains of safety-related inverters and their backup regulated power source, while the other two units have automatic transfer switches.

Field routed cabling As demonstrated in the table, the total CDF and total LERF are within the guidance of RG 1.174 to permit small changes in risk which may occur during implementation of RICTs.

Therefore, the PVNGS RICT Program is consistent with NEI guidance.

9-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 Table A9-1: Total Unit 1/2/3 Baseline Average Annual CDF/LERF1 CDF LERF Hazard (per reactor-yr) (per reactor-yr)

Internal Events 1.3E-6 4.3E-8 Internal Flooding 4.6E-7 2.1E-8 Seismic 3.1E-5 5.7E-6 Internal Fire 2.9E-5 2.4E-6 Total 6.2E-51 8.2E-61 Note:

1. The Baseline Average Annual CDF/LERF include average maintenance unavailability of structures, systems, and components (SSCs). The configuration risk management program model used for the RICT Program does not include maintenance unavailability of SSCs unless specific to the configuration.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 November 2002

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011

4. PVNGS Study 13-NS-B067, At-Power PRA Quantification, Revision 6

5. PVNGS Study 13-NS-C042, At-Power Level 2 PRA LERF Quantification, Revision 1

6. PVNGS Study 13-NS-F004, Fire PRA - Quantification and Screenings, Revision 0

7. PVNGS Study 13-NS-C099 Internal Flooding PRA - PRA Modeling and Quantification, Revision 2

8. Westinghouse Calculation CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1 9-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 ATTACHMENT 10 Justification of Application of At-Power PRA Models to Shutdown Modes This attachment is not applicable to the PVNGS submittal. APS is not proposing to apply the Risk-Informed Completion Time Program in shutdown modes, but only in Modes 1 and 2.

10-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 11 Probabilistic Risk Assessment Model Update Process

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 Probabilistic Risk Assessment Model Update Process Summary Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the probabilistic risk assessment (PRA) models which support the RMTS are maintained consistent with the as-built/as-operated plant. Palo Verde Nuclear Generating Station (PVNGS) procedure 70DP-0RA03 Probabilistic Risk Assessment Model Control (Reference 2 of this Attachment), controls update and maintenance of the PRA models. This procedure is in full compliance with ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 3 of this Attachment) for PRA model maintenance and update.

This attachment describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions, will be identified and reviewed prior to implementation to determine if they could impact the PRA models. The PRA Configuration Control Program will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models, which will be addressed through the PVNGS Corrective Action Program.

Should a plant change or a discovered condition be identified that has a significant impact to the RICT program calculations as defined by the Configuration Risk Management Program (CRMP), an interim update of the PRA model will be implemented.

Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic PRA model updates will be performed no less frequently than every two refueling cycles (i.e., three years),

consistent with the guidance of NEI 06-09-A.

PRA Model Update Process The PRA Configuration Control Program ensures that the applicable PRA model used for the RICT Program reflects the as-built, as-operated plant for the three PVNGS units. The PRA Configuration Control Program delineates the responsibilities and guidelines for updating the full-power internal event, internal flood, internal fire, and seismic PRA models, and includes both periodic and interim PRA model updates. The procedure requires an update to be initiated at least once every three years to reflect industry operating experience (other than data), plant design and procedure changes.

An update of PRA model data, including initiating event, component unavailability, component reliability, and common cause data is also required by the procedure to be initiated at least once every three years. The program includes guidance on identifying, evaluating, and documenting potential impacts (e.g., plant changes, plant/industry operational experience, or errors or limitations identified in the model).

In addition, guidance is provided on assessing individual and cumulative risk impacts of pending changes. Finally, the PVNGS software quality assurance program records 11-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 the controlled version of the PRA and CRMP models and associated references.

Review of Plant Changes for Incorporation into the PRA Model

1) Plant changes or discovered conditions, as defined in the PRA Configuration Control Program, are reviewed for potential impact to the PRA models, including the CRMP model and the subsequent risk calculations which support the RICT Program.

2) Plant changes that meet the criteria defined in the PRA Configuration Control Program (including consideration of the cumulative impact of other pending changes) will be incorporated in the applicable PRA model(s), consistent with the NEI 06-09-A guidance. Otherwise, the change is assigned a priority and is incorporated at a subsequent periodic update consistent with procedural requirements.

3) PRA updates for plant changes are initiated at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A.

4) If a change is required for the CRMP model, but cannot be immediately implemented for a significant plant change or discovered condition, either:

A. Alternative analyses to conservatively bound the expected risk impact of the change will be performed. In such a case, these alternative analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A.

or B. Appropriate administrative restrictions on the use of the RICT Program will be put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. PVNGS Procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control

3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009 11-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 12 Attributes of the Configuration Risk Management Program (CRMP) Model

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 Attributes of the Configuration Risk Management Program (CRMP) Model Introduction Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support RMTS, including identification of how the baseline PRA model is modified for use in the Configuration Risk Management Program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. The scope of structures, systems, and components (SSCs) within the CRMP will be provided. This item should also confirm that the CRMP tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant specific RMTS submittal.

This attachment describes the necessary changes to the peer reviewed baseline PRA models for use in the CRMP software to support the Risk-Informed Completion Time (RICT) Program. The process employed to adapt the baseline models for CRMP use is demonstrated: (1) to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; (2) to maintain the quality of the peer reviewed PRA models; and (3) to correctly accommodate changes in risk due to time-of-year, time-of-cycle, and configuration-specific considerations. Quality controls and training programs applicable for the CRMP are also discussed in this enclosure.

Translation of Baseline PRA Model for Use in CRMP:

The baseline PRA models for internal events, including internal floods, internal fires, and seismic events, are the peer reviewed models, updated as described in Attachment 11 of this Enclosure to reflect the as-built/as-operated plant. These models are modified to include changes that are needed to facilitate configuration-specific risk calculations to support the RICT Program implementation. The baseline models, and the changes made to create the CRMP model used in the RICT Program, are controlled using plant calculations, which include the necessary quality controls and reviews.

The changes to the models to account for variations in system success criteria based on time- of-year or time- in- operating cycle, and other specific changes needed to properly account for configuration-specific issues, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle, are described in Table A12-1, Changes Made for Configuration-Specific Risk.

12-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 TABLE A12-1 CHANGES MADE FOR CONFIGURATION-SPECIFIC RISK DESCRIPTION BASIS FOR CHANGE Plant Availability The baseline PRA models account for the time the reactor operates at power by using a plant availability factor. This is appropriate for determining the average annual (time-based) risk, but the factor is not applicable to configuration-specific risk calculated for the RICT Program. In order to account for the assumption that the plant is always operating in the RICT Program, the frequency of initiating events which include an availability factor are adjusted. This change is necessary to adjust the modeled initiating event frequencies from a per year to a per reactor year basis for use in the CRMP.

Maintenance Maintenance alignment probabilities in the baseline PRA models have Alignment probabilities based on the fraction of the year the equipment is Probabilities unavailable. For the CRMP model, the actual configuration of equipment is evaluated, so the maintenance alignment probabilities are set to zero. This is also done for the system initiating events, which include maintenance contributions.

Excluded The PRA models will not remove excluded maintenance combinations Maintenance allowed by the technical specifications (i.e., both trains of a single Combinations safety system being simultaneously unavailable).

Room Cooling The baseline PRA models include conservative success criteria for room Success Criteria cooling and do not use average annual criteria; therefore, no changes to the CRMP model for room cooling success criteria are required.

Unfavorable The current PVNGS core design reflected in the baseline PRA model for Exposure Time ATWT events includes a UET for variable success criteria based on time (UET) for of core life (i.e., moderator temperature coefficient early in cycle life).

anticipated The event is set to the fraction of the year for which the UET applies transient without and will be changed to a probability of 1 or 0 based on operator input trip (ATWT) using the CRMP tool, depending on the actual time in the operating Events cycle.

Quality Requirements and Consistency of PRA Model and CRMP Tools The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA maintenance and update process described in 1 of this Enclosure and the use of self-assessments and independent peer reviews described in Attachment 6 of this Enclosure.

The information provided in Attachment 6 demonstrates that the PVNGS internal event, internal flood, internal fire, and seismic PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200 Revision 2 (Reference 2 of this Attachment). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.

The current PRA models will either be combined into a single CRMP model for use in the CRMP software tool, or will be used to generate pre-solved solutions for routine plant configurations which will be entered into the CRMP software tool. PVNGS has been using a single CRMP model in EPRI CRMP model for more than eight years based on combined internal events and internal fire models. The CRMP model is rigorously checked against the individual PRA model results to validate the CRMP model quality. If a new CRMP model 12-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 including the upgraded fire and new seismic PRA models cannot be developed that meets work management and scheduling needs for solution speed, PVNGS will take the approach used by South Texas Project by pre-solving thousands of routine expected configurations and saving the results of those solutions in the CRMP software tool. When unanalyzed configurations occur, PRA would promptly solve the PRA models to determine the RICT as well as comply with existing Maintenance Rule configuration risk monitoring requirements.

PVNGS currently has and will continue to provide a qualified PRA engineer on call 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months a day, 7 days a week to support Operations and Work Management in assessing the risk of planned and emergent plant configurations.

Changes made to the baseline PRA model in translation to the CRMP model will be controlled and documented per procedure 70DP-0RA03 to maintain the existing CRMP model. An acceptance test is performed after every CRMP model update to verify proper translation of the baseline PRA models and acceptance of all approved changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components to the basic events in the CRMP model.

Training and Qualification The PVNGS PRA staff is responsible for development and maintenance of the CRMP model.

The PRA staff is trained in accordance with the site Engineering personnel training program and has passed specific qualifications on each major element of the PRA development and use. Operations and Work Control staff will use the CRMP tool under the RICT Program and are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is accredited by INPO.

Application of the CRMP Tool to the RICT Program Scope PVNGS will use the EPRI CRMP tool for RICT Program calculations. The EPRI program already exists in an approved, issued version to support the RICT Program. PVNGS currently uses the EPRI tool in the Maintenance Rule CRMP for at-power conditions. The EPRI CRMP tool meets RG 1.174 (Reference 3 of this Attachment) and PVNGS software quality assurance requirements.

12-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 12-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 ATTACHMENT 13 Key Assumptions and Sources of Uncertainty

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Key Assumptions and Sources of Uncertainty Introduction Section 4.0, Item 10 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a discussion of how the key assumptions and sources of uncertainty were identified, and how their impact was assessed and dispositioned. This attachment provides that discussion.

Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1.200, Revision 2, (Reference 2 of this Attachment) and the ASME/ANS RA-Sa-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 3 of this Attachment), have been identified for the P V N G S PRA models using the guidance of NUREG-1855 (Reference 4 of this Attachment) and EPRI TR-1016737 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 5 of this Attachment).

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk.

If the P V N G S model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on RICT Program calculations. Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.

Key assumptions and sources of uncertainty for the RICT Program application are identified and dispositioned in Table A13-1, Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations. The conclusion of this review is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for the following:

The seismic PRA model used for the RICT Program will increase all the seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

13-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The only plant system SBOGs can be aligned to multiple units to supply The existing PRA model conservatively modeled in the PRA that is limited loads. does not credit SBOGs in more than one shared between the three unit. Further, the plant design for FLEX units is the station blackout and beyond FLEX modifications /

generators (SBOGs). capabilities provide additional 480V and Simultaneous multiple unit 4160V supplies to safety buses not station blackout conditions currently credited in the PRA models. For are screened out based on RICT Program implementation, PVNGS will low probability. SBOGs are consider, based on plant conditions and assumed aligned to one unit associated risk levels, risk management only during an event. actions (RMAs) for use of FLEX equipment such as 480V and 4160V generators when electric power systems to risk significant equipment are unavailable under a RICT.

13-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Reactor Coolant Pump (RCP) RCP Seal Leak or Rupture is not modeled as a If RCP seal parameters are not within Seal Leak or Rupture loss of RCS Inventory safety function. Based on normal limits indicating potential seal Westinghouse WCAP-15749 (Reference 6 of this degradation while a RICT is in effect, Attachment) and pump seal vendor information, RMAs will be used to ensure availability of it was concluded that because of the very tight charging pumps or other plant SSCs clearances, leakage into the seal package from which can mitigate excessive RCP seal the RCS is limited to about 17 gpm per pump. leakage.

Each of the four RCPs has a seal package which consists of three seals. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA.

An analysis showed that continuing to model RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF.

Loss of Coolant Accident NUREG/CR-6928 (Reference 7 of this The slight variance in the range of break (LOCA) Frequencies Attachment) restated the results from NUREG- sizes for different LOCAs is not significant 1829 (Reference 8 of this Attachment). The and is judged to have minimal impact on LOCA frequencies are based upon expert LOCA frequencies, within the uncertainties elicitations. The LOCA sizes identified by the NRC associated with the expert elicitation are different from those estimated for PVNGS. values, and of insignificant impact to RICT calculations. No special measures are required for the RICT Program.

13-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Loss of Off-site Power The national LOSP data presented in the latest The LOSP frequencies are based on recent (LOSP) Frequency EPRI events reports (References 4 and 5 of this industry data and are appropriate to Attachment) was used to obtain point-estimates represent plant-specific conditions.

for switchyard centered and severe weather SBOGs, as well as other additional electric related LOSP frequencies. The EPRI Reports power supplies, are available on site to indicate that the generic LOSP data is subject to mitigate LOSP. RMAs will consider, based user modifications and screenings to fit the local on plant conditions and associated risk plant designs and environmental conditions. This levels, these alternate AC sources for approach of LOSP screening is considered applications of the RICT Program where reasonable and necessary to avoid erroneous LOSP events significantly contribute to skewing of the LOSP data. The frequency of configuration risk.

extreme weather LOSP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid related LOSP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 9 of this Attachment).

Loss of Off-site Power at The probabilities of offsite power non-recoveries The offsite power non-recovery Switchyard (LOSP) were obtained from Table 4-1 of the draft NRC probabilities are based on the best Associated Non-Recovery NUREG/CR-INEEL/EXT-04-02326. The error available data and are appropriate to Probabilities factors associated with LOSP frequencies and represent plant-specific conditions. SBO LOSP non-recovery probabilities were obtained diesel generators, as well as other from NUREG/CR-INEEL/EXT-04-02326 (when additional electric power supplies, are provided); otherwise, by using available in- available on site to mitigate LOSP. RMAs house statistical programs for lognormal and will consider, based on plant conditions Weibull distributions. and associated risk levels, these alternate AC sources for applications of the RICT Program where LOSP events significantly contribute to configuration risk.

13-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Battery Life Assumptions The PVNGS batteries are not credited in the long Crediting the actual higher capacities of term, because they are conservatively assumed the batteries and updated load shedding to be discharged after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Although the actions from Fukushima driven procedure IEEE Class 1E batteries are designed to operate changes would result in longer RICTs due for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , Engineering has determined that the to the additional mitigation capabilities class batteries' life is at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Thus they made available. Therefore, the current are available for power recovery at the 3-hour PRA model use for the RICT Program is point on the incident timeline. conservative and acceptable.

Human Failure Events Accessibility for completion of non-screened A sensitivity analysis was performed (HFEs) during a seismic human failure events (HFE) during a seismic evaluating the impact of not crediting the event event is assumed possible for all non-screened subject HFEs and there was minimal HFEs besides those which are assumed to fail in impact on the CDF and LERF. Therefore, the case where the corridor building or turbine the current Seismic PRA model used for building collapses. Both the collapse of the the RICT Program is acceptable.

corridor building and turbine building and their impact on the access to the Main Steam Support Structure is considered in the Seismic PRA model. There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed.

Seismic performance Seismic-only PSFs applied to the internal events This is considered a conservative shaping factors (PSFs) with HEPs will over-ride the flooding PSFs based on assumption. Therefore, the current respect to seismic-induced the consideration that the seismic events are Seismic PRA model used for the RICT flooding. more global events than the specific flooding Program is acceptable.

events. No additional modifications are made to the internal events HEP to consider the possibility of seismic-induced flooding events.

13-5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The Seismic PRA HFE The Seismic PRA dependency analysis assumes The modification of the timing available dependency analysis that once an accident sequence is initiated, the due to seismic considerations may result operator action timing for a seismically induced in a longer response or identification time event is similar to that of an internally induced and consequently a higher HEP.

event for main control room actions.

A sensitivity analysis was performed in the seismic PRA quantification increasing all the Seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

The change in CDF and LERF was 9.7%

and 5.3%, respectively. Therefore, the current Seismic PRA model used for the RICT Program will increase all Seismic HFEs by a factor of 3 to address this uncertainty.

13-6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic PRA Weighting There is no standardized method to calculate More emphasis was given to the Surry factors applied to three human error probabilities (HEP) in a seismic method since it was a selective approaches PRA. Therefore, a mean HEP for each basic combination of previous approaches and event was calculated by combining three the most recently performed and accepted approaches [Surry, Kernkraftwerk published method. However, the Surry Muhleberg (KKM), and Swiss Federal Nuclear method has the potential to be the least Safety Inspectorate (ENSI) provided in conservative approach among the three Reference 10 of this Attachment] using the methods. A sensitivity analysis was following weighting factors: 0.7, 0.15, 0.15, performed that ran the Seismic PRA respectively. model using only the KKM and ENSI approaches, equally weighted. The change in CDF and LERF was -1.63% and 0.42%. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Relay chatter correlation Relay chatter between relays of the same This is a conservative assumption because manufacturer, model number, and plant location, the demand experienced by a relay is i.e., building and elevation were assumed to be dictated by in-cabinet response and not fully correlated. Also, each relay identified as a the in-structure response spectra (ISRS) control switch, push button, or motor starter are which the binning is based. Therefore, the fully correlated with other generic, like current Seismic PRA model used for the components. RICT Program is acceptable.

Simplified Relay Fragility Low risk importance relays (based on Risk This assumption is reasonable given that Parameters Achievement Worth) were treated with a none of the c values for the relays simplified fragility analysis and higher evaluated using the detailed fragility importance relays (10 different types) were analysis were determined to have a c treated with a detailed fragility analysis. The below 0.33 and most had c of around simplified relay chatter fragility analysis assumed 0.5. Therefore, the current Seismic PRA a c of 0.35 based on engineering judgment. model used for the RICT Program is acceptable.

13-7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure of relays and For the relays modeled in the Seismic PRA, the PRA analyst experience is credited in the basic event mapping basic event associated with the seismic failure of selection of the appropriate internal the relay must be mapped to an existing internal events PRA model component failure events target basic event. A key source of modes to reflect postulated seismic PRA modeling uncertainty is associated with the model component failure modes. This mapping of seismic basic events. Failure modes selection was performed by Westinghouse postulated for the PVNGS internal events model PRA seismic experts and reviewed by APS may not fully align with their assigned seismic PRA engineers. Therefore, the current counterparts. Seismic PRA model used for the RICT Program is acceptable.

Seismic PRA uses internal The PVNGS Seismic PRA assumes that the The internal events PRA that was used to events PRA as a starting internal events PRA that is used as a starting develop the Seismic PRA was evaluated point point meets the requirements of Capability separately for its PRA quality and was Category II of the PRA standard. determined to meet Capability Category II of the PRA standard with the exception of System Notebook documentation, which is a commitment herein to fully address prior to RICT Program implementation.

Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Success criteria for Seismic If not otherwise specified, the success criteria The base case Seismic PRA uses a 24 PRA associated with the internal events PRA logic are hour mission time for the run time of considered valid and applicable to accident mitigating equipment. A sensitivity case sequences initiated by a seismic event. However, was developed to assess the impact of a standard 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time may not be using a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months mission time for suitable for a seismic-induced accident scenario equipment run failures. The change in because of the longer time needed for offsite overall CDF and LERF for this case is power recovery. 2.73% and 0.69%, respectively.

13-8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure correlation Seismic failures are assumed to be completely The validity of this assumption of correlated. This assumption implies that a single complete correlation is still being basic event is used to model the seismic failure discussed at the industry level. This is of components that are identified as pertaining considered a conservative assumption.

to the same fragility. Theres one exception to Therefore, the current Seismic PRA model this where failures in the steam path in the used for the RICT Program is acceptable.

Turbine Building are not considered correlated with failures of the feedwater lines.

Seismically induced Loss of The seismically induced LOSP is assumed to The basis for this assumption is that Offsite Power (LOSP) bound the fragility of non-seismic class system. seismically induced LOSP has a generally This assumption implies that a number of non- low seismic capacity. Scenarios where the seismic class systems are not addressed with a non-seismic support systems incur specific seismic failure. seismically induced failures while offsite power is still available are considered realistic only for very low magnitude seismic events. Therefore, the most significant mitigating equipment will still be available. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Seismic PRA LOSP recovery In the Seismic PRA, LOSP recovery is not It is realistic to consider that offsite power credited for any seismic event above the safe recovery is available for low magnitude shutdown earthquake (SSE), while it is credited seismic events. The selection of the SSE with unchanged probability for a seismic event as a threshold between recovery/no-below the SSE. recovery of offsite power is arbitrary and conservative. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

13-9

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Screening of equipment in Screening of equipment in the Seismic Using a surrogate event for a number of the Seismic Equipment List Equipment List (SEL) is based on fragility components that have been screened out (SEL) analysis. Equipment screened by the fragility introduces a conservative failure mode.

team as inherently rugged is not modeled in the The uncertainty introduced by the use of Seismic PRA for their seismic induced failure. In surrogate equipment for the seismic class order to quantitatively capture the impact of I system is judged to have a limited screened out equipment, generic fragility impact on the model. Therefore, the parameters for the building that housed the current Seismic PRA model used for the screened out equipment were used. The RICT Program is acceptable.

screened equipment are modeled through a surrogate basic event at a system level.

Operators tripping the It is assumed that the operators will always trip This is considered a conservative reactor above operating the reactor in case of a seismic event above OBE assumption. Therefore, the current basis earthquake (OBE) if even the option for a controlled shutdown is Seismic PRA model used for the RICT allowed. Program is acceptable.

Train N Auxiliary Feedwater The AFN Pump is assumed to remain functional A sensitivity case was developed to assess (AFN) Pump (AFN) is with small breaks or leaks at instrument tubing. the uncertainty in crediting the AFN pump assumed to remain The fragility analysis associated with the AFN and not the associated piping network.

functional following a design Pump only addresses the pump and not the The capacity of the AFN pump was basis earthquake entire piping network. reduced to the same system level fragility parameters associated with the instrument air system. CDF and LERF increased by 0.08% and 0.03% and indicates little significance of uncertainty in this simplification of the analysis.

Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

13-10

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Main steam line relief valves Main steam line relief valves are screened out of A sensitivity case is developed to assess not explicitly included in the the analysis on the basis that the steam the impact of this assumption. A fully SEL. generator and related piping & valves are dependent seismic failure across all 20 considered very rugged. For this reason, the relief valves is modeled. CDF and LERF seismic failure of the main steam line relief values did not change when compared to valves is not modeled. the base case results. This indicates that no significant uncertainty. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Structural failures of Structural failures of building are assumed to This is a conservative assumption since buildings result in major collapse and failure of all the fragility parameters provided are equipment hosted inside the building. addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the CST tunnel.

Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

The Anticipated Transient The ATWS logic for seismic PRA assumes that Moderator Temperature Coefficient (MTC)

Without Scram (ATWS) logic the RCS pressure will be above the HPSI shutoff and ATWS pressure transient are not for seismic PRA head for only a short period of time. influenced by the fact that the event is initiated by a seismic event rather than a spurious failure. Therefore, the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

13-11

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT All flood scenarios on the A cutset review showed that the contribution of This is a conservative approach and 40ft and 51ft elevations of Fire Protection (FP) initiators is very low and that should not have a significant impact on the Auxiliary Building the Internal Flood results are not being skewed the baseline Internal Flood model. This assumes that a pipe failure by this conservatism. would not have a significant impact on the drains the Refueling Water RICT Program.

Tank (RWT).

A single internal events PRA Since there are no significant differences It is a realistic assumption that the Unit 1 model was developed to between the units, the Unit 1 System, Structure, SSC designators are used, since there are quantify the plant flood risk or Component (SSC) designators were used. It no major differences between the three for multiple units. was therefore assumed that the quantification units in terms of internal flood. This would results are applicable to all units. not have a significant impact on the RICT Program.

All components within a This is a conservative assumption that simplifies This is a conservative approach that flood area where the flood the impacted component list. Uncertainty exists simplifies the impacted component list.

originates were assumed where exactly the flood would occur, the impact This would not have a significant impact susceptible and failed as a due to the geometry of the room and equipment, on the RICT Program.

result of the flood, spray, and the direction of the spray or splash for a steam, jet impingement, given scenario. This assumption raises CDF.

pipe whip, humidity, condensation and temperature concerns except when component design (e.g., waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect.

13-12

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Block walls are not credited Unless a treatment is non-conservative, the This has no impact and is of low in the analysis and are block walls are analyzed on an individual basis. consequence to RICT. This would not have treated as typical plant The amount of water that could flow through the a significant impact on the RICT Program.

walls. gaps is unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment.

Breaks in pipes less than or The basis for this assumption is as follows: This is a conservative approach and is of equal to two inches in 1. Provides a practical limit to bound the low consequence to RICT.

equivalent diameter were scope of the analysis to potentially large flow only considered if the break rate and significant consequence events.

would directly result in a 2. Pipe sizes of less than or equal to two inch plant trip or result in a flood diameter do not accurately reflect plant fluid induced equipment failure system flood impacts (i.e. two inch diameter that would result in a plant pipes produce significantly smaller flood rates).

trip or immediate shutdown. 3. At low flow rates, typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful. Such conditions enhance operator actions significantly to successfully mitigate the breaks in small bore pipes.

However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events.

Specifically these events are considered in rooms without drains. Piping less than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented.

13-13

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Closed-loop systems and This is a conservative approach that allows for This is a conservative approach and is of tanks were assumed to the consideration of all consequences and does low consequence to RICT. This would not instantaneously release the not require time based calculations. have a significant impact on the RICT entire system inventory Program.

Control Room staff would be Human Error Probability (HEP) and Performance This is a conservative approach and is of unable to respond effectively Shaping Factors (PSF) adjustments were made low consequence to RICT. This would not to multiple events during the early stages of a flooding event to have a significant impact on the RICT immediately following the account for the additional stress influencing Program.

flooding event factors. The CDF is higher with this assumption.

No addition to the Control Operator actions to isolate the flood source are It is a realistic assumption that there Room crew is credited early required shortly after detecting that a Pressure would be no addition to the Control Room into a flood event when Boundary Failure (PBF) has occurred. Often crew early into the flood event when assessing human actions. when responding to flood events operators are assessing human actions. This would not responding to multiple alarms. have a significant impact on the RICT Program.

It is assumed that pipes that The assumption is conservative as it includes This is a conservative approach and is of are larger than 3" were additional piping that may not be conducive to low consequence to RICT. This would not capable of producing major major flooding. Since, major floods are not a have a significant impact on the RICT floods unless it was major contributor to the Pressure Boundary Program.

determined that the piping Failure frequency, its contribution to risk would was not capable of be considered minimal.

producing a major flood.

External tanks were not External tanks that are ruptured would not There is no significant impact on the considered as a flood source normally propagate into the plant. There were no model. This would not have a significant unless there is a normally tanks identified in this Internal Flood PRA that impact on the RICT Program.

available pathway into the did not propagate into the plant. It was assumed plant whereby the tank that the impact of an external tank rupture was contents could empty into a bounded by the evaluation performed for internal room within the main plant events. Breach of an external tank was assumed structures. to discharge to the yard area and there would be no flood-induced failures of PRA related components.

13-14

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floods are assumed to fail Cases in which equipment is deemed as It is a realistic assumption and is of low all equipment in the sufficiently high or flood barriers are not consequence to RICT. This would not have initiating room and then expected to retain water to sufficient flood levels a significant impact on the RICT Program.

propagate out of the room are treated on an individual basis. Additionally, to surrounding flood areas. splitting the flood areas would generate an unreasonable number of scenarios with no added insight. The Top cutsets are not impacted, however if very specific isolation actions were taken this assumption could be significant.

Floods are assumed to Water will flow down the path of least resistance It is a realistic assumption and is of low propagate down pipe chases therefore a pipe chase is the preferred path over consequence to RICT. This would not have prior than down stairwells in a stairwell with a door in front. a significant impact on the RICT Program.

situations where pipe chases are not surrounded by a curb and/or a door must be opened to enter into the stairwell.

Floods are assumed to The hydrostatic load that a door can handle is It is a realistic assumption and is of low propagate through doorways based on whether the door closes against the consequence to RICT. This would not have which open out, away from frame or away (with relation to the room that a significant impact on the RICT Program.

the initiating flood area the flood initiates). A door that is against the more readily rather than frame can withstand a greater load as opposed doorways which open in, to away from the door frame.

towards the initiating flood area.

13-15

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floor drains were assumed This assumption is based on the expectation that It is a realistic assumption and is of low to be capable of controlling a spray event will not result in a significant consequence to RICT. This would not have water levels for spray accumulation of standing water. During plant a significant impact on the RICT Program.

events. walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. Drains were not credited for any flood or major flood events. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank. Such events were screened out as potential flood sources.

Grouping boundary condition Grouping boundary condition sets for the LERF This is a conservative approach and is of sets for the LERF analysis analysis is a conservative approach. The LERF low consequence to RICT. This would not results in conservative contribution of sequences that have been have a significant impact on the RICT modeling of the containment grouped for the LERF analysis and involve failure Program.

isolation valves. of containment isolation valves are considered very low.

The piping layout for flood To the extent possible, the similarities were It is a realistic assumption and is of low sources included in the confirmed during the plant walkdowns. consequence to RICT. This would not have Internal Flood PRA was Therefore, Units 2 and 3 pipe lengths were a significant impact on the RICT Program.

shown and estimated to be assumed to be identical to Unit 1 piping lengths.

similar for all three units. There are no major differences between the three units.

It is assumed that if a PBF There are no operator procedures for isolating a This is a conservative assumption and is were to occur in the Safety flood event, therefore the most conservative and of low consequence to RICT. This would Injection (SI) or Chemical & bounding location to isolate a flood of the SI or not have a significant impact on the RICT Volume Control (CH) system CH is one of the two pipe headers. By isolating Program.

piping, that the operator at this point it results in the loss of at least one would isolate the flood at train of the ECCS. This does cause a trip.

one of the two pipe headers Therefore the overall impact on the model is connecting the Refueling small.

Water Tank (RWT) to the CH and SI systems.

13-16

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that spurious Spurious actuation of a system relief valve was This is of low consequence to RICT. This actuation of system relief not determined to be a credible flood source would not have a significant impact on the valves would discharge a because the inventory that was released would RICT Program.

limited amount of inventory be retained within the flood area and would not to a discharge tank and such lead to an applicable initiating event. The risk is events were screened out as considered negligible as this is not considered to potential flood sources. be a significant source of inventory.

Limited or no access to an There was no credit taken for mitigation when This is of low consequence to RICT. This area where flood initiation the equipment relied on for mitigation was would not have a significant impact on the occurs was assumed. located in the flood initiation area. Operators RICT Program.

cannot get into flooded areas.

Only one internal flood The occurrence of simultaneous multiple It is a realistic assumption and is of low initiating event is assumed independent internal flood events were consequence to RICT. This would not have to occur at a time. considered to be very unlikely and were not a significant impact on the RICT Program.

considered in this evaluation. This is consistent with PRA modeling.

The breach of isolation This is a simplifying assumption that has This is a conservative assumption and is barrier(s) that may result in negligible impact on the model. Propagation of low consequence to RICT. This would a maintenance-induced flood pathways were made to be conservative for all not have a significant impact on the RICT event was assumed to have scenarios Program.

no impact on altering the propagation paths related to other flooding mechanisms (i.e., pipe failure) for the flood source.

13-17

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The indirect effects of a PBF Closed looped systems were considered to be This is a conservative assumption and is on the operability of a closed normally operating and provides cooling to of low consequence to RICT. This would looped system were equipment that is relied on to maintain the plant not have a significant impact on the RICT considered to be immediate. in a power production state. It was therefore Program.

assumed that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity. A PBF would drain the system and in most cases an operator action to isolate the PBF would not be feasible. This assumption is conservative and raises CDF.

The spill rate resulting from For a potentially unlimited source, a PBF that It is a realistic assumption and is of low a PBF of a potential resulted in a spray event (<100 gpm) would consequence to RICT. This would not have unlimited flood source that take an extraordinary amount of time to cause a a significant impact on the RICT Program.

causes a spray event is low loss of that system. Additionally, given that for enough (i.e., <100 gpm) to most of the large nearly unlimited sources the have no significant impact makeup capabilities of the system would on the operation of the generally exceed the flow rate generated by a affected system. spray event. It was therefore assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (i.e. the CH system) this assumption was not valid.

13-18

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The flow rate from a PBF is The spill rate resulting from a PBF of piping is This is a conservative assumption and is assumed static at the considered to be the highest flow rate possible of low consequence to RICT. This would maximum possible rate and from the system or piping, and for tank is was not have a significant impact on the RICT the scenario is only ended assumed to be constant at an assumed flow rate, Program.

when the source was and for systems requiring pumps is considered exhausted or isolated. the realistic pump flow rate, for the particular break in the originating flood area until the flood source was isolated or its water supply was limited or exhausted.

The accumulation of flood water in a flood area was considered halted when the flood source was terminated, or when outflow from the flood area matches or exceeds the inflow of flood water to the flood area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding.

Spill rates were assumed to fall within the following categories:

Spray events: 100 gpm

Flood events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)

Major flood events: greater than 2000 gpm (or the maximum capacity of the system, whichever is lower) 13-19

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The treatment of main Recovery of feedwater is important for secondary This is of low consequence to RICT. This steamline break and main side heat removal. The internal events analysis would not have a significant impact on the feedwater line break internal was believed to provide sufficient analysis to be RICT Program.

events analysis was used in the internal flooding model.

assumed to address the impact of these events in assessing whether main feedwater can be recovered following a reactor trip.

It was assumed that The flood HRA dependency analysis did not This is of low consequence to RICT. This minimal or no dependency include large early release specific HFEs. HFEs would not have a significant impact on the existed between flood- specific to large early releases (i.e., post-core RICT Program.

specific and large early damage operator actions) are generally release specific Human performed several hours after the initiating event Failure Events (HFEs). occurs.

No dependency between early and late operator actions. There is no impact on the model.

The fire areas defined by the Fire areas are required by regulation to be It is a realistic assumption and is of low Fire Hazards Analysis (which sufficiently bounded to withstand the hazards consequence to RICT. This would not have is contained in the UFSAR, associated with the area as defined in Generic a significant impact on the RICT Program.

Sections 9B.2.1 through Letter 86-10 (Enclosure 1 Section 4). Fire zone 9B.2.22) will substantially boundaries are similarly assumed adequate; contain the adverse effects however, because fire zones have a lesser of fires originating from any pedigree than fire areas, their boundaries are currently installed fixed verified adequately in this notebook by a FHA ignition source or reasonably review and plant walkdowns. Fire zone expected transient ignition boundaries that appear unable to withstand the source. Fire zone boundaries fire hazards within the zone are combined. The are similarly assumed fire PRA utilizes fire compartments which adequate or combined. generally align with fire zones, but may be a combination of several fire zones.

13-20

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Systems and equipment not The assumption that any fire fails all equipment It is a realistic assumption and is of low credited in the fire-induced lacking cable routing information has the consequence to RICT. This would not have risk model (e.g., systems for potential to affect the assessed fire risk. The a significant impact on the RICT Program.

which cable routing will not assumption that any fire will minimally result in There are no systems/components that be performed) are assumed a loss of Main Feedwater and subsequent reactor are assumed failed in the fire PRA model to be failed in the fire- trip likely adds conservatism to the Fire PRA that are within the RICT Program.

induced risk model. These results. However, the degree of conservatism is systems and equipment are relatively small compared with other modeling failed in the worst possible uncertainties, since Main Feedwater will trip for failure mode, including most transient events.

spurious operation The impact of these assumptions was evaluated It is assumed that any fire by a sensitivity analysis case which concluded will minimally result in a loss that the risk reduction due to crediting all of Main Feedwater and components assumed always failed was small.

subsequent reactor trip. This is a simplifying and conservative assumption and is typical of Fire PRAs.

However, it may not be true for all fires.

It is assumed that the RPS design is sufficiently fail-safe and redundant It is a realistic assumption and is of low Reactor Protection System to preclude fire-induce failure to scram: consequence to RICT. This would not have (RPS) design is sufficiently Consistent with the guidance in NUREG/CR-6850 a significant impact on the RICT Program.

fail-safe and redundant to (Reference 11 of this Attachment) Section 2.5.1, The low frequency of a fire occurring preclude fire-induce failure type of sequences that can be generally coincident with the low probability of to scram, or random failure eliminated from consideration in Fire PRA include independent failure to scram results in a to scram during a fire event, sequences for which a low frequency argument negligible contribution to fire risk.

as a risk significant can be made, and uses ATWS as a specific contributor. example, because fire-induced failures will almost certainly remove power from the control rods, resulting a trip, rather than cause a failure to scram condition.

13-21

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Properly sized and Electrical protection design calculations provide It is a realistic assumption and is of low coordinated electrical the documentation of the electrical coordination consequence to RICT. Electrical protective devices are between overcurrent protective devices. An coordination will either be established or assumed to function within evaluation was performed to assess the Fire PRA the fire-induced impact will be modeled.

their design tripping power supply coordination requirements in characteristics, thus accordance with NUREG/CR 6850, and provides a preventing initiation of link to relevant PVNGS electrical coordination secondary fires through calculations that demonstrate selective tripping circuit faults created by the capability for each credited Fire PRA power initiating fire. supply (Reference 11 of this Attachment). When selective tripping cannot be demonstrated, the current fire PRA model credits plant modifications planned to correct the coordination.

13-22

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that Fire PRA All raceways containing cables were assigned a It is a realistic assumption and is of low targets were assigned the radiant heat flux damage threshold of 6kW/m2 consequence to RICT. It was concluded appropriate radiant heat flux and 205 °C. Raceways containing cables with that minimal benefit could be obtained by damage and temperature thermoset insulation only may be assigned a further analysis to identify and model damage criteria depending radiant heat flux damage threshold of 11 kW/m2 raceways containing only thermoset on the cable insulation and 330 °C but have been initially assigned the insulation.

information available. In thermoplastic damage thresholds. A brief review other words, all raceways of the dominant scenarios identified the containing cables with existence of thermoplastic insulated cables thermoplastic or unknown within the target raceways.

cable insulation were assigned a radiant heat flux damage threshold of 6kW/m2 and 205 °C. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thresholds.

13-23

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Planned plant modifications This approach introduces uncertainty in the This assumption that the planned plant and recovery actions are results, because the actual modifications may modifications will be installed and assumed in the base case vary for those assumed or they may not function tested/operated as assumed in the fire model. These modeled as modeled. The assumed modifications are PRA model has significant impact on the modifications are assumed documented in the Fire PRA studies. Plant and RICT Program. The assumption is realistic to correct the fire model configuration and control mechanisms are since the PRA analysis will provide details vulnerability and not in place to ensure that the fire model will be to the design modifications group in introduce any new failure updated to correct the as-installed modifications. developing the plant modifications and modes. One specific planned plant modification is the procedures. The PRA model will be revised installation of an additional Steam Generator to reflect the as-built/as-operated plant Makeup Pump to address Fire PRA risk. A configuration prior to implementation of sensitivity was performed that removes this the RICT Program.

modification from the model 13-24

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009

3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009

4. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

5. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

6. WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008

7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007

8. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies through the Elicitation Process, Draft

9. NUREG/CR-INEEL/EXT 04-0236, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003 (Draft), October 2004

10. Westinghouse Calculation Note CN-RAM-12-022, Revision 1, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, dated December 2, 2013

11. NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, September 2005 13-25

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 14 Program Implementation

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14 Program Implementation Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the RMTS implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a risk-informed completion time (RICT). This attachment provides the required description.

RICT Program Procedures Procedures will be developed to outline the requirements and responsibilities for the RICT Program. The procedures will provide guidance on departmental responsibilities and management authority for RICT Program application, and for required training, implementation, and monitoring of the RICT Program, including development and maintenance of the configuration risk management program (CRMP) tool and models reflecting the as-built, as-operated plant.

The RICT Program will be implemented by site procedures, which will fully address all aspects of the guidance of NEI 06-09-A. Operations, specifically the control room staff, is responsible for compliance with technical specifications (TS) requirements, and will be responsible for implementation of a RICT and any risk management actions (RMA) determined to be appropriate for the plant configuration. Use of a RICT and associated RMA will be approved by the General Plant Manager prior to entering an extended completion time (CT) for pre-planned activities. For emergent conditions requiring an extended CT, the use of the RICT program will be approved by the applicable Operations Shift Manager or General Plant Manager.

These procedures will be supplemented as necessary to address the additional guidance of NEI 06-09-A for detailed implementation of the RICT Program, including guidance on the following topics:

Performing a Tier 2 assessment for a RICT prior to entry into the TS limiting condition of operation (LCO)

Plant conditions for which the RICT Program is applicable

Conditions under which a RICT may not be used, or may not be voluntarily entered for the calculation of RICTs and RMA Times (RMAT)

Implementation of RICT Program front stops, 30-day backstop and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop limits

Plant configuration changes [i.e., recalculating the RICT and RMAT within the lesser of the affected required action (RA) completion time or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of any change.]

Conditions for exiting a RICT

Requirements to identify and implement RMA when the RMAT is exceeded or is anticipated to be exceeded in accordance with PVNGS Protected Equipment procedure, and NEI 06-09-A

The use of RMAs, including the conditions under which they may be credited in RICT calculations 14-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14

Crediting probabilistic risk assessment (PRA) functionality

Approval processes for use of a RICT

Determining PRA availability from detailed PRA functionality characteristics for each Technical Specification LCO

A RICT cannot be entered if PRA functionality must be lost in order to restore the LCO.

Determining PRA availability of degraded SSCs consistent with NEI 06-09-A

Cases where CDF and/or LERF exceed 1E-3/yr and/or 1E-4/yr as delineated in NEI 06-09-A

Analyzing conditions for Common Cause Failures (CCFs), planned and emergent configurations, in accordance with NEI 06-09-A and the guidance of Regulatory Guide 1.177 (Reference 2 of this Attachment).

RICT Program Training The scope of the training for the RICT Program will include training on rules and processes for the new RICT program, CRMP tool, TS Actions included in the program, and procedures.

Training will be carried out in accordance with PVNGS training procedures and processes.

Those organizations with functional responsibilities for performing or administering the CRMP shall have required training (e.g., licensed operators, work control personnel, PRA personnel, and station management).

Training will be provided to personnel responsible for performance of risk-managed technical specification (RMTS) actions. This training will be commensurate with the respective responsibilities of the personnel in the following areas:

Programmatic requirements of RMTS program.

Fundamentals of PRA including analytical methods employed and the interpretation of quantitative results. This training should include training on the potential impact of common cause failures, model assumptions and limitations, and uncertainties. The training also should address the implications of these factors in the use of PRA results in decision-making applicable to RMTS.

Plant specific quantitative and qualitative insights obtained from the PRA.

Operation of the plant configuration risk management tool and interpretation of results derived from its application.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making:

Technical Specifications, Revision 1, May 2011 14-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 15 Monitoring Program

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 Monitoring Program Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, (Reference 2 of this Attachment) and NEI 06-09-A. (Note that RG 1.174, Revision 2 (Reference 3 of this Attachment), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation for Section 4.0, Item 12.)

This attachment provides a description of the process applied to monitor the cumulative risk impact of implementation of the risk-informed completion time (RICT) Program, specifically the calculation of cumulative risk of extended completion times (CTs).

Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.

The calculation of cumulative risk impact is required by the RICT Program at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09, Revision 0 - A. For the assessment period evaluated, data is collected for the risk increases associated with each application of the RICT Program for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk calculated by summing the contributors to risk associated with each RICT application. This is the change in CDF or LERF above the zero maintenance baseline levels while a RICT was in effect (i.e., beyond the front-stop CT). The change in risk is converted to an average annual value.

The total average annual change in risk for extended CTs is compared to the guidance of RG 1.174, Figures 4 and 5 for CDF and LERF changes, respectively. If the actual annual risk increase is acceptable (i.e., not in Region I of the figures), then RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the RG 1.174 guidance and implementation of any necessary corrective actions to ensure future plant operation is within the guidance is conducted under the site Corrective Action Program.

The assessment will identify areas for consideration during the evaluation, including, as examples:

Those SSCs where the application of a RICT dominated the risk increase

Contributions from planned vs. emergent RICT applications

Risk management actions (RMA) implemented but not credited in the risk calculations

Offset risk due to RICT application by avoiding multiple shorter outages

Reductions in risk levels through improvements in SSC availability and reliability due to different maintenance strategies and the operational flexibility made possible through the RICT Program 15-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 Based on the evaluation, any necessary corrective actions determined to be appropriate are developed and approved by the General Plant Manager or Operations Shift Manager.

These may include:

Administrative restrictions on the use of RICTs for specific high-risk configurations based on instantaneous risk levels

Additional RMA for specific high-risk configurations

Rescheduling planned maintenance activities

Deferring planned maintenance to shutdown conditions

Use of temporary equipment to replace out-of-service systems, structures or components (SSCs)

Plant modifications to reduce risk impact of expected future maintenance configurations In addition to the cumulative impact of RICT Program implementation, the unavailability of SSCs is also potentially impacted. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts that may be incurred by implementation of the RICT Program. The use of the MR Program is acceptable since the SSCs in the scope of the RICT Program are also in the scope of the MR. Using the existing MR monitoring for this program is explicitly discussed in RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, (Reference 4 of this Attachment), Section 3.2, "Maintenance Rule Control."

The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serves as the "Implementation and Monitoring Program,"

defined as Element 3 of RG 1.174 for the RICT Program.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011

4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making:

Technical Specifications, Revision 1, May 2011 15-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 16 Risk Management Action Examples

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Risk Management Action Examples Introduction Section 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of the process to identify and provide compensatory measures and risk management actions (RMAs) during extended Completion Times (CTs), including specific examples.

This attachment describes the process for identification of risk management actions (RMA) applicable during extended CTs and provides examples of RMA. RMA will be governed by plant procedures for planning and scheduling maintenance activities. This procedure will provide guidance for the determination and implementation of RMA when entering the Risk-Informed Completion Time (RICT) Program and is consistent with the guidance provided in NEI 06-09-A (Reference 2 of this Attachment).

Responsibilities Work Planning / Work Management is responsible for identifying the need for RMA for planned work and Operations is responsible for identifying the need for RMA for emergent work. Operations, PRA and Fire Protection are responsible for developing the RMA.

Operations is responsible for implementation of RMA.

Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded. The RMA are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded as appropriate for the situation. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs, requiring recalculation of a RMAT already in place, the procedure requires a re-evaluation of the existing RMA for the new plant configuration to see if new RMA are appropriate. These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A.

RMAs are put in place no later than the point at which the incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. If as the result of an emergent event, the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1E-3 or 1E-4 per year, respectively, RMA are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A.

By determining which structures, systems, or components (SSC) are most important from a CDF and/or LERF perspective for a specific plant configuration, RMA may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF and/or LERF allows development of RMA that enhance the plants capability to mitigate such events. System-specific configuration risk management system guidelines (CRMSG) will be developed that will define the risk role of plant systems within the scope of the RICT Program, identify SSC explicitly modeled in the system, and 16-1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 identify the key SSC failure modes for equipment explicitly modeled. Approved system-specific RMAs will be contained in the CRMSG and be available in each unit Control Room.

It is possible to credit RMAs in the RICT calculations, but such quantification of RMA is not required by NEI 06-09-A. Crediting RMA in the RICT calculations is only done consistent with the guidance of NEI 06-09-A.

NEI 06-09-A classifies RMA into three categories, as described below:

1) Actions to increase awareness and control

Shift brief

Pre-job brief

Training (formal or informal)

Presence of system engineer or other expertise related to maintenance activity

Special purpose procedure to identify risk sources and contingency plans

2) Actions to reduce the duration of maintenance activities

Pre-staging materials

Conducting training on mock-ups

Performing the activity around the clock

Performing walk-downs on the actual system(s) to be worked on prior to beginning work

3) Actions to minimize the magnitude of the risk increase

Suspend/minimize activities on redundant systems

Suspend/minimize activities on other systems that adversely affect the CDF and/or LERF

Suspend/minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate

Use temporary equipment for backup power

Use temporary equipment for backup ventilation

Reschedule other maintenance activities 16-2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Examples of specific RMAs that may be considered during a RICT Program entry are found in Table A16-1. These specific limiting condition of operations (LCOs) have been chosen in response to the requests addressed by Southern Nuclear in NL-17-0447 (Reference 3 of this Attachment).

Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Suspend/minimize discretionary activities on the Station Blackout Operating Generators (SBOGs), the main and unit auxiliary transformers Condition A - One required associated with the unit, and on the startup transformers. The offsite circuit inoperable SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power availability to the unit.

4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

5. Suspend/minimize discretionary activities on Diesel Generators (DGs) and 4160 VAC bus(es) which could challenge the Availability of DGs and/or 4160 VAC safety bus(es).

6. Consider staging and connecting portable generators to the 4160 VAC safety bus(es).

7. Consider establishing the Outage Control Center (OCC) for oversight and monitoring of the compensatory measures and the actions described in this section.

16-3

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Weather conditions will be assessed prior to removing a DG from Operating service during planned maintenance activities.

Condition B - One Diesel 2. Should a severe weather warning be issued for the local area that Generator (DG) inoperable could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.

4. Maintain Availability of 4160 VAC safety buses.

5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

16-4

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Suspend/minimize discretionary activities on the SBOGs, the main Operating and unit auxiliary transformers associated with the unit, and on the Condition C - Two required startup transformers. The SBOGs will not be used for non-safety offsite circuits inoperable functions (i.e., power peaking to the grid).

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

5. Maintain Availability of both DGs, and maintain Availability of 4160 VAC safety bus(es).

6. Consider staging and connecting portable generators per procedure to the 4160 VAC safety bus(es).

7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

16-5

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Weather conditions will be assessed prior to removing a DG from Operating service during planned maintenance activities.

Condition D - One required 2. Should a severe weather warning be issued for the local area that offsite circuit inoperable could affect the switchyard or the offsite power supply during the AND Risk-Informed Completion Time, an operator will be available locally one DG inoperable at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.

4. Maintain Availability of 4160 VAC safety buses.

5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

16-6

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Weather conditions will be assessed prior to removing a DG from Operating service during planned maintenance activities.

Condition E - Two DGs 2. Should a severe weather warning be issued for the local area that inoperable could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Maintain Availability of 4160 VAC safety buses.

4. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

5. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

6. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

7. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

8. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..

16-7

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources - 1. Weather conditions will be assessed prior to removing an automatic Operating load sequencer from service during planned maintenance activities.

Condition F - One automatic 2. Should a severe weather warning be issued for the local area that load sequencer inoperable could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Perform a beginning of shift brief that focuses on actions operators will take in response to a loss of offsite power or safety injection.

Include review of local emergency start of the DG, manual tie to the bus, and manual Class 1E 4160 VAC bus loading for the affected bus.

4. The DGs (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the DGs.

5. Maintain Availability of 4160 VAC safety buses.

6. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

7. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

8. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..

16-8

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.4 DC Sources - 1. Limit the immediate discharge of the affected battery, if possible.

Operating 2. Recharge the affected battery to float voltage conditions using a Condition A - One battery spare battery charger, if possible.

charger on one subsystem 3. Evaluate the remaining battery capacity and protect its ability to inoperable perform its safety function.

4. Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries.

3.8.4 DC Sources - 1. Suspend/minimize discretionary activities on the SBOGs, the main Operating and unit auxiliary transformers associated with the unit, and on the Condition B - One DC startup transformers. The SBOGs will not be used for non-safety electrical power subsystem functions (i.e., power peaking to the grid).

inoperable for reasons other 2. Suspend/minimize discretionary activities in the Salt River Project than Condition A (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

3. Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or Loss of Offsite Power (LOOP).

4. Work to establish alternate power to the 125 VDC bus by temporary modification or by implementation of FLEX procedures.

5. Maintain Availability of redundant and diverse electrical systems.

6. Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.7 Inverters - Operating 1. Suspend/minimize discretionary activities on the SBOGs, the main Condition A - One required and unit auxiliary transformers associated with the unit, and on the inverter inoperable startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

3. Maintain Availability of DC electrical systems within the same train and the redundant train, associated 480 V bus, and associated regulating transformer.

4. Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

16-9

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.9 Distribution Systems 1. Terminate in-progress maintenance/testing activities and defer

- Operating scheduled maintenance/testing activities with the potential to cause Condition A - One AC loss of a Class 1E 4160 VAC bus. Also, avoid unnecessary switching electrical power distribution (i.e., breaker manipulations) in affected unit AC electrical systems.

subsystem inoperable 2. Maintain Availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.

3. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.9 Distribution Systems 1. Terminate in-progress maintenance/testing activities and defer

- Operating scheduled maintenance/testing activities with the potential to cause Condition B - One AC vital loss of an AC vital instrument bus.

instrument bus electrical 2. Maintain Availability of inoperable subsystem's remaining electrical power distribution SSCs, as well as the other subsystems' electrical SSCs.

subsystem inoperable 3. Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

4. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.9 Distribution Systems 1. Terminate in-progress maintenance/testing activities and defer

- Operating scheduled maintenance/testing activities with the potential to cause Condition C - One DC loss of a DC electrical power distribution subsystem.

electrical power distribution 2. Suspend/minimize discretionary activities on the safety systems and subsystems inoperable important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or LOOP.

3. Maintain Availability of redundant and diverse electrical systems.

4. Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather.

5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

References:

1. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI D6-09, "Risk-Informed Technical Specifications Initiative 48, Risk- Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995)," Letter from Jennifer M. Golder (NRR) to Biff Bradley (NEI), (ADAMS Accession Number dated ML071200238), dated May 17, 2007.

2. Nuclear Energy Institute (NEI) 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0-A, November 2006.

3. Vogtle Electric Generating Plant Units 1 and 2 Response to Request for Additional Information on Technical Specifications Change to Adopt Risk Informed Completion Times (ADAMS Accession Number ML17108A253), dated April 14, 2017.

16-10

v t e Letter Sequence Supplement
CAC:MF6576, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance Supplement, Supplement Administration Questions 26 February 2016 7 March 2016 4 April 2018 3 May 2018 23 August 2018 Answers 18 May 2018 21 September 2018 14 April 2017 Results Approval Other: ML18275A275
MONTHYEAR2018-10-05 [Table View]

ML17307A188

Text

Dear Sirs:

Reference:

Subject:

Enclosure:

1.0 DESCRIPTION

4.0 ENVIRONMENTAL CONSIDERATION

1.0 DESCRIPTION

4.0 ENVIRONMENTAL CONSIDERATION

References:

References:

References:

References:

Navigation menu

Search