Text

Rev 1 to PVNGS TS Bases Implemented Between Aug 1998 & Jul 1999
	ML17313B060
Person / Time
Site:	Palo Verde
Issue date:	08/31/1999
From:	; ARIZONA PUBLIC SERVICE CO. (FORMERLY ARIZONA NUCLEAR
To:	;
Shared Package
ML17313B059	List: ML17313B058; ML17313B060;
References
	NUDOCS 9908170259
	Download: ML17313B060 (244)
	v • d • e

PVNGS Technical Specifications Bases Revision 1 Insertion Instructions List of Effective Pages Revised Bases Pages 9908i70259 990806 PDR ADOCK i

05000528'DR

0 Oi i

I

PVNGS Technical Specifications Bases Revision' Ins*'ertion Instructions, Remove Pa e: Insert New Pa e:

B 3.0-6 B 3.0-6 B 3.0-10 B 3.0-10 B 3.1.5-7 B 3.1.5-7 B 3.1.5-8 B 3.1.5-8 B 3.1.5-10 B 3.1.5-10 B 3.1.5-11 B 3.1.9-5 B 3.1.9-5 B 3.1.9-6 B 3.1.9-6 3.2.2-5 3.2.2-5 B 3.3.1-12 B 3.3.1-12 B 3.3.1-13 B 3.3.1-13 B 3.3.1-19 B 3.3.1-19 B 3.3.1-22 B 3.3.1-22 B 3.3.1-23 B 3.3.1-23 B 3.3.1-29 B 3.3.1-29 B 3.3.1-34 B 3.3.1-34 B 3.3.1-39 B 3.3.1-39 B 3.3.2-3 B 3.3 2-3

~

B 3.3.2-4 B 3.3.2-4 B 3.3.2-6 B 3.3.2-6 B 3.3.2-7 B 3.3.2-7 B 3.3.2-15 B 3.3.2-15 B 3.3.5-12 B 3.3.5-12 B 3.3.5-20 B 3.3.5-20 B 3.3.5-27 B 3.3.5-27 B 3.3.6-21 B 3.3.6-21 B 3.3.6-22 B 3.3.6-22 3.3.8-6 3.3.8-6 3.3. 9-5 3.3. 9-5 3.3.10-10 3.3.10-10 3.4.1-2 3.4.1-2 3.4.2-2 3.4.2-2 3.4.6-3 3.4.6-3 3.4.8-3 3.4.8-3 3.4.9-3 3.4.9-3

I PVNGS Technical Specifications'Bases Revision j.

Insertion Instructions, Remove Pa e: 1nsert New Pa e:

3.4.11-2 3.4.11-2 B 3.4.12-1 B 3.4.12-1 B 3.4.12-2 B 3.4.12-2 3.4. 13-3 3.4. 13-3 B 3.5.1-7 B 3.5.1-7 B 3.5.1-8 B 3.5.1-8 B 3.5.1-10 B 3.5.1-10 B 3.5.2-7 B 3.5.2-7 B 3.5.2-8 B 3.5.2-8 B 3.5.2-9 B 3.5.2-9 B 3.5.2-10 B 3.5.3-6 B 3.5.3-6 B 3.5.3-8 B 3.5.3-8 B 3.5.3-10 B 3.5.3-10 B 3.5.6-2 B 3.5.6-2 B 3.5.6-4 B 3.5.6-4 B 3.6.3-4 B 3.6.3-4 B 3.6.3-5 B 3.6.3-5 B 3.6.3-6 B 3.6.3-6 B 3.6.3-7 B 3.6.3-7 B 3.6.3-8 B 3.6.3-8 B 3.6.3-9 B 3.6.3-9 B 3.6.3-10 B 3.6.3-10 B 3.6.3-11 B 3.6.3-11 B 3.6.3-12 B 3.6.3-12 B 3.6.3-13 B 3.6.3-13 B 3.6.3-14 B 3.6.3-14 B 3.6.3-15 B 3.6.3-16 B 3.6.3-17 B 3.6.4-2 B 3.6.4-2 B 3.6.4-3 B 3.6.4-3 3.6.5-2 3.6.5-2 B 3.6.6-3 B 3.6.6-3 B 3.6.6-4 B 3.6.6-4 B 3.6.6-5 B 3.6.6-5 B 3.6.6-7 B 3.6.6-7 B 3.6.6-8 B 3.6.6-8

0' PVNGS Technical,'.Specifications Bases Revision:1 Inseition Instructions Remove Pa e: Insert New Pa e:

B 3.7.1-5 B 3.7.1-5 B 3.7.1-6 B 3.7.1-6 B 3.7.3-1 B 3.7.3-1 B 3.7.3-2 B 3.7.3-2 B 3.7.3-3 B 3.7.3-3 B 3.7.5-5 B 3.7.5-5 B 3.7.5-6 B 3.7.5-6 B 3.7.5-7 B 3.7.5-7 B 3.7.5-10 B 3.7.5-10 B 3.7. 7-2 B 3.7.7-2 B 3.7. 7-3 B 3.7.7-3 B 3.7. 7-4 B 3.7.7-4 B 3.7. 7-5 B 3.7.7-5 B 3.7. 8-1 B 3.7.8-1 B 3.7. 8-2 B 3.7.8-2 B 3.7. 8-3 B 3.7.8-3 B 3.7. 8-4 B 3.7.8-4 B 3.7.9-2 3.7.9-2 B 3.7.10-2 B 3.7 '0-2 B 3.7.10-3 B 3.7.10-3 B 3.7.10-4 B 3.7.10-4 B 3.7.11-3 B 3.7.11-3 B 3.7.11-6 B 3.7.11-6 B 3.7.12-1 B 3.7.12-1 B 3.7.12-2 B 3.7.12-2 B 3.7.17-2 B 3.7.17-2 B 3.7.17-3 B 3.7.17-3 B 3.8. 1-2 B 3.8.1-2 B 3.8. 1-4 B 3.8.1-4 B 3.8. 1-6 B 3.8.1-6 B 3.8. 1-25 B 3.8.1-25 3.8. 3-5 3.8.3-5 B 3.8 5-1 B 3.8.5"1 B 3.8 5-2 B 3.8.5-2 B 3.8 5-3 B 3.8.5-3 B 3.8 5-4 B 3.8.5-4 B 3.8.5-5 B 3.8.5-6 B 3.8.6-5 B 3.8.6-5 B 3.8.6-6 B 3.8.6-6

0]

PVNGS'echnical, Specifications Bases Revision 1

>>, Insertion Xnstxuctions Remove Pa e: Insert New Pa e:

B 3.8.8-1 B 3.8.8-1 B 3.8.8-2 B 3.8.8-2 B 3.8.8-3 B 3.8.8-3 B 3.8.8-4 B 3.8.8-4 B 3.8.8-5 B 3.9.2-3 B 3.9.2-3 B 3.9.2-4 B 3.9.3-5 B 3.9.3-5 B 3.9.4-2 B 3.9.4-2 B 3.9.5-2 B 3.9.5-2

0 TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 2.1.1-1 0 B 3.1.4-5 0 B 2.1.1-2 0 B 3.1.5-1 0 B 2.1.1-3 0 B 3.1.5-2 0 B 2.1.1-4 0 B 3.1.5-3 0 B 2.1.1-5 0 B 3.1.5-4 0 B 2.1.2-1 0 B 3.1.5-5 0 B 2.1.2-2 0 B 3.1.5-6 0 B 2.1.2-3 0 B 3.1.5-7 1 B 2.1.2-4 0 B 3.1.5-8 1 B 2.1.2-5 0 B 3.1.5-9 0 B 3.0-1 ~

0 B 3.1.5-10 1 B 3.0-2 0 B 3.1.5-11 1 B 3.0-3 0 B 3.1.6-1 0 B 3.0-4 0 B 3.1.6-2 0 B 3.0-5 0 B 3.1.6-3 0 B 3.0-6 1 B 3.1.6-4 0 B 3.0-7 0 B 3.1.7-1 0 B 3.0-8 0 B 3.1.7-2 0 B 3.0-9 0 B 3.1.7-3 0 B 3.0-10 1 B 3.1.7-4 0 B 3.0-11 0 B 3.1.7-5 0 B 3.0-12 0 B 3.1.7-6 0 B 3.0-13 0 B 3.1.7-7 0 B 3.0-14 0 B 3.1.7-8 0 B 3.0-15 0 B 3.1.7-9 0 B 3.0-16 0 B 3.1.8-1 0 B 3.0-17 0 B 3.1.8-2 0 B 3.0-18 0 B 3.1.8-3 0 B 3.0-19 0 B 3.1.8-4 0 B 3.1.1-1 0 B 3.1.8-5 0 B 3.1.1-2 0 B 3.1.9-1 0 B 3.1.1-3 0 B 3.1.9-2 0 B 3.1.1-4 0 B 3.1.9-3 0 B 3.1.1-5 0 B 3.1.9-4 0 B 3.1.1-6 0 B 3.1.9-5 1 B 3.1.2-1 0 B 3.1.9-6 1 B 3.1.2-2 0 3.1.10-1 0 B 3.1.2-3 0 3.1.10-2 0 B 3.1.2-4 0 3.1.10-3 0 B 3.1.2-5 0 3.1.10-4 0 B 3.1.2-6 0 3.1.10-5 0 B 3.1.2-7 0 3.1.10-6 0 B 3.1.2-8 0 3.1.11-1 0 B 3.1.2-9 0 3.1.11-2 0 B 3.1.3-1 0 3.1.11-3 0 B 3.1.3-2 0 B 3.1.11-4 0 B 3.1.3-3 0 B 3.1.11-5 0 B 3.1.3-4 0 B 3.2.1-1 0 B 3.1.3-5 0 B 3.2.1-2 0 B 3.1.3-6 0 B 3.2.1-3 0 B 3.1.4-1 0 B 3.2.1-4 0 B 3.1.4-2 0 B 3.2.1-5 0 B 3.1.4-3 0 B 3.2.1-6 0 B 3.1.4-4 0 B 3.2.1-7 0 PALO VERDE UNITS 1~ 2g AND 3 Rev. 1 August 1999

S 0,

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.2.1-8 0 B 3.3.1-21 B 3.2.2-1 0 B 3.3.1-22 B 3.2.2-2 0 B 3.3.1-23 B 3.2.2>>3 0 B 3.3.1-24 B 3.2.2-4 0 B 3.3.1-25 B 3.2.2-5 1 B 3.3.1-26 B 3.2.2-6 0 B 3.3.1-27 B 3.2.2-7 0 B 3.3.1-28 B 3.2.3"1 0 B 3.3.1-29 B 3.2.3-2 0 B 3.3.1-30 B 3.2.3-3 0 B 3.3.1-31 B 3.2.3-4 0 B 3.3.1-32 B 3.2.3-5 0 B 3.3.1-33 B 3.2.3-6 0 B 3.3.1-34 B 3.2.3-7 0 B 3.3.1-35 B 3.2.3-8 0 B 3.3.1-36 B 3.2.3-9 0 B 3.3.1-37 B 3.2.3-10 0 B 3.3.1-38 B 3.2.4-1 0 B 3.3.1-39 B 3.2.4-2 0 B 3.3.1-40 B 3.2.4-3 0 B 3.3.2-1 B 3.2.4-4 0 B 3.3.2-2 B 3.2.4-5 0 B 3.3.2-3 B 3.2.4-6 0 B 3.3.2-4 B 3.2.4-7 0 B 3.3.2-5 B 3.2.4-8 0 B 3.3.2-6 B 3.2.4-9 0 B 3.3.2-7 B 3.2.5-1 0 B 3.3.2-8 B 3.2.5-2 0 B 3.3.2-9 B 3.2.5-3 0 B 3.3.2-10 B 3.2.5-4 0 B 3.3.2-11 B 3.2.5-5 0 B 3.3.2"12 B 3.2.5-6 0 B 3.3.2-13 B 3.2.5-7 0 B 3.3.2-14 B 3.3.1-1 0 B 3.3.2-15 B 3.3.1-2 0 B 3.3.2-16 B 3.3.1-3 0 B 3.3.3-1 B 3.3.1-4 0 B 3.3.3-2 B 3.3.1-5 0 B 3.3.3-3 B 3.3.1-6 0 B 3.3.3-4 B 3.3.1-7 0 B 3.3.3-5 B 3.3.1-8 0 B 3.3.3-6 B 3.3.1-9 0 B 3.3.3-7 B 3.3.1-10 0 B 3.3.3-8 B 3.3.1-11 0 B 3.3.3-9 B 3.3.1-12 1 B 3.3.3-10 B 3.3.1-13 1 B 3.3.3"11 B 3.3.1-14 0 B 3.3.4"1 B 3.3.1-15 0 B 3.3.4-2 B 3.3.1-16 0 B 3.3.4-3 B 3.3.1"17 0 B 3.3.4-4 B 3.3.1-18 0 B 3.3.4-5 B 3.3.1-19 1 B 3.3.4-6 B 3.3.1-20 0 B 3.3.4-7 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

0 l

TECHNICAL SPECIFICAT10N BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.3.4-8 0 B 3.3.6-19 B 3.3.4-9 0 B 3.3.6-20 B 3.3.4-10 0 B 3.3.6-21 B 3.3.4-11 0 B 3.3.6-22 B 3.3.4-12 0 B 3.3.7-1 B 3.3.4-13 0 B 3.3.7-2 B 3.3.4-14 0 B 3.3.7-3 B 3.3.4-15 0 B 3.3.7-4 B 3.3.5-1 0 B 3.3.7-5 B 3.3.5-2 0 B 3.3.7-6 B 3.3.5-3 0 B 3.3.7-7 B 3.3.5-4 0 B 3.3.7-8 B 3.3.5-5 0 B 3.3.7-9 B 3.3.5-6 0 B 3.3.8-1 B 3.3.5-7 0 B 3.3.8-2 B 3.3.5-8 0 B 3.3.8-3 B 3.3.5-9 0 B 3.3.8-4 B 3.3.5-10 0 B 3.3.8-5 B 3.3.5-11 0 B 3.3.8-6 B 3.3.5-12 1 B 3.3.8-7 B 3.3.5-13 0 B 3.3.8-8 B 3.3.5-14 0 B 3.3.9-1 B 3.3.5-15 0 B 3.3.9-2 B 3.3.5-16 0 B 3.3.9-3 B 3.3.5-17 0 B 3.3.9-4 B 3.3.5-18 0 B 3.3.9-5 B 3.3.5-19 0 B 3.3.9-6 B 3.3.5-20 1 B 3.3.9-7 B 3.3.5-21 0 B 3.3.10-1 B 3.3.5-22 0 B 3.3.10-2 B 3.3.5-23 0 B 3.3.10-3 B 3.3.5-24 0 B 3.3.10-4 B 3.3.5-25 0 B 3.3.10-5 B 3.3.5-26 0 B 3.3.10-6 B 3.3.5-27 1 B 3.3.10-7 B 3.3.5-28 0 B 3.3.10-8 B 3.3.6-1 0 B 3.3.10-9 B 3.3.6-2 0 B 3.3.10-10 B 3.3.6-3 0 B 3.3.10-11 B 3.3.6-4 0 B 3.3.10-12 B 3.3.6-5 0 B 3.3.10-13 B 3.3.6-6 0 B 3.3.10-14 B 3.3.6-7 0 B 3.3.10-15 B 3.3.6-8 0 B 3.3.10-16 B 3.3.6-9 0 B 3.3.10-17 B 3.3.6-10 0 B 3.3.10-18 B 3.3.6-11 0 B 3.3.10-19 B 3.3.6-12 0 B 3.3.10-20 B 3.3.6-13 0 B 3.3.11-1 B 3.3.6-14 0 B 3.3.11-2 B 3.3.6-15 0 B 3.3.11-3 B 3.3.6-16 0 B 3.3.11-4 B 3.3.6-17 0 B 3.3.11-5 B 3.3.6-18 0 B 3.3.11-6 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

0 TECHNICAL SPECIFICATION BASES LIST OF EFFECT1VE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.3.12"1 B 3.4.10-4 B 3.3.12-2 B 3.4.11-1 B 3.3.12-3 B 3.4.11-2 B 3.3.12-4 B 3.4.11-3 B 3.3.12-5 B 3.4.11-4 B 3.3.12-6 B 3.4.11-5 B 3.4.1-1 B 3.4.11-6 B 3.4.1-2 B 3.4.12-1 B 3.4.1-3 B 3.4.12-2 B 3.4.1-4 B 3.4.12-3 B 3.4.1-5 B 3.4.12-4 B 3.4.2-1 B 3.4.12-5 B 3.4.2-2 B 3.4.13-1 B 3.4.3-1 B 3.4.13-2 B 3.4.3-2 B 3.4.13-3 B 3.4.3-3 B 3.4.13-4 B 3.4.3-4 B 3.4.13-5 B 3.4.3-5 B 3.4.13-6 B 3.4.3-6 B 3.4.13-7 B 3.4.3-7 B 3.4.13-8 B 3.4.3-8 B 3.4.13-9 B 3.4.4-1 B 3.4.13-10 B 3.4.4-2 B 3.4.14-1 B 3.4.4-3 B 3.4.14-2 B 3.4.4-4 B 3.4.14-3 B 3.4.5-1 B 3.4.14-4 B 3.4.5-2 B 3.4.14-5 B 3.4.5'-3 B 3.4.14-6 B 3.4.5-4 B 3.4.15-1 B 3.4.5-5 B 3.4.15-2 B 3.4.6-1 B 3.4.15-3 B 3.4.6-2 B 3.4.15-4 B 3.4.6-3 B 3.4.15-5 B 3.4.6-4 B 3.4.15-6 B 3.4.6-5 B 3.4.15-7 B 3.4.7-1 B 3.4.16-1 B 3.4.7-2 B 3.4.16-2 B 3.4.7-3 B 3.4.16-3 0 B 3.4.7-4 B 3.4.16-4 0 B 3.4.7-5 B 3.4.16-5 0 B 3.4.7-6 B 3.4.16-6 0 B 3.4.7-7 B 3.4.17-1 B 3.4.8-1 B 3.4.17-2 B 3.4.8-2 B 3.4.17-3 B 3.4.8-3 B 3.4.17-4 B 3.4.9-1 B 3.4.17-5 B 3.4.9-2 B 3.4.17-6 B 3.4.9-3 B 3.5.1-1 B 3.4.9-4 B 3.5.1-2 B 3.4.9-5 B 3.5.1-3 B 3.4.9-6 B 3.5.1-4 B 3.4.10-1 B 3.5.1-5 B 3.4.10-2 B 3.5.1-6 B 3.4.10-3 B 3.5.1-7 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

0 0,'

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.5.1-8 1 B 3.6.3-4 1 B 3.5.1-9 0 B 3.6.3-5 1 B 3.5.1-10 1 B 3.6.3-6 1 B 3.5.2-1 0 B 3.6.3-7 1 B 3.5.2-2 0 B 3.6.3-8 1 B 3.5.2-3 0 B 3.6.3-9 1 B 3.5.2-4 0 B 3.6.3-10 1 B 3.5.2-5 0 B 3.6.3-11 1 B 3.5.2-6 0 B 3.6.3-12 1 B 3.5.2-7 1 B 3.6.3-13 1 B 3.5.2-8 1 B 3.6.3-14 1 B 3.5.2-9 1 B 3.6.3-15 1 B 3.5.2-10 1 B 3.6.3-16 1 B 3.5.3-1 0 B 3.6.3-17 1 B 3.5.3-2 0 B 3.6.4-1 0 B 3.5.3-3 0 B 3.6.4-2 1 B 3.5.3-4 0 B 3.6.4-3 1 B 3.5.3-5 0 B 3.6.5-1 0 B 3.5.3-6 1 B 3.6.5-2 1 B 3.5.3-7 0 B 3.6.5-3 0 B 3.5.3-8 1 B 3.6.5-4 0 B 3.5.3-9 0 B 3.6.6-1 0 B 3.5.3-10 1 B 3.6.6-2 0 B 3.5.4-1 0 B 3.6.6-3 1 B 3.5.4-2 0 B 3.6.6-4 1 B 3.5.4-3 0 B 3.6.6-5 1 B 3.5.5-1 0 B 3.6.6-6 0 B 3.5.5-2 0 B 3.6.6-7 1 B 3.5.5-3 0 B 3.6.6-8 1 B 3.5.5-4 0 B 3.6.6-9 0 B 3.5.5-5 0 B 3.6.7-1 0 B 3 '.5-6 0 B 3.6.7-2 0 B 3.5.5-7 0 B 3.6.7-3 0 B 3.5.6-1 0 B 3.6.7-4 0 B 3.5.6-2 1 B 3.6.7-5 0 B 3.5.6-3 0 B 3.7.1-1 0 B 3.5.6-4 1 B 3.7.1-2 0 B 3.5.6-5 0 B 3.7.1-3 0 B 3.6.1"1 0 B 3.7.1-4 0 B 3.6.1-2 0 B 3.7.1-5 1 B 3.6.1-3 0 B 3.7.1-6 1 B 3.6.1-4 0 B 3.7.2-1 0 B 3.6.1-5 0 B 3.7.2-2 0 B 3.6.2-1 0 B 3.7.2-3 0 B 3.6.2-2 0 B 3.7.2-4 0 B 3.6.2-3 0 B 3.7.2-5 0 B 3.6.2-4 0 B 3.7.2-6 0 B 3.6.2-5 0 B 3.7.3-1 1 B 3.6.2-6 0 B 3.7.3-2 1 B 3.6.2-7 0 B 3.7.3-3 1 B 3.6.2-8 0 B 3.7.3-4 0 B 3.6.3-1 0 B 3.7.3-5 0 B 3.6.3-2 0 B 3.7.4-1 0 B 3.6.3-3 0 B 3.7.4-2 0 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

0 J

/

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.7.4-3 0 B 3.7.16-3 0 B 3.7.4-4 0 B 3.7.16-4 0 B 3.7.5-1 0 B 3.7.17-1 0 B 3.7.5-2 0 B 3.7.17-2 1 B 3.7.5-3 0 B 3.7.17-3 1 B 3.7.5-4 0 B 3.7.17-4 0 B 3.7.5-5 1 B 3.7.17-5 0 B 3.7.5-6 1 B 3.8.1-1 0 B 3.7.5-7 1 B 3.8.1-2 1 B 3.7.5-8 0 B 3.8.1-3 0 B 3.7.5-9 0 B 3.8.1-4 1 B 3.7.5-10 1 B 3.8.1-5 0 B 3.7.6-1 0 B 3.8.1-6 1 B 3.7.6-2 0 B 3.8.1-7 0 B 3.7.6-3 0 B 3.8.1-8 0 B 3.7.6-4 0 B 3.8.1-9 0 B 3.7.7-1 0 B 3.8.1-10 0 B 3.7.7-2 1 B 3.8.1-11 0 B 3.7.7-3 1 B 3.8.1-12 0 B 3.7.7-4 1 B 3.8.1-13 0 B 3.7.7-5 1 B 3.8.1-14 0 B 3.7.8-1 1 B 3.8.1-15 0 B 3.7.8-2 1 B 3.8.1-16 0 B 3.7.8-3 1 B 3.8.1-17 0 B 3.7.8-4 1 B 3.8.1-18 0 B 3.7.9-1 0 B 3.8.1-19 0 B 3.7.9-2 1 B 3.8.1-20 0 B 3.7.9-3 0 B 3.8.1-21 0 B 3.7.10-1 0 B 3.8.1-22 0 B 3.7.10-2 1 B 3.8.1-23 0 B 3.7.10-3 1 B 3.8.1-24 0 B 3.7.10-4 1 B 3.8.1-25 1 B 3.7.11-1 0 B 3.8.1-26 0 B 3.7.11-2 0 B 3.8.1-27 0 B 3.7.11-3 1 B 3.8.1-28 0 B 3.7.11-4 0 B 3.8.1-29 0 B 3.7.11-5 0 B 3.8.1-30 0 B 3.7.11-6 1 B 3.8.1-31 0 B 3.7.12-1 1 B 3.8.1-32 0 B 3.7.12-2 1 B 3.8.1-33 0 B 3.7.12-3 0 B 3.8.1-34 0 B 3.7.12-4 0 B 3.8.1-35 0 B 3.7.13-1 0 B 3.8.2-1 0 B 3.7.13-2 0 B 3.8.2-2 0 B 3.7.13-3 0 B 3.8.2-3 0 B 3.7.13-4 0 B 3.8.2-4 0 B 3.7.13-5 0 B 3.8.2-5 0 B 3.7.14-1 0 B 3.8.2-6 0 B 3.7.14-2 0 B 3.8.3-1 0 B 3.7.14-3 0 B 3.8.3-2 0 B 3.7.15-1 0 B 3.8.3-3 0 B 3.7.15-2 0 B 3.8.3-4 0 B 3.7.16-1 0 B 3.8.3-5 1 B 3.7.16-2 0 B 3.8.3-6 0 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

@I 0',

I

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. LDCR Page Rev LDCR No. No. No. No. No. No.

B 3.8.3-7 0 B 3.9.1-4 B 3.8.3"8 0 B 3.9.2-1 B 3.8.3-9 0 B 3.9.2-2 B 3.8.4-1 0 B 3.9.2-3 B 3.8.4-2 0 B 3.9.2-4 B 3.8.4-3 0 B 3.9.3-1 B 3.8.4-4 0 B 3.9.3-2 B 3.8.4-5 0 B 3.9.3-3 B 3.8.4-6 0 B 3.9.3-4 B 3.8.4-7 0 B 3.9.3-5 B 3.8.4-8 0 B 3.9.4-1 B 3.8.4-9 0 B 3.9.4-2 B 3.8.4-10 0 B 3.9.4-3 B 3.8.4-11 0 B 3.9.4-4 B 3.8.5-1 1 B 3.9.5-1 B 3.8.5-2 1 B 3.9.5-2 B 3.8.5-3 1 B 3.9.5-3 B 3.8.5-4 1 B 3.9.5-4 B 3.8.5-5 1 B 3.9.6-1 B 3.8.5-6 1 B 3.9.6-2 B 3.8.6-1 0 B 3.9.6-3 B 3.8.6-2 0 B 3.9.7-1 B 3.8.6-3 0 B 3.9.7-2 B 3.8.6-4 0 B 3.9.7-3 B 3.8.6-5 1 B 3.8.6-6 1 B 3.8.6-7 0 B 3.8.7-1 0 B 3.8.7-2 0 B 3.8.7-3 0 B 3.8.7-4 0 B 3.8.8-1 1 B 3.8.8-2 1 B 3.8.8-3 1 B 3.8.8-4 1 B 3.8.8-5 1 B 3.8.9-1 0 B 3.8.9-2 0 B 3.8.9-3 0 B 3.8.9-4 0 B 3.8.9-5 0 B 3.8.9-6 0 B 3.8.9-7 0 B 3.8.9-8 0 B 3.8.9-9 0 B 3.8.9-10 0 B 3.8.9-11 0 B 3.8.10-1 0 B 3.8.10-2 0 B 3.8.10-3 0 B 3.8.10-4 0 B 3.9.1-1 0 B 3.9.1-2 0 B 3.9.1-3 0 PALO VERDE UNITS 1, 2, AND 3 Rev. 1 August 1999

0 0

LCO Appl i cabi 1 i ty 8 3.0 BASES LCO 3.0.4 Compliance with Required Actions that permit continued (continued) operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Appl i cabi 1 i ty.

The provisions of LCO 3.0.4 shall not prevent, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown including any non-LCO driven shutdowns such as entry into a refueling outage.

Exceptions to LCO 3.0.4 are stated in the individual Specifications. The exceptions allow entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time. Exceptions may apply to all the ACTIONS or to a specific Required Action of a Specification.

LCO 3.0.4 is only applicable when entering MODE 4 from MODE 5, MODE 3 from MODE 4, MODE 2 from MODE 3, or MODE 1 from MODE 2. Furthermore, LCO 3.0.4 is applicable when entering any other specified condition in the Applicability only while operating in MODES 1,', 3, or 4. The requi rements of LCO 3.0.4 do not apply in MODES 5 and 6 or in other specified conditions of the Applicability (unless in MODES 1, 2, 3, or 4)'ecause the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

(continued)

PALO VERDE UNITS 1,2,3 8 3.0-6 REVISION 1

0 LCO Applicability 8 3.0 BASES LCO 3.0.6 If this evaluation determines that a loss of safety function (continued) exists, the appropriate Conditions and Required Actions LCO in which the loss of saf'ety function exists are of'he required to be entered.

~XAMP ~

ystea C Systea C Systea 2 Systea 5 Systea 10 ystea 11 syscea 2 Systea 5 i Systea Systea 10 11

[

Systea 1 Systes 1 Systea 12 Systea 12 ystte 0 Systea 0 tea 13 Systea 13

[

Systea 3 Systee 3 Systea 1C Systea 1C ystes 7 a Systea 15 Systea 7 Systea 15 83.0.6-1

~y EXAMPLE a loss 1 Al 1 p

of safety function exists in supported bl . ddyt. B TT 1 Systems 5. 10 and 11.

Bl 1 p bl EXAMPLE 83.0.6-2 T 1 A 1 1 p bl . d By t. Tl 1 T 1 B 1 1 p bl a loss of safety function exists in System 11 which is in turn supported by System 5.

83.0.6-3 Tydyyy EXAMPLE loss of safety function exists 1 Al 1 p in bl .

Systems ddyt 1 2.4.5,8,9,10, TT 1 Bl and 11.

1 P bl For the examples above, support systems are to the left of the supported systems (i.e., System 1 supports System 2 and System 3).

(continued)

PALO VERDE UNITS 1,2,3 8 3.0-10 REVISION 1

I 0'

CEA Alignment B 3.1.5 BASES ACTIONS A.l and A.2 (continued)

In both cases, a 2 hour time period is sufficient to:

a. Identify cause of a misaligned CEA;

b. Take appropriate corrective action to realign the CEAs; and

c. Minimize the effects of xenon redistribution.

The CEA must be returned to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

If a CEA misalignment results in the COLSS programs bein@

declared INOPERABLE. refer to Section 3.2 Power Distribution Limits for applicable actions.

8.1 and 8.2 At least two of the following three CEA position indicator channels shall be OPERABLE for each CEA:

a. CEA Reed Switch Position Transmitter (RSPT 1) with the capability of determining the absolute CEA positions within 5.2 inches,

b. CEA Reed Switch Position Transmitter (RSPT 2) with the capability of determining the absolute CEA positions within 5.2 inches, and

c. The CEA pulse counting position indicator channel.

If only one CEA position indicator channel is OPERABLE, continued operation in MODES 1 and 2 may continue, provided, within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , at least two position indicator channels are returned to OPERABLE status; or within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , verify that the CEA group with the inoperable position indicators are either fully withdrawn or fully inserted while maintaining the insertion limits of LCO

3. 1.6. LCO 3. 1.7 and LCO 3. 1.8. CEAs are fully withdrawn (Full Out) when withdrawn to at least 144.75 inches.

C.1 If a Required Action or associated Completion Time of Condition A or Condition B is not met or ~ if one or more regulating or shutdown CEAs are untrippable (immovable as a result of excessive friction or mechanical interference or (continued)

PALO VERDE UNITS 1,2.3 B 3.1.5-7 REVISION 1

CEA Alignment B 3.1.5 BASES ACTIONS C.1 (continued) known to be untrippable), the unit is requi red to be brought to MODE 3. By being brought to MODE 3, the unit is brought outside its MODE of applicability.

When a Required Action cannot be completed within the required Completion Time, a controlled shutdown should be commenced. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

If a full length CEA is untrippable, it is not available for reactivity insertion during a reactor trip. With an untrippable CEA,,meeting the insertion limits of LCO 3. 1.6, "Shutdown Control Element Assembly (CEA) Insertion Limits,"

and LCO 3. 1.7. "Regulating Control Element Assembly (CEA)

Insertion Limits," does not ensure that adequate SDM exists.

Therefore, the plant must be shut down in order to evaluate the SDM required boron concentration and power level for critical operation. Continued operation is allowed with untrippable part length CEAs limits are met.

if the alignment and insertion Continued operation is not allowed with one or more full length CEAs untrippable. This is because these cases are indicative of a loss of SDM and power distribution, and a loss of safety functions respectively.

D.1 Continued operation is not allowed in the case of more than one CEA misaligned from any other CEA in its group by

> 9.9 inches. For example, two CEAs in a group misaligned from any other CEA in that group by > 9.9. inches, or more than one CEA group that has a least one CEA misaligned from any other CEA in that group by > 9.9 inches. This is indicative of a loss of power distribution and a loss of safety function, respectively. Multiple CEA misalignments should result in automatic protective action. Therefore, with two or more CEAs misaligned more than 9.9 inches, this could result in a situation outside the design basis and immediate action would be required to prevent any potential fuel damage. Immediately opening the reactor trip breakers minimizes these effects.

(continued)

PALO VERDE UNITS 1.2,3 8 3.1.5-8 REVISION 1

0 CEA Alignment B 3.1.5 BASES SURVEILLANCE SR 3.1.5.4 REQUIREMENTS (continued) Performance of a CHANNEL FUNCTIONAL TEST of each reed switch position transmitter channel ensures the channel is OPERABLE and capable of indicating CEA position. Since this test must be performed when the reactor is shut down, an 18 month Frequency to be coincident with refueling outage was selected. Operating experience has shown that these ,

components usually pass this Surveillance when performed at a Frequency of once every 18 months. Furthermore, the Frequency takes into account other factors. which determine the OPERABILITY of the CEA Reed Switch Indication System.

These factors include:

a. Other, more freguently performed survei llances that

,help to verify OPERAB1LITY;

b. On-line diagnostics performed automatically by the CPCs. CEACs, and the Plant Computer which include CEA position comparisons and sensor validation; and

c. The CHANNEL CALIBRATIONs for the CPCs (SR 3.3. 1.9) and CEACs (SR 3.3.3.4) input channels that are performed at 18 month intervals and is an overlapping test.

SR 3.1.5.5 Veri fication of full length CEA drop times determines that the maximum CEA drop time permitted is consistent with the assumed drop time used in the safety analysis (Ref. 3).

Measuring drop times prior to reactor criticality. after reactor vessepl head removal, ensures the reactor internals and CEDM will not interfere with CEA motion or drop time, and that no degradation in these systems has occurred that would adversely affect CEA motion or drop time. Individual CEAs whose drop times are greater than safety analysis assumptions are not OPERABLE. This SR is performed prior to criticality due to the plant conditions needed to perform the SR and the potentia] for an unplanned plant transient the Surveillance were performed with the reactor at power.

if The 4 second CEA drop time is the maximum time it takes for a fully withdrawn individual full length CEA to reach its 90K insertion position when electrical power is interrupted to the CEA drive mechanism with RCS T greater than or equal to 552'F and all reactor coolant pumps operating.

(continued)

PALO VERDE UNITS 1.2,3 B 3.1.5-10 REVISION 1

J CEA Alignment 8 3.1.5 BASES The CEA drop time of full-length CEAs shall also be demonstrated through measurement prior to reactor criticality f'r specifically affected individual CEAs following any maintenance on or modification to the CEA drive system which could af'feet the drop time of those specific CEAs.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. UFSAR, Section 15.4.

PALO VERDE UNITS 1.2,3 8 3.1.5-11 REVISION 1

STE-SDM 8 3.1.9 BASES (continued)

ACTIONS A.1 With any CEA not fully inserted and less than the minimum required reactivity equivalent available for insertion, or with all CEAs inserted and the reactor subcritical by less than the reactivity equivalent of the highest worth withdrawn CEA, restoration of the minimum shutdown reactivity requirements must be accomplished by increasing the RCS boron concentration. The required Completion Time of 15 minutes for initiating boration allows the operator sufficient time to align the valves and start the boric acid pumps and is consistent with the Completion Time of LCO 3.1.2.

In the determination of the required combination of boration flow rate and boron concentration, there is no unique requi rement that must be satisfied. Since it is imperative to raise the bo'ron concentration of the RCS as soon as possible, the boron concentration should be a highly concentrated solution, such as that normally found in the refueling water tank. The operator should borate with the best source available for the plant conditions.

In determining the boration flow rate the time in core life must be considered. For instance, the most difficult time in core life to increase the RCS boron concentration is at the beginning of cycle, when the boron concentration will exceed 2000 ppm. Assuming that a value of 1X hk/k must be recovered and a boration flow rate of 26 gpm, it is possible to increase the boron concentration of the RCS by 100 ppm in approximately 35 minutes with a 4000 ppm source. If a boron worth of 10 pcm/ppm is assumed, this combination of parameters will increase the SON by 1X dk/k. These boration parameters of 26 gpm and 4000 ppm represent typical values and are provided for the purpose of offering a specific example.

SURVEILLANCE SR 3.1.9.1 REQUIREMENTS Verification of the position of each partially or fully withdrawn full length or part length CEA is necessary to ensure that the minimum negative reactivity requirements for insertion on a trip are preserved. A 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Frequency is sufficient for the operator to verify that each CEA position is within the acceptance criteria.

(continued)

PALO VERDE UNITS 1,2,3 8 3.1.9-5 REVISION 1

STE-SDM B 3.1.9 BASES (continued)

SR 3.1.9.2 Prior demonstration that each CEA to be withdrawn from the core during PHYSICS TESTS is capable of full insertion, when tripped from at least a 50K withdrawn position, ensures that the CEA will insert on a trip signal. The 7 day Frequency ensures that the CEAs are'OPERABLE prior to reducing SDN requirements to less than the limits of LCO 3. 1.2.

SR 3.1.9.3 During NODE 3, verification that the reactor is subcritical by at least the reactivity equivalent of the highest estimated CEA worth ensures that the minimum negative reactivity requirements are preserved. The negative reactivity requi rements are verified by performing a reactivity balance calculation, considering the listed reactivity effects:

a. RCS boron concentration;

b. CEA positions;

c. RCS average temperature;

d. Fuel burnup based on gross thermal energy generation;

e. Xenon concentration; and

f. Samarium concentration.

The Frequency oi 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is based on the generally slow change in; required boron concentration, and it allows sufficient time for the operator to collect the required data.

REFERENCES 1. 10 CFR 50, Appendix B,Section XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68. Revision 2, August 1978.

4. ANSI/ANS-19.6.1-1985, December 13, 1985.

5. UFSAR, Chapter 14.

6. 10 CFR 50.46.

7. UFSAR, Chapter 15.

PALO VERDE UNITS 1.2,3 B 3.1.9-6 REVISION 1

BASES APPLICABLE cause increased power peaking and correspondingly increased SAFETY ANALYSES LHR.

(continued)

F~ satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCO The power distribution LCO limits are based on correlations between power peaking and certain measured variables used as inputs to the LHR and DNBR operating limits. The power distribution LCO limits are provided in the COLR.

Limiting the calculated Planar Radial Peaking Factors (F~)

used in the COLSS and CPCs to values than the measured Planar Radial Peaking Factorsgreasier(F ) ensures that the limits calculated by the COLSS and Cps remain valid.

The Planar Radial Peakinq Factor is the ratio of the peak to plane average power density of the individual fuel rods in a given horizontal plane, excluding the effects of'zimuthal tilt.

APPLICABILITY Power distribution is a concern any time the reactor is critical. The power distribution LCOs, however, are only applicable in MODE 1 above ZOX RTP. The reasons these LCOs are not applicable below 20K RTP are:

a. The incore neutron detectors that provide input to the COLSS, which then calculates the operating limits, are inaccurate because of the poor signal to noise ratio that they experience at relatively low core power levels; and

b. As a result of this inaccuracy, the CPCs assume a minimum core power of ZOX RTP when generating the LPD and DNBR trip signals. When the core power is below ZOX RTP, the core is operating well below its thermal limits, and the resultant CPC calculated LPD and DNBR trips are highly conservative.

ACTIONS A.1.1 and A.1.2 When the F~ values exceed the F' values used in the COLSS and CPCs, nonconservative operating limits and trip setpoints may be calculated. In this case, action must be taken to ensure that the COLSS operating limits and CPC trip (continued)

PALO VERDE UNITS 1,2,3 B 3.2.2-5 REVISION 1

0 0

RPS Instrumentation Operating B 3.3.1 BASES APPLICABLE Desi n Basis Defini ti on (continued)

SAFETY ANALYSES Variable Over Power-Hi h (continued) setpoint change is limited by the rate function. If the power level signal increases faster than the setpoint, a trip will occur when the power level eventually equals the trip setpoint. The maximum value the setpoint can have is determined by the ceiling function.

The Variable Over Power High trip provides protection against core damage during the following events:

~ Uncontrolled CEA Withdrawal From Low Power (AOO):

~ Uncontrolled CEA Withdrawal at Power (AOO); and

~ CEA Ejection (Accident).

Lo arithmic Power Level Hi h The Logarithmic Power Level High trip protects the integrity of the fuel cladding and helps protect the RCPB in the event of an unplanned criticality from a shutdown condition.

In NODES 2, 3, 4, and 5, with the RTCBs closed and the CEA Drive System capable of CEA withdrawal, protection is required for CEA withdrawal events originating when logarithmic power is ( 1E-4K NRTP. For events originating above this power level, other trips provide adequate protection.

NODES 3, 4, and 5, with the RTCBs closed, are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Instrumentation Shutdown."

In NODES 3, 4, or 5, with the RTCBs open or the CEAs not capable of withdrawal, the Logarithmic Power Level High trip does not have to be OPERABLE. The indication and alarm functions requi red to indicate a boron dilution event are addressed in LCO 3.3.12.

"Boron Dilution Alarm System (BDAS)".

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-12 REVISION 1

E 0

RPS Instrumentati on Operating 8 3.3.1 BASES APPLICABLE Desi n Basis Definition (continued)

SAFETY ANALYSES

3. Pressurizer Pressure Hi h The Pressurizer Pressure High trip provides protection for the high RCS pressure SL. In conjunction with the pressurizer safety valves and the main steam safety valves (MSSVs), it provides protection against overpressurization of the RCPB during the following events:

~ Loss of Condenser Vacuum (AOO):

~ CEA Withdraw'al From Low Power Conditions (AOO);

~ Chemical and Volume Control System Malfunction (AOO); and

~ Main Feedwater System Pipe Break (Accident).

4. Pressurizer Pressure - Low The Pressurizer Pressure Low trip is provided to trip the reactor to assist the ESF System in the event of loss of coolant accidents (LOCAs). During a LOCA, the SLs. may be exceeded; however, the consequences of the accident wi 11 be acceptable. A Safety Injection Actuation Signal (SIAS) and a Containment Isolation Actuation Signal (CIAS) are initiated simultaneously.

5. Containment Pressure Hi h The Containment Pressure High trip prevents exceeding the containment design pressure psig during a design basis LOCA or main steam line break (MSLB) accident.

During a LOCA or MSLB the SLs may be exceeded; however, the consequences of the accident will be acceptable. An SIAS, CIAS, and MSIS are initiated simultaneously.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-13 REVISION 1

I

~

ll

RPS Instrumentation Operating B 3.3.1 BASES LCO Lo arithmic Power Level Hi h This LCO requires all four channels of Logarithmic Power Level High to be OPERABLE in NODE 2.

In NODES 3, 4, or 5 when the RTCBs are shut and the CEA Drive System is capable of CEA withdrawal conditions are addressed in LCO 3.3.2.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary Logarithmic Power Level High reactor trips during normal plant operations. The Allowable Value is low enough f'r the system to maintain a margin to unacceptable fuel cladding damage should a CEA withdrawal event occur.

The Logarithmic Power Level High trip may be bypassed when logarithmic power is above 1E-4X NRTP to allow the reactor to be brought to power during a reactor startup. This operating bypass is automatically removed when logarithmic power decreases below 1E-4X NRTP. Above 1E-4X NRTP, the Variable Over Power High and Pressurizer Pressure High trips provide protection for reactivity transients.

Pressurizer Pressure Hi h This LCO requires four channels of'ressurizer Pressure High to be OPERABLE in NODES 1 and 2.

The Allowable Value is set below the nominal setting of the pressurizer code safety valves, and its lift operation avoids the undesirable operation of these valves during normal plant operation. In the event of a loss of condenser vacuum at 100K power, this setpoint ensures the reactor trip will take place, thereby limiting further heat input to the RCS and consequent pressure rise. The pressurizer safety valves may lift to prevent overpressurization of the RCS.

(continued)

PALO VERDE UNITS 1,2,3 8 3.3.1-19 REVISION 1

~ 4 0

RPS Instrumentation Operating B 3.3 '

BASES

12. 13. Reactor Coolant Flow Low This LCO requires four channels of Reactor Coolant Flow Steam Generator gl-Low and Reactor Coolant Flow Steam Generator g 2-Low to be OPERABLE in MODES 1 and 2. The Allowable Value is set low enough to allow f'r slight variations in reactor coolant flow during normal plant operations while providing the required protection. Tripping the reactor ensures that the resultant power to flow ratio provides adequate core cooling to maintain DNBR under the expected pressure conditions for this event.

LCO 3.4.5. "RCS Loops NODE 3." LCO 3.4.6. "RCS Loops NODE 4." and LCO 3.4.7. "RCS Loops NODE 5, Loops Filled," ensure adequate RCS flow rate is maintained.

14. Local Power Densit Hi h This LCO requires four channels of LPD High to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AOOs and the consequences of accidents are acceptable.

A CPC the is not considered inoperable CPC if CEAC inputs to are inoperable. The Required Actions requi red in the event of CEAC channel fai lures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below 1E-4X NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR Low and LPD High trips from the RPS Logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are no longer satisfied.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-22 REVISION 1

/I RPS Inst rumentati on Operating 8 3.3.1 BASES LCO 14. Local Power Densit Hi h (continued)

This operating bypass is requi red to perform a plant startup, since both CPC generated trips will be in effect whenever shutdown CEAs are inserted. It also allows system tests at low power with Pressurizer Pressure Low or RCPs off.

15. De arture from Nucleate Boi lin Ratio (DNBR) Low This LCO requires four channels of DNBR Low to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AOOs and the consequences of accidents are acceptable.

A CPC the is not considered inoperable CPC if CEAC inputs to are inoperable. The Required Actions required in the event of CEAC channel failures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below lE-4X NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR Low and LPD High trips from the RPS logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are- no longer satisfied.

This operating bypass is required to perform a plant startup. since both CPC generated trips will be in effect whenever shutdown CEASE are inserted. It also allows system tests at low power with Pressurizer Pressure Low or RCPs off.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.1-23 REVISION 1

I

$ 1 0

RPS Instrumentation Operating B 3.3.1 BASES ACTIONS D.l and D.2 (continued)

The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST, or the plant must shut down per LCO 3.0.3 as explained in Condition B.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of NODES even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration. the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

E.l Condition E applies if any CPC cabinet receives a high temperature alarm. There are redundant temperature sensors in each of the four CPC bays. Since CPC bays B and C also house CEAC calculators 1 and 2, respectively, a high temperature in either of these bays requires entry into LCO 3.3.3, Condition C.

If a CPC cabinet high temperature alarm is received, is it possible for an OPERABLE CPC to be affected and not be completely reliable. Therefore, a CHANNEL FUNCTIONAL TEST must be performed on OPERABLE CPCs within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate considering the low probability. of undetected failure, the consequences of a single channel fai lure, and the time required to perform a CHANNEL FUNCTIONAL TEST.

F.1 Condition F applies if an OPERABLE autorestarts in a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period.

CPC has three or more CPCs and CEACs will attempt to autorestart if they detect a fault condition, such as a calculator malfunction or loss of power. A successful autorestart restores the calculator to operation; however, excessive autorestarts might be indicative of a calculator problem. The autorestart periodic test restart (Code 30), and normal system load (Code 33) are not included in the total.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-29 REVISION 1

0 0

0

RPS Instrumentation Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) The three vertically mounted excore nuclear instrumentation detectors in each channel are used to determine APD for use in the DNBR and LPD calculations. Because the detectors are mounted outside the reactor vessel. a portion of the signal from each detector is from core sections not adjacent to the detector. This is termed shape annealing and is compensated for after every refueling by performing SR 3.3.1.11, which adjusts the gains of the three detector amplifiers for shape annealing. SR 3.3.1.6 ensures that.

the preassigned gains are still proper. When power is

< 15K the CPCs do not use the excore generated signals for axial flux shape information. The Note allowing 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 15K RTP is required for plant stabilization and testing. The 31 day Frequency is adequate because the demonstrated long term drift of the instrument channels is minimal.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on each channel is performed every 92 days to ensure the entire channel will perform its intended function when needed. The SR is modified by two Notes. Note 1 is a requirement to verify the correct CPC addressable constant values are installed in the CPCs when the CPC CHANNEL FUNCTIONAL TEST is performed. Note 2 allows the CHANNEL FUNCTIONAL TEST for the Logarithmic Power Level High channels to be performed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after logarithmic power drops below lE-4X NRTP.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 8. These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs. They include:

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-34 REVISION 1

0 I

I 0

1'

RPS Instrumentation Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1. 12 REQUIREMENTS (continued) SR 3.3.1.12 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.1.7, except SR 3.3.1.12 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify operating bypass removal function OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

Once the operating bypasses are removed. the bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST, SR 3.3.1'.7.

Therefore, further testing of the operating bypass function after startup is unnecessary.

SR 3.3.1.13 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the

'arameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response times are conducted on an 18 month STAGGERED TEST BASIS. This results in the interval between successive survei llances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of 18 months is based upon operating experience, which has shown that random fai lures of instrumentation components causing serious response time degradation. but not channel failure.

are infrequent occurrences. Response time testing may be performed at power on a single channel or during plant outages when the equipment is not required to be operable.

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-39 REVISION 1

8 0

RPS Instrumentation Shutdown B 3.3.2

'ASES BACKGROUND Measurement Channels and Bistable Tri Units (continued)

The measurement channels providing input to the Logarithmic Power Level High trip consist of the four logarithmic nuclear instrumentation channels detecting neutron flux leakage from the reactor vessel. Other aspects of the Logarithmic Power Level High trip are similar to the other measurement channels and bistables. These are addressed in the Background section of LCO 3.3.1.

Functional testing of the entire RPS, from bistable input through the opening of individual sets of RTCBs, can be performed either at power or shutdown and is normally erformed on a quarterly basis. Nuclear instrumentation can

~

e similarly tested. UFSAR, Section 7.2 (Ref. 3). provides

~ ~

more detail on RPS testing.

APPLICABLE The RPS functions to maintain the SLs during AOOs and SAFETY ANALYSES mitigates the consequence of DBAs in all NODES in which the RTCBs are closed.

Each of the analyzed transients and accidents can be detected by one or more RPS Functions. Functions not specifically credited in the accident analysis were qualitatively credited in the safety analysis and the NRC staff approved licensing basis for the plant. Noncredited Functions include the Steam Generator Water Level - High Trip. The Steam Generator Water Level - High Trip is purely equipment protective, and its use minimizes the potential for equipment damage.

The Logarithmic Power Level High trip protects the integrity of the fuel cladding and helps protect the RCPB in the event of an unplanned criticality from a, shutdown condition.

The Steam Generator Pressure-Low trip function provides shutdown margin to prevent or minimize the return to power, following a large Hain Steam Line Break (MSLB) in NODE 3.

With less than 4 RCPs running the trip setpoint for the Logarithmic Power Level-High trip is reduced to 5 10 4X NRTP. The lower setpoint is requi red for a bank CEA withdrawal with less than 4 RCPs running.

(continued)

PALO VERDE UNITS 1,2,3 8 3.3.2-3 REVISION 1

ll 0

'1

RPS Instrumentation Shutdown B 3.3.2 BASES APPLICABLE In MODES 2, 3, 4, and 5, with the RTCBs closed, and the Control Element Assembly (CEA) Drive System capable of CEA SAFETY ANALYSES (continued) withdrawal, protection is required f'r CEA withdrawal events, and excessive cooldown due to a MSLB originating when logarithmic power is < 1E-4X NRTP. for events originating above this power level. other trips provide adequate protection.

MODES 3. 4. and 5, with the RTCBs closed, are addressed in this LCO. MODE 2 is addressed in LCO 3.3.1.

In MODES 3, 4, or 5, with the RTCBs open or the CEAs not capable of withdrawal,, the Logarithmic Power Level High trip does not have to be OPERABLE. The indication and alarm functions requi red to indicate a boron dilution event are addressed in LCO 3.3.12 "Boron Dilution Alarm System (BOAS)".

Interlock/B asses The operating bypasses and their Allowable Values are addressed in footnotes to Table 3.3.2-1. They are not otherwise addressed as specific Table entries.

The automatic operating bypass removal features must function as a backup to manual actions for all safety related trips to ensure the trip Functions are not operationally bypassed when the safety analysis assumes the Functions are not bypassed. The basis for the Logarithmic Power Level -High operating bypass is discussed under individual trips in the LCO section.

The RPS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1.2.3 8 3.3.2-4 REVISION 1

I/

0

RPS Instrumentation Shutdown 8 3.3.2 BASES LCO that removes power from the CEDMs may be used. The CEAs are (continued) still capable of withdrawal are disabled with power if the CEDMCS withdrawal to the CEDMs because circuits failures applied in the CEDNCS could result in CEA withdrawal.

This LCO requires all four channels of Steam Generator ¹1 Pressure-Low. and Steam Generator ¹2 Pressure-Low, to be OPERABLE in NODE 3, when the RTCBs are closed and the CEA Drive System is capable of CEA withdrawal. These RPS functions are not required in NODES 4 and 5 because the Steam Generator temperature is low, therefore the energy release and resulting cooldown following a large NSLB in MODES 4 and 5 is not significant.

The Allowable Values are high enough to provide an operating envelope that prevents unnecessary Logarithmic Power Level High reactor trips during normal plant operations.

The Allowable Values are low enough for the system to maintain a safety margin for unacceptable fuel cladding damage should a CEA withdrawal or NSLB event occur.

The Logarithmic Power Level High trip may be bypassed when logarithmic power is above 1E-4X NRTP to allow the reactor to be brought to power during a reactor startup. This bypass is automatically removed when logarithmic power decreases below 1E-4X NRTP. Above 1E-4X NRTP, the Variable Over Power High and Pressurizer Pressure High trips provide protection for reactivity transients.

APPLICABILITY This LCO is applicable to the RPS Instrumentation in NODES 3, 4, and 5 with any RTCB closed and any CEA capable of withdrawal. LCO 3.3. 1 is applicable to the RPS Instrumentation in MODES 1 and 2. The requirements for the CEACs in MODES 1 and 2 are addressed in LCO 3.3.3. The RPS Matrix Logic. Initiation Logic, RTCBs, and Manual Trips in MODES 1, 2, 3, 4, and 5 are addressed in LCO 3.3.4.

Most RPS trips are required to be OPERABLE in NODES 1 and 2 because the reactor is critical in these MODES. The trips are designed to take the reactor subcritical, which maintains the SLs during AOOs and assists the Engineered Safety Features Actuation System (ESFAS) in providing acceptable consequences during accidents. Most trips are not required to be OPERABLE in MODES 3, 4, and 5.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.2-6 REVISION 1

0 0

RPS Instrumentation Shutdown B 3.3.2 BASES APPLICABILITY In MODES 3, 4, and 5, the emphasis is placed on return to (continued) power events. The reactor is protected in these MODES by ensuring adequate SDM. Exceptions to this are:

~ The Logarithmic Power Level High trip, RPS Logic RTCBs.

and Manual Trip are requi red in MODES 3, 4, and 5, with the RTCBs,closed. to provide protection for boron dilution and CEA withdrawal events. The Logarithmic Power Level High trip in these lower MODES is addressed in this LCO. The RPS Logic in MODES 1, 2. 3. 4, and 5 is addressed in LCO 3.3.4, "Reactor Protective System (RPS) Logic and Trip Initiation."

~ The Steam Generator gl Pressure-Low. and the Steam Generator g2 Pressure-Low trips, RPS Logic. RTCBs, and Manual Trip are required in MODE 3 with the RTCBs closed, to provide protection for large MSLB events in MODE 3. The Steam Generator Pressure-Low trip in this lower MODE is addressed in this LCO. The RPS Logic in MODES 1,2,3,4, and 5 is addressed in LCO 3.3.4, Reactor Protection System (RPS) Logic and Trip Initiation.

The applicability for the Logarithmic Power Level-High function is modified by a Note that allows the trip to be bypassed when logarithmic power is ) 1E-4X NRTP, and the bypass is automatically removed when logarithmic power is

< 1E-4X NRTP.

ACTIONS The most common causes of channel inoperability are outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific setpoint analysis. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the trip setpoint is less conservative than the Allowable Value stated in the LCO, the channel is declared inoperable immediately, and the appropriate Condition(s) must be entered immediately.

(continued)

PALO VERDE UNITS 1,2,3 8 3.3.2-7 REVISION 1

RPS Instrumentation Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.4 (continued)

REQUIREMENTS because of the difficulty of simulating a meaningful signal.

Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

SR 3.3.2.5 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response times are conducted on an 18 month STAGGERED TEST BASIS. This results in the interval between successive tests of a given channel of n x 18 months, where n is the number of channels in the Function. The 18 month Frequency is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. Response time testing may be performed at power on a single channel or during plant outages when the equipment is not required to be operable.

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated f'r by performing the daily calorimetric calibration (SR 3.3.1.4).

REFERENCES 1. 10 CFR 50.

2. 10 CFR 100.

3. UFSAR, Section 7.2.

4. "Calculation of Trip Setpoint Values Plant Protection System, CEN-286(v)", or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-15 REVISION 1

f W

~

0

ESFAS Instrumentation B 3.3.5 BASES LCO B ass Removal (continued)

This LCO requires four channels of operating bypass removal for Pressurizer Pressure-Low to be OPERABLE in MODES 1. 2 and 3.

Each of the four channels enables and disables the operating bypass capability for a single channel. Therefore, this LCO applies to the operating bypass removal feature only. If the bypass enable function is failed so as to prevent entering an operating bypass condition, operation may continue.

Because the trip setpoint has a floor value of 100 psia, a channel trip will result is decreased below this setpoint without if pressure bypassing.

The operating bypass removal Allowable Value was chosen because MSLB events originating from below this setpoint add less positive reactivity than that which can be compensated for by required SDM.

2. Containment S ra Actuation Si nal Containment Pressure Hi h Hi h This LCO requires four channels of Containment Pressure High High to be OPERABLE in MODES 1, 2.

and 3.

The Allowable Value for this trip is set high enough to allow for small pressure increases in containment expected during normal operation (i.e. plant heatup) and is not indicative of an abnormal condition. The setting is low enough to initiate CSAS in time to prevent containment pressure from exceeding design.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.5-12 REVISION 1

ESFAS Instrumentation 8 3.3.5 BASES ACTIONS The most common causes of channel inoperability are outright failure or drift of the bistable or process module sufficient'to exceed the tolerance allowed by the plant specific setpoint analysis. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. Determination of setpoint drift is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification.

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or ESFAS bistable is found inoperable, then all affected Functions provided by that channel must, be declared inoperable and the LCO Condition entered for the particular protection Function affected.

With a channel process measurement circuit that affects multiple functional units inoperable or in test, bypass or

,trip all associated functional units as listed below.

Process Measurement Circuit

1. Steam Generator Pressure-Low Steam Generator Pressure-Low Steam Generator Level 1-Low (ESF)

Steam Generator Level 2-Low (ESF)

2. Steam Generator Level Steam Generator Level-Low (RPS)

(Wide Range) Steam Generator Level 1-Low (ESF)

Steam Generator Level 2-Low (ESF)

With a Steam Generator Pressure Difference-High channel inoperable or in test, bypass or trip the associated Steam Generator Level-Low (ESF) function.

When the number of inoperable channels in a trip Function exceeds those specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be entered immediately, if applicable in the current NODE of operation.

A Note has been added to the ACTIONS. The Note has been added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Time for the inoperable channel of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.5-20 REVISION 1

ESFAS Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.2 (continued)

REQUIREMENTS The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

SR 3.3.5.3 CHANNEL CALIBRATION is a complete check of the instrument channel including the detector and the bypass removal functions. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive survei llances. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

The 18 month frequency is based on operating experience which has shown these components usually pass the Surveillance when performed on the 18 month Frequency. With proper precautions the channel calibration can be performed with the reactor at power.

SR 3.3.5.4 This Surveillance ensures that the train actuation response times are within the maximum values assumed in the safety analyses.

Response time testing acceptance criteria are included in Reference 8.

ESF RESPONSE TIME tests are conducted on a STAGGERED TEST BASIS of once every 18 months. The 18,month Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

(continued}

PALO VERDE UNITS 1,2.3 B 3.3.5-27 REVISION 1

u ESFAS Logic and Manual Trip 8 3.3.6 BASES SURVEILLANCE Tri Path (Initiation Lo ic) Tests (continued)

During the Matrix Logic and Initiation Logic test, power is applied to the Matrix relay test coils. The test coils revent an actuation during testing by preventing the atrix relay contacts in the Initiation Logic from changing state during the test. This does not affect the Operability of the Initiation Logic since only one of the six logic combinations that are available to trip the Initiation Logic are affected during the test because only one Matrix Logic combination can be tested at any time.

The remaining five matrix combinations available ensure that a trip in any three channels will de-energize all four Initiation paths.

t~ll Tl T t This test verifies that the manual trip handswitches are capable of opening contacts in the Actuation Logic as designed.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 2).

SR 3.3.6.2 Individual ESFAS subgroup relays must also be tested, one at a time, to verify the individual ESFAS components will actuate when required. Proper operation of the individual subgroup relays is verified by de-energizing these relays one at a time using an ARC mounted test ci rcuit. Proper operation of each component actuated by the individual relays is thus verified without the need to actuate the entire ESFAS function.

The 9 months Staggered Test Frequency is based on operating experience and ensures individual relay problems can be detected within this time frame. Considering the large number of similar relays in the ARC, and the similarity in their use, a large test sample can be assembled to verify the validity of this Frequency. The actual justification is based on CEN-403, "ESFAS Subgroup Relay Test Interval Extension (Ref. 3).

If two or more ESFAS subgroup relays fail per Unit in a 12-month period, an evaluation should be performed to determine the adequacy of the surveillance interval. The evaluation should consider the design, maintenance, and (continued)

PALO VEROE UNITS 1,2,3 8 3.3.6-21 REVISION 1

ESFAS Logic and Manual Trip B 3.3.6 BASES SURVEILLANCE SR 3.3.6.2 (continued)

REQUIREMENTS testing of all ESFAS subgroup relays. If it is determined that the surveillance interval is inadequate for detecting a single relay failure, the surveillance interval should be decreased. The revised surveillance interval should be such that an ESFAS subgroup relay failure can be detected prior to the occurrence of a second failure.

The above guidance for reevaluating ESFAS subgroup relay surveillance test intervals is based on the Safety Evaluation by the Office of Nuclear Reactor Regulation, "Review of CE Owners Group Topical Report CEN-403, Rev. 1,

'ESFAS Subgroup Relay Test Interval Extension'" (Ref. 4).

Some components cannot be tested at power since their actuation might lead to plant trip or equipment damage.

Reference 1 lists those relays exempt from testing at power, with an explanation of the reason for each exception. Relays not tested at power must be tested in accordance with the Note to this SR.

, REFERENCES 1. UFSAR, Section 7.3.

2. CEN-327, May 1986, including Supplement 1, March 1989, and Calculation 13-JC-SB-200.

3. CEN-403, "ESFAS Subgroup Relay Test Interval Extension, Revision 1".

4. Safety Evaluation by the Office of Nuclear Reactor Regulation, Review of CE Owners Group Topical Report CEN-403. Rev..l, "ESFAS Subgroup Relay Test Interval Extension", February 27. 1996.

PALO VERDE UNITS 1.2,3 B 3.3.6-22 REVISION 1

CPIAS B 3.3.8 BASES SURVEILLANCE SR 3.3.8.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred on the required radiation monitor channels used in the CPIAS.

A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus. it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel fai lure.

Since the probability of two random fai lures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.8.2 A CHANNEL FUNCTIONAL TEST is performed on each requi red containment radiation monitoring channel (RU-37 and RU-38) to ensure the entire channel will perform its intended function. The Frequency of 92 days is based on plant operating experience with regard to channel OPERABILITY and drift, which demonstrates that fai lure of more than one channel of a given Function in any 92 day Frequency is a rare event.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.8-6 REVISION 1

0 0

CREFAS B 3.3.9 BASES SURVEILLANCE SR 3.3.9.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel fai lure; thus. it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limit.

The Frequency, about once every shift. is based on operating experience that demonstrates the rarity of channel failure.

Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal. but more frequent. checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.9.2 A CHANNEL FUNCTIONAL TEST is performed on each required control room radiation monitoring channel (RU-29 and RU-30) to ensure the entire channel will perform its intended function.

The Frequency of 92 days is based on plant operating experience with regard to channel OPERABILITY and drift, which demonstrates that failure of more than one channel of a given Function in any 92 day interval is a rare event.

(continued)

PALO VEROE UNITS 1.2,3 B 3.3.9-5 REVISION 1

PAN Instrumentation B 3.3.10 BASES LCO Containment Area Radiation (hi h ran e)

(continued)

Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

The alarm setpoints shall be set within the limits specified in the UFSAR.

At PVNGS, Containment Area Radiation instrumentation consists of the following:

SOA-RU-148 SOB-RU-149

10. Containment H dro en Monitors Containment Hydrogen Monitors are provided to detect high hydrogen concentration conditions that represent a potential for containment breach. This variable is also important in verifying the adequacy of mitigating actions.

At PVNGS, Containment Hydrogen instrumentation consists of the following:

HPA-AI -9 HPB-AI -10 Pressurizer Level Pressurizer Level is used to determine whether to terminate Safety Injection (SI), if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer water level is also used to verify the plant conditions necessary to establish natural circulation in the RCS and to verify that the plant is maintained in a safe shutdown condition.

At PVNGS, Pressurizer Level instrumentation consists of the following:

RCA-LT-110X RCB-LT-110Y (continued)

PALO VERDE UNITS 1,2,3 B 3.3.10-10 REVISION 1

0 0

1$

n rl t

0

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE The transients analyzed for include loss of'oolant flow SAFETY ANALYSES events and dropped or stuck Control Element Assembly (CEA)

(continued) events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.7, "Regulating CEA Insertion Limits": LCO 3.1.8, "Part Length CEA Insertion Limits"; LCO 3.2.3, "AZIMUTHAL POWER TILT (Tq)"; and LCO 3.2.5, "AXIAL SHAPE INDEX (ASI).

The safety analyses are performed over the following range of initial values: RCS pressure 2100-2325 psia, core inlet temperature 548-572'F, and reactor vessel inlet coolant flow rate > 95K.

The RCS DNB limits sati sfy Criterion 2 of 10 CFR 50.56(c)(2)(ii).

LCO This LCO specifies limits on the monitored process variables 'RCS pressurizer pressure, RCS cold leg temperature, and RCS total flow rate to ensure that the core operates within the limits assumed for the plant safety analyses. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient.

The LCO numerical value for minimum flow rate is given for the measurement location but has not been adjusted for instrument error. Plant specific limits of instrument error are established by the plant staff to meet the operational requirements of minimum flow rate.

APPLICABILITY In MODE 1 for RCS flow rate, MODES 1 and 2 for RCS pressurizer pressure, Mode 1 for RCS cold leg temperature.

and MODE 2 with K,<< > 1 for RCS cold leg temperature, the limits must be maintained during steady state operation in order to ensure that DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. In all other MODES, the power level is low enough so that DNBR is not a concern.

(continued)

PALO VERDE UNITS 1.2,3 B 3.4.1-2 REVISION 1

0' RCS Minimum Temperature for Criticality 8 3.4.2 BASES (continued)

APPLICABILITY The reactor has been designed and analyzed to be critical in MODES 1 and 2 only and in accordance with this specification. Criticality is not permitted in any other MODE. Therefore, this LCO is applicable in MODE 1, and MODE 2 when K,<< > 1.0. Monitoring is required at or below a T>, of 550'F. The no load temperature of 565'F is maintained by the Steam Bypass Control System.

ACTIONS A. 1 If T>< is below 545'F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 30 minutes.

Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time reflects the ability to perform this action and to maintain the plant within the analyzed range.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS T is required to be verified > 545'F once within 30 minutes after any RCS loop T>, < 550'F and every 30 minutes thereafter . The 30 minute time period is frequent enough to prevent inadvertent violation of the LCO.

A Note states the Surveillance is required whenever the reactor is critical and temperature is below 550'F. A second Frequency requi res T>, to be verified within 30 minutes of reaching criticality. This will require repeated erformance of SR 3.4.2. 1 since a reactor startup takes onger than 30 minutes. The 30 minute time period is frequent enough to prevent inadvertent violation of the LCO.

REFERENCES 1. UFSAR ~ Secti on 15.

PALO VERDE UNITS 1.2,3 B 3.4.2-2 REVISION 1

RCS Loops MODE 4 8 3.4.6 BASES LCO Note 3 restricts RCP operation to no more than 2 RCPs with (continued) RCS cold leg temperature < 200'F, and no more than 3 RCPs with RCS cold leg temperature >200'F but ~ 500'F.

Satisfying these conditions will maintain the analysis assumptions of the flow induced pressure correction factors due to RCP operation (Ref. 1)

An OPERABLE RCS loop consists of at least one OPERABLE RCP and an SG that is OPERABLE in accordance with the Steam Generator Tube Surveillance Program and has the minimum water level specified in SR 3.4.6.2.

Similarly, for the SDC System, an OPERABLE SDC train is composed of an OPERABLE SDC pump (CS or LPSI) capable of providing flow to the SDC heat exchanger for heat removal.

RCPs and SDC pumps are OPERABLE if they are capable of being powered and are able to provide flow, if requi red.

APPLICABILITY In MODE 4, this LCO applies because it is possible to remove core decay heat and to provide proper boron mixing with either the RCS loops and SGs or the SDC System.

Operation in other MODES is covered by:

LCO 3.4.4 "RCS Loops-MODES 1 and 2";

LCO 3.4.5. "RCS Loops MODE 3":

LCO 3.4.7, "RCS Loops MODE 5, Loops Filled":

LCO 3.4.8, "RCS Loops MODE 5. Loops Not Filled";

LCO 3.9.4. "Shutdown Cooling (SDC) and Coolant Circulation High Water Level" (MODE 6); and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation Low Water Level" (MODE 6).

ACTIONS A.l If only one requi red RCS loop is OPERABLE and in operation.

redundancy for heat removal is lost. Action must be initiated imnediately to restore a second loop to OPERABLE status. The iranediate Completion Time reflects the importance of maintaining the availability of two paths for decay heat removal.

(continued)

PALO VERDE UNITS 1,2,3 8 3.4.6-3 REVISION 1

RCS Loops MODE 5, Loops Not Filled B 3.4.8 BASES ACTIONS B.1 and B.2 (continued)

If no SDC train is OPERABLE or in operation, except as provided in NOTE 1, all operations involving the reduction of RCS boron concentration must be suspended. Action to restore one SDC train to OPERABLE status and operation must be initiated immediately. Boron dilution requires forced circulation for proper mixing and the margin to criticality must not be reduced in this type of operation. The iranediate Completion Time reflects the importance of maintaining operation for decay heat removal.

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requi res verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that one SDC train is in operation and circulating reactor coolant at a flow rate of greater than or equal to 3780 gpm.

Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing decay heat removal. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency has been shown by operating practice to be sufficient to regularly assess degradation and verify operation is within safety analyses assumptions.

SR 3.4.8.2 Verification that the required number of trains are OPERABLE ensures that redundant paths for heat removal are available and that an additional train can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and indicated power available to the required pumps. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

REFERENCES None.

PALO VERDE UNITS 1.2,3 B 3.4.8-3 REVISION 1

Pressurizer B 3.4.9 BASES APPLICABLE Although the heaters are not specifically used in accident SAFETY ANALYSES analysis, the need to maintain subcooling in the long term (continued) during loss of offsite power, as indicated in NUREG-0737 (Ref. 1), is the reason f'r their inclusion. The requirement for emergency power supplies is based on NUREG-0737 (Ref. 1). The intent is to keep the reactor coolant in a subcooled condition with natural circulation at hot, high pressure conditions for an undefined. but extended, time period after a loss of offsite power. While loss of offsite power is a coincident occurrence assumed in the accident analyses, maintaining hot, high pressure conditions over an" extended time period is not evaluated in the accident analyses. The pressurizer satisfies Criterion 2 and Criterion 3 of 10 CFR 50.36(c)(2)(ii ).

LCO The LCO requirement for the pressurizer to be OPERABLE with water level a 27K indicated level (425 cubic feet) and < 56K indicated level (948 cubic feet) ensures that a steam bubble.

exists. Limiting the maximum operating water level reserves the steam space for pressure control. The LCO has een established to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.

The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity > 125 kW and capable of being powered from an emergency power supply. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide subcooling margin to saturation can be obtained in the loops.

AP PL I CAB IL ITY The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, Applicability has been designated for MODES 1 and 2. The Applicability is also provided for MODE 3. It is assumed pressurizer level is under steady state conditions. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises. caused by normal operational (continued)

PALO VERDE UNITS 1.2,3 B 3.4.9-3 REVISION 1

Pressurizer Safety Valves-MODE 4 B 3.4.11 BASES BACKGROUND Pressurizer Safet Valve Re uirements (continued)

The pressurizer code safety valves operate to prevent the RCS from being pressurized above its Safety Limit (SL) of 2750 psia. Each safety valve is designed to relieve a minimum of 460,000 lb per hour of saturated steam at valve setpoint. The relief capacity of a single safety valve is adequate to relieve any overpressure condition which could occur during shutdown above LTOP System temperatures.

Shutdown Coolin S stem Suction Line Relief Valve A single Shutdown Cooling System suction line relief valve provides overpressure relief capability and will prevent RCS overpressurization in the event that no pressurizer safety valves are OPERABLE.

APPLICABLE All accident analyses in the UFSAR that require safety valve SAFETY ANALYSES actuation assume operation of four pressurizer safety valves to limit increasing reactor coolant pressure. The overpressure protection analysis is also based on operation of four safety valves and assumes that the valves open at the high range of the setting (2475 psia + 3X). These valves must accommodate pressurizer insurges that could occur during a startup, rod withdrawal, ejected rod, loss of main feedwater, or main feedwater line break accident. The Loss of Load with Delayed Reactor Trip accident establishes the minimum safety valve capacity. The Loss of Load with Delayed Reactor Trip accident is assumed to occur at 100K power. Single failure of a safety valve is neither assumed in the accident analysis nor requi red to be addressed by the ASME Code. Compliance with this specification is requi red to ensure that the accident analysis and design basis calculations remain valid.

The pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.11-2 REVISION 1

Pressurizer Vents B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4. 12 Pressurizer Vents BASES BACKGROUND The pressurizer vent is part of the reactor coolant gas vent system (RCGVS) as described in UFSAR 18. II.B.1 (Ref. 1). The pressurizer can be vented remotely from the control room through the following four paths (see UFSAR Figure 18. II.B-1):

1. From the pressurizer vent through SOV HV-103, then through SOV HV-105 to the reactor drain tank (RDT).

From the pressurizer vent through SOV HV-103, then through SOV HV-106 directly to the containment atmosphere.

From the pressurizer vent through SOVs HV-108 and HV-109, then through SOV HV-105 to the reactor drain tank (RDT).

4. From the pressurizer vent through SOVs HV-108 and HV-109, then through SOV HV-106 directly to the containment atmosphere.

The RCGVS also includes the reactor head vent, which can be used along with the pressurizer vent to remotely vent gases that could inhibit natural circulation core cooling during post accident situations. However, this function does not meet the criteria of 10 CFR 50.36(c)(2)(ii ) to require a Technical Specification LCO, and therefore the reactor head vent is not included in these Technical Specifications.

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.12-1, REVISION 1

Pressurizer Vents B 3.4.12 BASES APPLICABLE The requirement for pressurizer path vent path to be SAFETY ANALYSES OPERABLE is ba'sed on the steam generator tube rupture (SGTR) with loss of offsite power (LOP) and a single fai lure safety analysis. as described in UFSAR 15.6.3 (Ref. 4). It is assumed that the auxiliary pressurizer spray system (APSS) is not available for this event. Instead. RCS depressurization is performed, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after the initial SGTR, by venting the RCS via a pressurizer vent path and throttling HPSI flow. The analysis also incorporates an additional failure by assuming that only the smallest of the four available pressurizer vent paths is used. This is identified as the orificed flow path to the RDT.

The results of the analysis for steam generator tube rupture with a loss of offsite power and a fully stuck open ADV using the pressurizer vent system, forwarded to the NRC in Reference 3, states that the analysis assumes that the APSS is inoperable and the pressurizer gas vent system performs the functions of RCS depressurization. The staff has reviewed and accepted the results of the analysis and the design of the pressurizer gas vent system. The staff's detailed evaluation has been reported in Supplement No. 9 to PVNGS SER (Ref. 2).

The pressurizer vent paths satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The LCO requi res four pressurizer vent paths be OPERABLE.

The four vent paths are:

1. From the pressurizer vent through SOV HV-103, then through SOV HV-105 to the reactor drain tank (RDT).

2. From the pressurizer vent through SOV HV-103 'hen through SOV HV-106 directly to the containment atmosphere.

3. From the pressurizer vent through SOVs HV-108 and HV-109 'hen through SOV HV-105 to the reactor drain tank (RDT).

4. From the pressurizer vent through SOVs HV-108 and

'V-109. then through SOV HV-106 directly to the containment atmosphere.

(continued)

PALO VERDE UNITS 1,2,3 B 3.4.12-2 REVISION 1

~ '

LTOP System B 3.4.13 BASES BACKGROUND Shutdown Coolin S stem Suction Line Relief Valve (continued)

When a Shutdown Cooling System suction line relief valve lifts due to an increasing pressure transient, the release of coolant causes the pressure increase to slow and reverse.

As the Shutdown Cooling System suction line relief valve releases coolant, the system pressure decreases until valve reseat pressure is reached and the Shutdown Cooling system suction line relief valve closes.

At low temperatures with the Shutdown Cooling System suction line relief valves aligned to the RCS, it is necessary to restrict heatup and cooldown rates to assure that P-T limits are not exceeded. These P-T limits are usually applicable to a finite time period such as one cycle, 5 EFPY, etc. and are based upon i rradiation damage prediction by the end of the period. Accordingly, each time P-T limits change. the LTOP System needs to be reanalyzed and modified, if necessary, to continue its function.

Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS at containment ambient pressure in an RCS overpressure transient, if the relieving requi rements of the transient do not exceed .the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

For an RCS vent to meet the specified flow capacity, it requi res removing all pressurizer safety valves, or similarly establishing a vent by opening the pressurizer manway (Ref. 11). The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

(continued)

PALO VERDE UNITS 1.2.3 8 3.4.13-3 REVISION 1

SITs-Operating B 3.5.1 BASES ACTIONS A.l If the boron concentration of one SIT is not within limits, the SIT must be return'ed to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

If the boron concentration is not within limits, ability to maintain subcriticality or minimum boron precipitation time may be reduced, but the reduced concentration effects on core subcriticality during ref lood are minor. Boiling of the ECCS water in the core during ref lood concentrates the boron in the saturated liquid that remains in the core. In addition, the volume oi the SIT is still available for injection. Since the boron requirements are based on the average boron concentration of the total volume of three SITs. the consequences are less severe than they would be if a SIT were not available for injection. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

If one SIT is inoperable due to the inability to verify level or pressure, the SIT must be returned to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Section 7.4 of NUREG-1366 (Ref. 5) discusses surveillance requirements in technical specifications for the instrument channels used in the measurement of water level and pressure in SITs. The following statement is made in Section 7.4 of'UREG-1366 (Ref. 5):

"The combination of redundant level and pressure instrumentation [for any single SIT] may provide sufficient information so that it may not be worthwhile to always attempt to correct drift associated with one instrument (with resulting radiation exposures during entry into containment] if there were sufficient, time to repair one in the event that a second one became inoperable. Because these instruments do not initiate a safety action, it is reasonable to extend the allowable outage for them.

The [NRC] staff, therefore, recoranends that an additional condition be established for the specific case, where 'One accumulator [SIT] is inoperable due to the inoperability of water level and pressure channels,'n which the completion time to restore the accumulator to operable status will be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

While technically inoperable, the accumulator would be available to fulfill its safety function during this time and, thus, this change would have a negligible increase in risk."

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.1-7 REVISION 1

SITs-Operating B 3.5.1 BASES ACTIONS B.l If one SIT is inoperable for a. reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.

CE NPSD-994 (Ref. 6) provides a series of deterministic and probabi listic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 (Ref. 6) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or of one high pressure safety injection (HPSI) pump the'peration and a single SIT. CE NPSD-994 (Ref. 6) also discusses plant-specific probabi listic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to sh'orter recovery periods.

ACTIONS C.l and C.2 If the SIT cannot be restored to OPERABLE status within the associated, Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to ( 1837 psia within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Specification 3.5.2, "SITs - Shutdown", further requires the plant to be in Mode 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the SIT while in the inoperability was discovered but not restored applicability of Specification 3.5. 1, "SITs - Operating".

D.1 If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.1-8 REVISION 1

SITs-Operating 8 3.5.1 BASES (continued)

SURVEILLANCE SR 3.5.1.5 REQUIREMENTS (continued) Verification every 31 days that power is removed from each SIT isolation valve operator ensures that an active failure could not result in the undetected closure of a SIT motor operated isolation valve. If this were to occur, only two SITs would be available for injection, given a single failure coincident with a LOCA. Since installation and removal of power to the SIT isolation valve operators is conducted under administrative control, the 31 day Frequency was chosen to provide additional assurance that power is removed.

SR 3.5.2.5 allows power to be supplied to the motor operated isolation valves when RCS pressure is ( 1500 psia, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA.

REFERENCES 1. IEEE Standard 279-1971.

2. UFSAR, Section 6.

3. 10 CFR 50.46.

4. UFSAR. Chapter 15.

5. NUREG-1366, "Improvements to Technical Specifications Survei 1 lance Requirements, " December 1992.

6. CE NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," Hay 1995.

PALO VERDE UNITS 1.2.3 8 3.5.1-10 REVISION 1

0 SITs Shutdown 8 3.5.2 BASES ACTIONS A. 1 (continued)

If one of the required SITs is inoperable due to the inability to verify level or pressure, the SIT must be returned to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Section ?.4 of NUREG-1366 (Ref. 4) discusses surveillance requi rements in technical specifications for the instrument channels used in the measurement of water level and pressure in SITs. The following statement is made in Section 7.4 of NUREG-1366 (Ref. 4):

"The combination of redundant level and pressure instrumentation [for any single SIT] may provide sufficient information so that it may not be worthwhile to always attempt to correct drift associated with one instrument (with resulting radiation exposures during entry into containment3 if there were sufficient time to repair one in the event that a second one became inoperable. Because these instruments do not initiate a safety action, it is reasonable to extend the allowable outage for them.

The 5NRC] staff. therefore, recommends that an additional condition be established for the specific case. ~here 'One accumulator [SITj is inoperable due to the inoperability of water level and pressure channels,'n which the completion time to restore the accumulator to operable status wi 11 be 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

While technically inoperable, the accumulator would be available to fulfill its safety function during this time and, thus, this change would have a negligible increase in risk."

(continued)

PALO VERDE UNITS 1.2,3 B 3.5.2-7 REVISION 1

SITs Shutdown B 3.5.2 BASES ACTIONS B.l If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.

CE NPSD-994 (Ref. 5) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either

'risk beneficial" or "risk neutral" in comparison to shorter eriods for restoring the SIT to OPERABLE status. CE PSD-994 (Ref. 5) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or the operation of one high pressure safety injection (HPSI) pump and a single SIT. CE NPSD-994 (Ref. 5) also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods.

C.1 If the inoperability of the required SIT was discovered but not restored while the plant was within the applicability of specification 3.5. 1, "SITs - Operating", the plant must be brought to a MODE in which the LCO does not apply. The time allowed for restoration in specification 3.5.2 is adequate and may not be duplicated, for the same condition. when in specification 3.5.2, "SITs - Shutdown".

If the required SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Time is reasonable, based on operating experience, ho reach the required plant conditions in an orderly manner and without challenging plant systems.

D.l If more than one of the required SITs is inoperable, the unit is in a condition outside the accident analyses.

Therefore, LCO 3.0.3 must be entered immediately.

(continued)

PALO VERDE UNITS 1,2 ' B 3.5.2-8 REVISION 1

II e

SITs Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2. 1 REQUIREMENTS Verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each required SIT isolation valve is fully open when pressurizer pressure is ) 430 psia as indicated in the control room, ensures that the required SITs are 'available for injection and ensures timely discovery if a valve should be partially closed. If a required isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve should not change position with power removed' closed valve could result in not meeting accident analysis assumptions. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of other administrative controls that ensure the unlikelihood of a mispositioned isolation valve.

SR 3.5.2.2 and SR 3.5.2.3 Borated water volume and nitrogen cover pressure for the required SITs should be verified to be within specified limits every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months in order to ensure adequate injection during a LOCA. Due to the static design of the SITs, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the operator sufficient time to identify changes before the limits are reached.

Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.

SR 3.5.2.4 Thirty-one days is reasonable for verification to determine that each required SIT's boron concentration is within the required limits, because the static design of the SITs limits the ways in which the concentration can be changed.

The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Verification of boron concentration by performing a calculation based on level increase, RCS boron concentration, and last sample results; or sampling the affected SIT within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months whenever a SIT is drained to maintain contained borated water level will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water is from the RMT.

(continued)

PALO VEROE UNITS 1.2,3 8 3.5.2-9 REVISION 1

t 0

SITs Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 (continued)

REQUIREMENTS because the water contained in the RWT is within the SIT boron concentration requirements. This is consistent with the recommendations of NUREG-1366 (Ref. 4).

SR 3.5.2.5 Verification every 31 days that power is removed from each required SIT isolation valve operator when the pressurizer pressure is ) 1500 psia ensures that an active failure could not result in the undetected closure of a SIT motor operated isolation valve. If this were to occur, two less than the required SITs would be available for injection, given a single failure coincident with a LOCA.

Since installation and removal of power to the SIT isolation valve operators is conducted under administrative control, the 31 day Frequency was chosen to provide additional assurance that power is removed.

This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 1500 psia, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns. Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves. Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA.

REFERENCES 1. IEEE Standard 279-1971.

2. 10 CFR 50.46.

3. UFSAR, Chapter 15.

4. NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements," December 1992.

5. CE NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOT/STI Extension," Hay 1995.

PALO VERDE UNITS 1.2,3 8 3.5.2-10 REVISION 1

0 0

ECCS - Operating 8 3.5.3 BASES ACTIONS A.l With one LPSI subsystem inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, the remaining OPERABLE ECCS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure to the remaining LPSI subsystem could result in loss of ECCS function. The Completion Time is reasonable to perform corrective maintenance on the inoperable LPSI subsystem.

B.l If one or more trains are inoperable, except for reasons other than Condition A (one LPSI inoperable) and at least 100K of the ECCS flow equivalent to a single OPERABLE ECCS train is available. the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC study (Ref. 4) using a reliability evaluation and is a reasonable amount of time to effect many repairs.

An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS. The individual components are inoperable if they are not capable of performing their design function, or are not available.

if supporting systems The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS.. The intent of this Condition is to maintain a combination of OPERABLE equipment such that 100K of the ECCS flow equivalent to 100K of a single OPERABLE train remains available. This allows increased flexibility in plant operations when components in opposite trains are inoperable.

(continued)

PALO VERDE UNITS 1.2,3 8 3.5.3-6 REVISION 1

ECCS - Operating B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 REQUIREMENTS Verifying the correct alignment for manual. power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked. sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This Surveillance, does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position.

The 31 day Frequency is appropriate because the valves are operated under procedural control and an improper valve osition would only affect a single train. This Frequency as been shown to be acceptable through operating experience.

SR 3.5.3.2 With the exception of systems in operation, the ECCS pumps are normally in a standby, nonoperating mode. As such, flow path piping has the potential to develop voids and pockets of entrained gases. The method of ensuring that any "voids or pockets of gases are removed from the ECCS piping is to vent the accessible discharge piping high points, which is controlled by PVNGS procedures. Maintaining the piping from the ECCS pumps to the RCS full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of noncondensible gas (e.g. air, nitrogen, or hydrogen) into the reactor vessel

~

following an SIAS or during SDC. The 31 day Frequency takes into consideration the gradual nature of gas'ccumulation in the ECCS piping and the adequacy of the procedural controls governing system operation.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.3-8 REVISION 1

ECCS - Operating B 3.5.3 BASES SURVEILLANCE SR 3.5.3.7 REQUIREMENTS (continued) Realignment of valves in the flow path on an SIAS is necessary for proper ECCS performance. The safety injection valves have stops to position them properly so that flow is restricted to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The 18 month Frequency is based on current industry practice.

These valves are also monitored in accordance with the requi rements of 10 CFR 50.65 (Ref. 5).

SR 3.5.3.8 Periodic inspection of the containment sump ensures that is unrestricted and stays in proper operating condition.

it The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during an outage, on the need to have access to the location, and on the potential for unplanned transients if the Surveillance were performed with the reactor at power. This Frequency is sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 35.

2. 10 CFR 50.46.

3. UFSAR, Chapter 6.

4. NRC Memorandum to V. Stello, Jr., from R. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December l. 1975.

5. 10 CFR 50.65.

\

PALO VERDE UNITS 1,2.3 8 3.5.3-10 REVISION 1

TSP B 3.5.6 BASES BACKGROUND Adjusting the.pH of the recirculation solution to levels at (continued) or above 7.0 prevents a significant fraction of the dissolved iodine from converting to a volatile form. The higher pH thus decreases the level of airborne iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA.

Maintaining the solution pH at or above 7.0 also reduces the occurrence of SCC of austenitic stainless steel components in containment. Reducing SCC reduces the probability of failure of components.

Granular anhydrous TSP is employed as a passive form of pH control for post LOCA containment spray and core cooling water. Baskets of TSP are placed on the floor of the containment building to dissolve from released reactor coolant water and containment sprays after a LOCA.

Recirculation of the water for core cooling and containment sprays then provides mixing to achieve a uniform solution pH.

APPLICABLE The LOCA radiological consequences analysis takes credit for SAFETY ANALYSES iodine retention in the sump solution based on the t

recirculation water pH being 7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased recirculation water if the pH of the were not adjusted to 7.0 or above.

LCO The TSP is required to adjust the pH of'he recirculation water to > 7.0 after a LOCA. A pH > ?.0 is necessary to prevent significant amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile form and evolving into the containment atmosphere. Higher levels of airborne iodine in containment may increase the release of radionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SCC increases the probability of failure of components.

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.6-2 REVISION 1

TSP B 3.5.6 ACTIONS B.l and B.2 (continued)

If the TSP cannot be restored within limits within the Completion Time of Required Action A.1. the plant must be brought to a NODE in which the LCO does not apply. The specified Completion Times for reaching NODES 3 and 4 are those used throughout the Technical Specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.5.6.1 REQUIREMENTS Periodic determination of the volume of TSP in containment must be performed due to the possibility of leaking valves and components in the containment building that could cause dissolution of the TSP during normal operation. A Frequency of 18 months is required to determine visually that a minimum of 524 cubic feet is contained in the TSP baskets (Ref. 1). This requirement ensures that there is an adequate volume of TSP to adjust the pH of the post LOCA sump solution to a value > 7.0.

The periodic verification is required every 18 months, since access to the TSP baskets is only feasible during outages.

and normal fuel cycles are scheduled for 18 months.

Operating experience has shown this Surveillance Frequency acceptable due to the margin in the volume of TSP placed in the containment building, SR 3.5.6.2 Testing must be performed to ensure the solubility and buffering ability of the TSP after exposure to the containment environment. A representative sample of 3.5 grams + 0.005 grams of anhydrous TSP (corrected for moisture content) from one of the baskets in containment is submerged in 1.0 liters + 0.005 liters of 2.5 wtX boric acid solution (nominally at 4400 ppm) at 135'F + 9'F.

Without agitation, the solution pH as measured at 77'F + 9'F should be raised to > 7 within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The representative sample weight is based on the minimum required TSP weight of 25,325 pounds which at installed density corresponds to the minimum volume of 524 cubic ft.'continued)

PALO VERDE UNITS 1,2,3 B 3.5.6-4 REVISION 1

0 Containment Isolation Valves 8 3.6.3 BASES APPLICABLE SAFETY ANALYSES The containment isolation valves satisfy Criterion 3 of (continued) 10 CFR 50.36 (c)(2)(l>).

LCO Containment isolation valves form a part of the containment boundary. The containment isolation valve safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate on an automatic isolation, signal. The refueling purge valves must be maintained sealed closed. The valves covered by this LCO are listed with their associated stroke times in the UFSAR (Ref. 1).

The normally closed isolation valves are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, blind flanges are in place, and closed systems are intact. These passive isolation valves or devices are those listed in Reference 2. ESF actuated valves are considered OPERABLE when locked, sealed, or otherwise prevented from unintended operation, in their actuated position.

Containment Isolation Valves (CIVs) required open during accident conditions are considered "dual function" valves and may be secured in the closed position to conservatively comply with LCO 3.6.3. However, a closed CIV would result in entry into the applicable system LCO.

Alternatively, some "dual function" CIVs may be administratively controlled in the open position (to prevent unintentional operation) to comply with both LCO 3.6.3 and the associated system LCO. When placed in the OPEN position and OPERABLE pursuant to LCO 3.6.3, the control room's ability to remote-manually close the valve for containment isolation must be maintained (i.e., actuating and control power must be retained). The administrative controls prevent a valve from unintentional operation. This position ensures compliance with containment isolation functions specified by General Design Criteria 54 through 57. The valve is INOPERABLE and entry into the applicable action statement of LCO 3.6.3 will be required until the administrative controls (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-4 REVISION I

0, Containment Isolation Valves 8 3.6.3 BASES h

LCO are in place. If', for any reason, a CIV is placed in the (continued) administratively controlled OPEN position to remain OPERABLE pursuant to LCO 3.6.3. the cause of the condition will be identified and corrected at the earliest opportunity.

While the remaining "dual function" CIVs have system limitations which preclude placing them in the open position, the following valves are subject to being placed in the OPEN position and remaining OPERABLE pursuant to LCO 3.6.3 with administrative controls to prevent unintentional operation and retain the control room's remote-manual closure capability:

Containment Hydrogen Monitoring CIVs: HPA-HV-007A, HPA-HV-0078, HPB-HV-OOSA, and HPB-HV-008B

HPSI Injection Valves: SIB-UV-616, SIA-UV-617, SIB-UV-626, SIA-UV-627. SIB-UV-636, SIA-UV-637, SIB-UV-646, and S IA-UV-647

LPSI Flow Control Valves: SIB-UV-615. SIB-UV-625, SIA-UV-635, and SIA-UV-645

RCP Seal Injection Isolation Valve: CHB-HV-255 The following valves are normally OPEN and considered OPERABLE pursuant to LCO 3.6.3 with no additional actions required (i.e. Control Room remote-manual closure capability need not be maintained):

Containment Pressure Monitoring CIVs: HCA-HV-074.

HCB-HV-075, HCC-HV-076, and HCD-HV-077

Normal Charging Line Isolation Valve: CHA-HV-524 When a CIV required OPEN during accident conditions becomes INOPERABLE. and there is only one CIV in the penetration, and plant and/or equipment conditions do not support securing the CIV in the closed position to restore operability per LCO 3.6.3, an alternate valve (including a non-automatic, non-manual valve) in the piping connected to the affected penetration may be used as an isolation valve to satisfy the requirement of LCO 3.6.3. The alternate valve must be secured in the closed position and prevented from unintentional operation (via PVNGS administrative controls such as the locked valve or clearance and tagging program or (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-5 REVISION 1

Containment Isolation Valves 8 3.6.3 BASES LCO the removal of motive power. as appropriate) and any

~

(continued) vent/drain valve and test connection within the new boundary must be closed and capped. To ensure penetration integrity, it is only allowable to use an alternate valve as the isolation valve in the affected penetration if the piping between the INOPERABLE CIV and the valve used for penetration isolation. have both of the following characteristics:

A pressure rating equivalent to the containment design pressure (i.e., 60 psig) AND

The INOPERABLE CIV does not require Type "C" testing (reference the list of CIVs in the Technical Requirements Manual).

Check valves which function as CIVs are considered secured in their actuated position when flow through the valve is secured and prevented from unintentional operation (i .e., all upstream flow paths are isolated and administratively controlled),

Manual containment isolation valves include those specified in TRM Table 7.0.300 and all vents, drains, and test connections located within a containment penetration.

Manual containment isolation valves may be opened intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Manual vent, drain and test connection valves within a penetration may be opened under admi nistrative control on only one side of the containment wall. The opening of a manual vent, drain and test connection valve on both sides of the containment wall provides a di rect bypass of the containment barrier and would necessitate declaring the penetration INOPERABLE.

For inoperable Appendix R credited valves secured in the closed position. actions must be taken per PVNGS Administrative Controls to ensure time limitations are not exceeded.

Purge valves with resilient seals must meet additional leakage rate requirements. The other containment isolation valve leakage rates are addressed by LCO 3.6. l.

"Containment," as Type C testing.

(continued)

PALO VERDE UNITS 1,2,3 8 3.6.3-6 REVISION 1

Containment Isolation Valves B 3.6.3 BASES (continued)

LCO Each containment isolation valve shall be demonstrated (continued) OPERABLE prior to returning the valve to service after maintenance, repair, or repl'acement work is performed on the valve or its associated actuator. control. or power circuit.

This LCO provides assurance that the containment isolation valves and purge valves wi 11 perform their designed safety functions to msnimize the loss of reactor coolant inventory and establish the containment boundary during accidents.

APPLICABILITY In HODES 1, 2. 3, and 4, a DBA could cause a release of radioactive material to containment. In HODES 5 and 6, the robabi lity and consequences of these events are reduced due o the pressure and temperature limitations of these HODES.

Therefore. the containment isolation valves are not required to be OPERABLE in HODE 5. The requi rements for containment isolation valves during HODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths, except for 42 inch purge valve penetration flow paths, to be unisolated intermittently under administrative controls. This allowance also applies to the operation of manual vents, drains, and test connections, including those within the 42" purge valve penetrations (i.e. only tlie 42" purge valves themselves are excluded). Hanua'I vent, drain and test connection valves within a penetration may be opened under administrative control on only one side of the containment wall. The opening of a manual vent, drain and test connection valve on both sides of the containment wall provides a direct bypass of the containment barrier and would necessitate entry into the appropriate ACTION for the INOPERABLE penetration. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.

Due to the size of the containment refueling purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the envi ronment.

these valves may not be opened under administrative controls.

A second Note has been added to provide clarification that, for this LCO, separate Condition entry is allowed for each enetration flow path. This is acceptable. since the equired Actions for each Condition provide appropriate compensatory actions for each inoperable containment (continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-7 REVISION 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS isolation valve. Complying with the Required Actions may (continued) allow for continued operation; and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are further modified by a third Note, which ensures that appropriate remedial actions are taken, necessary, if if the affected systems are rendered inoperable by an inoperable containment isolation valve.

A fourth Note has been added that requires entry into the applicable Conditions and Required Actions of LCO 3.6.1 when leakage results in exceeding the overall containment leakage l imi t.

A.l and A.2 I n the event one containment isolation valve in one or more enetration flow paths is inoperable except for purge valve eakage not within limit (refer to Action D), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active fai lure. Isolation barriers that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. Compliance with this Action is established via: 1) Administrative controls (i.e. clearance) on the de-activated automatic containment isolation valve, closed manual valve, blind flange, or check valve, and 2) Administrative controls (i .e. clearance or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located within the containment enetration. Instruments (i.e. flow/pressure transmitters) ocated within the penetration that are not removed from

'ervice for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requi rements of this Action. For penetrations isolated in accordance with Required Action A. 1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion (continued)

PALO VERDE UNITS 1,2,3 8 3.6.3-8 REVISION 1

l t

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated i n accordance with Required Action A. 1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and,no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment. the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibi1 i ty.

Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides appropriate actions.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-9 REVISION 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS B.l (continued)

With two containment isolation valves in one or more enetration flow paths inoperable except for purge valve eakage not within limit (refer to Action D), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve. and a blind flange. Compliance with this Action is established via: 1) Administrative controls (i.e. clearance) on the de-activated automatic containment isolation valve. closed manual valve, or blind flange, and

2) Administrative controls (i.e. clearance or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located within the containment penetration.

Instruments (i.e. flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action .

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6. 1. In the event the affected penetration is isolated in accordance with Required Action B. 1, the affected enetration must be verified to be isolated on a periodic asis per Required Action A.2,'which remains in effect . This periodic verification is necessary to assure leak tightness of containment and that penetrations requi ring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under administrative controls and the probability of thei r misalignment is low.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

(continued)

PALO VERDE UNITS 1.2.3 B 3.6.3-10 REVISION 1

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.l and C.2 (continued)

With one or more penetration-flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. Compliance with this Action is established via: 1) Administrative controls (i.e. clearance) on the de-activated automatic containment isolation valve, closed manual valve, or blind flange and 2) Administrative controls (i.e. clearance or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located within the containment penetration. Instruments (i.e. flow/pressure transmitters) located within the penetration that are not removed from service f'r maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, iso'tation valves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. A check valve may not be used to isolate the affected penetration. Required Action C. 1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C. 1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to assure leak tightness of'ontainment and that containment penetrations requi ring isolation following an accident are isolated. The Completion Time of once per 31 days for

,verifying that each affected penetration flow path is isolated is appropriate considering the valves are operated under administrative controls and the probability of their misalignment is low.

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. This Note is necessary since this Condition is (continued)

PALO VERDE UNITS 1.2,3 B 3.6.3-11 REVISION 1

l 0

Containment Isolation Valves 8 3.6.3 BASES ACTIONS C. 1 and C.2 (continued) written to specifically address those penetration flow paths which are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere (10 CFR 150, APP. A, GDC 57).

Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and

'allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.

D. l. D.2. and D.3 In the event one or more containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits, or the affected penetration must be isolated.

The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active fai lure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve with resi lient seals, or a blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.l must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. Compliance with this Action is established via:

1) Administrative controls (i.e. clearance) on the de-activated automatic containment isolation valve with resilient seals or blind flange, and 2) Administrative controls (i .e. clearance or Locked Valve/Breaker/Component Control lock) on vents, drains; and test connections located within the containment penetration. Instruments (i .e.

flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not, be isolated nor otherwise administratively controlled to comply with the, requirements of this Action. The specified Completion Time is reasonable, considering that one containment purge valve remains closed so that a gross breach of containment does not exist.

(continued)

PALO VERDE UNITS 1,2,3 8 3.6.3-12 REVISION 1

0 Containment Isolation Valves 8 3.6.3 BASES ACTIONS D. 1, D.2 and D.3 (continued)

In accordance with Required Action D.2, this penetration flow ath must be verified to be isolated on a periodic basis.

he periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be ln the isolation position should an event.

occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment capable of being mispositioned,are in the correct position.

For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of

, the inaccessibility of the isolation devices and other administrative controls that wi 11 ensure that isolation device misalignment is an unlikely possibility For the containment purge valve with a resilient seal that is isolated in accordance with Required Action D.l, SR 3.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6. 184 days. is based on an NRC i nitiative, Generic Issue B-20 (Ref. 3).

Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often.

Therefore, a Frequency of once per 92 days was chosen and has been shown to be acceptable based on operating experience.

E.l and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status. the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-13 REVISION 1

e Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.1 REQUIREMENTS Each 42 inch containment purge valve is requi red to be verified sealed closed at 31 day intervals. This Surveillance is designed to ensure that a gross breach of containment is not caused by an inadvertent or spurious opening of a containment purge valve. Detailed analysis of the refueling purge valves failed to conclusively demonstrate thei r ability to close during a LOCA in time to limit offsite doses. Therefore. these valves are required to be in the sealed closed position during NODES 1, 2, 3, and 4. A containment purge valve that is sealed closed must have motive power to the valve operator removed. This can be accomplished by de-energizing the source of electric power.

In this application, the term "sealed" has no connotation of leak tightness. The Frequency is a result of an NRC initiative, Generic Issue B-24 (Ref. 4), related to containment purge valve use during unit operations. This SR is not requi red to be met while in Condition 0 of this LCO.

This is reasonable since the penetration flow path would be isolated.

SR 3.6.3.2 This SR ensures that the power access purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed.

not considered to have leakage outside of limits. The SR is it is not required to be met when the purge valves are open for pressure control, AI ARA or air quality considerations for personnel entry, or for Survei llances that requi re the valves to be open. The power access purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.3.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-14 REVISION 1

i.

Containment Isolation Valves 8 3.6.3 BASES SURVEILLANCE SR 3.6.3.3 REQUIREMENTS (continued) This SR requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the containment boundary is within design limits. .This SR does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for containment isolation valves outside containment is relatively easy, the 31 day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to valves that are locked, sealed. or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, 4 and for ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in the proper position, is small.

SR 3.6.3.4 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of'adioactive fluids or gases outside the containment boundary is within design limits. For containment isolation valves inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 performed within the previous 92 days" is appropriate, since if not these containment isolation valves are operated under (continued)

PALO VERDE UNITS 1.2,3 8 3.6.3-15 REVISION 1

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.4 (continued)

REQUIREMENTS administrative controls and the probability of their misalignment is low. Containment isolation valves that are open under administrative controls are not requi red to meet the SR during the time that .they are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing or securing.

The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during NODES 1, 2, 3 and 4 f'r ALARA reasons. Therefore, the probability of misalignment of these containment isolation valves, once they have been verified to be in their proper position, is small.

SR 3.6.3.5 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.6 For containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B (Ref. 5), is required to ensure OPERABILITY. Industry operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types.

Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of 184 days was established as part of the NRC resolution of Generic Issue B-20, "Containment Leakage Due to Seal Deterioration" (Ref. 3).

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.3-16 REVISION 1

Containment Isolation Valves 8 3.6.3 BASES (continued)

SURVEILLANCE SR 3.6.3.6 (continued)

REQUIREMENTS Additionally, this SR must be performed within 92 days after opening the valve. The 92 day Frequency was chosen recognizing that cycling the valve could introduce additional seal degradation (beyond that occurring to a valve that has not been opened). Thus, decreasing the interval (from 184 days) is a prudent measure after a valve has been opened.

SR 3.6.3.7 Automatic containment isolation valves close on a containment isolation signal to prevent leakage of radioactive material from containment following a DBA. This SR ensures each automatic containment isolation valve will actuate to its isolation position on an actual or simulated actuation signal. This Surveillance is not requi red for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency was developed considering it is prudent that this SR be performed only during a unit outage, since isolation of penetrations would eliminate cooling water flow and disrupt normal operation of many critical components. Operating experience has shown that these components usually pass this SR when performed on the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 6.2.4.

2. UFSAR, Section 6.2.6.

3. Generic Issue 8-20.

4. Generic Issue 8-24.

5. 10 CFR 50, Appendix J, Option B.

PALO VEROE UNITS 1,2,3 8 3.6.3-17 REVISION 1 I

0 Containment Pressure B 3.6.4 BASES APPLICABLE The containment was also designed for an excess external SAFETY ANALYSES pressure of 4.0 psig to withstand the resultant pressure (continued) drop from an accidental actuation of the Containment Spray System. The maximum external pressure that would occur as a result of, this transient is -3.5 psig based on an initial containment pressure of -1.0 psig (the lower Technical Specification limit plus instrument uncertainty) and the calculated pressure drop of 2.5 psi.

The upper LCO limit of 2.5 psig does not compensate for any instrument inaccuracies. Use of an indicated limit of 1.8 psig ensures that the actual limit of 2.5 psig will not be exceeded.

The lower LCO limit of -0.3 psig has been derived to account for instrument inaccuracies. The indicated limit of

-0.3 psig ensures that the actual limit of -1.0 psig will not be exceeded.(Ref. 3)

Containment pressure satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

ceo Maintaining containment pressure less than or equal to the LCO upper pressure limit ensures that, in the event of a DBA, the resultant peak containment accident pressure will remain below the containment design pressure. Maintaining containment pressure greater than or equal to the LCO lower pressure limit ensures that the containment will not exceed the design negative pressure differential following the inadvertent actuation of the Containment Spray System.

APPLICABILITY In MODES 1, 2, 3, and 4. a DBA'could cause a release of radioactive material to containment. Since maintaining containment pressure within limits is essential to ensure initial conditions assumed in the accident analysis are maintained, the LCO is applicable in MODES 1, 2. 3, and 4.

In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore. maintaining containment pressure within the limits of the LCO is not requi red in MODE 5 or 6.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.4-2 REVISION 1

e Containment Pressure 8 3.6.4 BASES ACTIONS A.1 When containment pressure is not within the limits of the LCO. containment pressure must be restored to within these limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return operation to within the bounds of the containment analysis. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1, "Containment," which requires that containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.l and 8.2 If containment pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in- which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable. based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.4.1 REQUIREMENTS Verifying that containment pressure is within limits ensures that operation remains within the limits assumed in the accident analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency of this SR was developed after taking into consideration operating experience related to trending of containment pressure variations during the applicable MODES. Furthermore, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal containment pressure condition.

REFERENCES 1. UFSAR, Section 6.2. 1

2. UFSAR, Section 7.2

3. Calculation 13-JC-HC-201 PALO VERDE UNITS 1,2 ' 8 3.6.4-3 REVISION 1

Containment Air Temperature B 3.6.5 BASES APPLICABLE The initial containment average air temperature condition of SAFETY ANALYSES 120'F resulted in a maximum vapor temperature in containment (continued) of 405.65'F. The temperature of the containment steel liner reached approximately 244'F. The containment average air temperature limit of 120'F ensures that, in the event of an accident, the maximum design temperature for the containment steel liner, 300'F. is not exceeded. The consequence of exceeding this design temperature may be the potential for degradation of the containment structure under accident loads.

The LCO limit of 117'F has been derived to account for instrument inaccuracies. The indicated limit of 117'F ensures that the actual limit of 120'F will not be exceeded. 1ll Containment average air temperature satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

LCO During a DBA, with an initial containment average air temperature less than or equal to the LCO temperature limit, the resultant peak accident temperature is maintained below the containment design temperature. As a result, the ability of containment to perform its function is ensured.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release material to containment. In MODES 5 and 6. the of'adioactive probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES.

Therefore, maintaining containment average air temperature within the limit is not required in MODE 5 or 6.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.5-2 REVISION 1

0 II

Containment Spray System 8 3.6.6 BASES BACKGROUND The Containment Spray System accelerates the air mixing (continued) process between the upper dome space of the containment atmosphere during LOCA operations. It also prevents any hot spot air pockets during the containment cooling mode and avoids any hydrogen concentration in pocket areas.

APPLICABLE The Containment Spray System limits the temperature and SAFETY ANALYSES pressure that could be experienced following a DBA. The Containment Spray System is required to be capable of reducing containment pressure to 1/2 the peak pressure within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following a DBA. The limiting DBAs considered relative to containment temperature and pressure are the Loss Of Coolant Accident (LOCA) and the Hain Steam Line Break (HSLB). The DBA LOCA and HSLB are analyzed using computer codes designed to predict the resultant containment pressure and temperature transients. No DBAs are assumed to occur simultaneously or consecutively. The postulated DBAs are analyzed with regard to containment ESF systems, assuming the loss of one ESF bus, which is the worst case single active fai lure, resulting in one train of the Containment Spray System being rendered inoperable.

The analysis and evaluation show that under the. worst case scenario, the highest peak containment pressure is 52.0 psig (experienced during a LOCA). The analysis shows that the peak containment vapor temperature is 405.65'F (experienced during a HSLB). Both results are within the design. (See the Bases for Specifications 3.6.4, "Containment Pressure,"

and 3.6.5, "Containment Air Temperature," for a detai led discussion.) The analyses and evaluations assume a power level of 102K RTP, one containment spray train operating, and initial (pre-.accident) conditions of 120'F and 16.7 psia (LOCA) and 13.22 ps)a (MSLB). The analyses also assuee a response time delayed initiation in order to provide a conservative calculation of peak containment pressure and temperature responses.

The effect of an inadvertent containment spray actuation has been analyzed. An inadvertent spray actuation reduces the containment pressure to -2.6 psig due to the sudden cooling effect in the interior of the air tight containment.

Additional discussion is provided in the Bases for Specification 3.6.4.

(continued)

PALO VERDE UNITS 1,2,3 B 3.6.6-3 REVISION 1

Containment Spray System B 3.6.6 BASES APPLICABLE ,The modeled Containment Spray System actuation from the SAFETY ANAI YSES containment analysis is based,.upon a response time (continued) associated with exceeding the containment High-High pressure setpoint to achieve full flow through the containment spray nozzles. The Containment Spray System total response time of 91 seconds includes diesel generator startup (for loss of offsite power), block loading of equipment, containment spray pump startup, and spray line filling (Ref. 2).

The Containment Spray System mixes the containment atmosphere to provide a uniform hydrogen concentration.

Hydrogen may accumulate in containment following a LOCA as a result of:

a. A metal steam reaction between the zirconium fuel rod cladding and the reactor coolant;

b. Radiolytic decomposition of water in the Reactor Coolant System (RCS) and the containment sump;

c. Hydrogen in the RCS at the time of the LOCA (i.e.,

hydrogen dissolved in the reactor coolant and hydrogen gas in the pressurizer vapor space): or

d. Corrosion of metals exposed to Containment Spray System and Emergency Core Cooling Systems solution.

To evaluate the potential for hydrogen accumulation in containment following a LOCA, the hydrogen generation as a function oj time following the initiation of the accident is calculated. Conservative assumptions recommended by Reference 8 are used to maximize the amount of hydrogen calculated.

The Containment Spray System satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO During a DBA, one containment spray train is required to maintain the containment peak pressure and temperature below the design limits (Ref. 5), to remove iodine from the containment atmosphere to maintain concentrations below those assumed in the safety analysis, and provide hydrogen mixing. To ensure that these requirements are met, two containment spray trains must be OPERABLE. Each spray train must be capable of taking suction from the RHT on a (continued)

PALO VERDE UNITS 1 ',3 8 3.6.6-4 REVISION 1

Containment Spray System B 3.6.6 BASES LCO containment spray actuation signal and automatically (continued) transferring suction to the containment sump on a recirculation actuation signal. Each spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

Therefore, in the event of an accidents the minimum requirements are met, assuming that the worst case single active failure occurs.

Each Containment Spray System typically includes a spray pump, a shutdown cooling heat exchanger, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWT upon an ESF actuation signal and automatically transferring suction to the containment sump.

APPLICABILITY In HODES 1, 2, and 3, and Hode 4 with RCS pressure > 385 psia, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the containment spray trains.

In HODE 4 with RCS pressure < 385 psia and HODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these HODES. Thus, the Containment Spray System is not required to be OPERABLE in these HODES.

ACTIONS A.l With one containment spray train inoperable. the inoperable containment spray train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE spray train is adequate to perform the iodine removals hydrogen mixing'nd containment cooling functions. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant heat removal capability afforded by the Containment Spray System, reasonable time for repai rs, and the low probability of a DBA occurring during this period.

(continued)

PALO VERDE UNITS 1,2,3 8 3.6.6-5 REVISION 1

Containment Spray System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.2 REQUIREMENTS (continued) Verifying that the containment spray header piping is full of water to the 113 ft, level minimizes the time required to fill the header. containment This ensures that spray flow wi 11 be atmosphere within the time frame admitted to the assumed in the containment analysis. The analyses shows that the header may be filled with unborated water which helps to reduce boron plate out due to evaporation. The 31 day Frequency is based on the static nature of the fill header and the low probability of a significant degradation of water level in the piping occurring between survei llances. The value of 113 ft is an indicated value which accounts for instrument uncertainty.

SR 3.6.6.3 Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of'entrifugal pump performance required by Section XI of the ASME Code (Ref. 6). Since the containment spray pumps cannot be tested with flow through the spray headers, they are tested on recirculation flow (either f'ull flow or miniflow as conditions permit). This test is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

(continued)

PALO VERDE UNITS 1,2,3 8 3.6.6-7 REVISION 1

I I

~

0

Containment Spray System B 3.6.6 BASES SURVEILLANCE SR 3.6.6.4 and SR 3.6.6.5 (continued)

REQUIREMENTS These SRs verify that each automatic containment spray valve actuates to its correct position and that each containment spray pump starts upon receipt of an actual or simulated safety injection actuation signal, recirculation actuation signal and containment spray actuation signal as applicable.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Survei llances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Survei llances were performed with the reactor at power.

Operating experience has shown that these components usually pass the Survei llances when, performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

The surveillance of containment sump isolation valves is also required by SR 3.5.3.5. A single surveillance may be used to satisfy both requirements.

SR 3.6.6.6 This SR is done by performing an air or smoke flow test through each spray header and verifying each spray nozzle is unobstructed.

With the containment spray inlet valves closed and the spray header drained of any solution, low pressure air or smoke can be blown through test connections. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during'n accident, is not degraded. Due to the passive design of the nozzle, a test at 10 year intervals is considered adequate to detect obstruction of the spray nozzles.

(continued)

PALO VEROE UNITS 1.2.3 B 3.6.6-8 REVISION 1

MSSVs B 3.7.1 BASES ACTIONS B.1 and B.2 (continued)

If the HSSVs cannot be restored to OPERABLE status in the associated Completion Time, or if one or more steam generators have less than six HSSVs OPERABLE, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR verifies the OPERABILITY of the HSSVs by the verification of each HSSV lift setpoints in accordance with the Inservice Testing Program. The ASME Code,Section XI (Ref. 4), requires that safety and relief valve tests be performed in accordance with ANSI/ASNE ON-1-1987 (Ref. 5).

According to Reference 5, the following tests are required for HSSVs:

a. Visual exapination;

b. Seat tightness determination;

c. Setpoint pressure determination (lift setting);

d. Compliance with owner's seat tightness criteria; and

e. Verification of the balancing device integrity on balanced valves.

The ASME Standard requires that all valves be tested every 5 years, and a minimum of 20K of the valves tested every 24 months. The ASME Code specifies the activities and frequencies necessary to satisfy the requirements.

Table 3.7.1-2 allows a + 3X setpoint tolerance for OPERABILITY: however, the valves are reset to 2 lX during the Surveillance to allow for drift.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.1-5 REVISION 1

'1

)t

MSSVs B 3.7.1 BASES SURVEILLANCE SR 3.7.1.1 (continued)

REQUIREMENTS This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR. This is to allow testing of the MSSVs at hot conditions. The MSSVs may be either bench tested or tested in situ at hot conditions using an assist device to simulate lift pressure. If the MSSVs are not tested at hot conditions, the lift setting pressure shall be corrected to ambient conditions of the valve at operating temperature and pressure.

REFERENCES 1. CESSAR ~ Section 5.2.

2. ASME, Boiler and Pressure Vessel Code, Section III, Article NC-7000, Class 2 Components.

3. UFSAR, Section 15.2.

4. ASME, Boiler and Pressure Vessel Code,Section XI, Subsection IWV.

5. ANSI/ASME ON-1-1987.

PALO VERDE UNITS 1.2,3 8 3.7.1-6 REVISION 1

Il MFIVs B 3.?.3' 3.7 PLANT SYSTEMS 8 3.7.3 Hain Feedwater Isolation Valves (MFIVs)

BASES BACKGROUND The MFIVs isolate Main Feedwater (MFW) flow to the secondary side of the steam generators following a High Energy Line Break (HELB). Closure of the MFIVs terminates flow to both steam generators, terminating the event for Feedwater Line Breaks (FWLBs) occurring upstream of the HFIVs. The consequences of events occurring in the main steam lines or in the MFW lines downstream of the MFIVs will be mitigated by thei r closure. Closure of the MFIVs effectively terminates the addition of feedwater to an affected steam generator, limiting the mass and energy release for Steam Line Breaks (SLBs) or FWLBs inside containment, and reducing the cooldown effects for SLBs.

The HFIVs isolate the nonsafety related portions from the safety related portion of the system. In the event of a secondary side pipe rupture inside containment, the valves limit the quantity of high energy fluid that enters containment through the break, and provide an additional pressure boundary for the controlled addition of Auxiliary Feedwater (AFW) to the intact loop.

Two MFIVs are located on each economizer and downcomer line, outside, but close to. containment. The downcomer MFIVs are located upstream of the train A and 8 AFW injection points so that AFW may be supplied to a steam generator following HFIV closure. The piping volume from the downcomer HFIVs to the steam generator must be accounted for in calculating mass and energy releases, and refilled prior to AFW reaching the steam generator following either an SLB or FWLB.

The HFIVs close on receipt of a Hain Steam Isolation Signal (HSIS) generated by either low steam generator pressure.

high steam generator level, or high containment pressure.

The MSIS also actuates the Main Steam Isolation Valves (HSIVs) to close. The MFIVs may also be actuated manually.

In addition to the HFIVs, check valves are available to isolate the feedwater line penetrating containment'nd to ensure that the consequences of events do not exceed the capacity of the containment heat removal systems. A description of the HFIVs is found in the UFSAR, Section 10.4.7 (Ref. I).

(continued)

PAI 0 VERDE UNITS 1,2,3 8 3.7.3-1 REVISION 1

e HFI Vs B 3.7.3 BASES APPLICABLE The design basis of the MFIVs is established by the SAFETY ANALYSES analysis for the large SLB. It, is also influenced by the accident analysis for the large FWLB. Closure of the HFIVs may also be relied on to terminate a steam break for core response analysis and an excess feedwater flow event upon receipt of a NSIS on high steam generator level.

Failure of an MFIV to close following an SLB, FWLB, or excess feedwater flow event can result in additional mass and energy to the steam generators contributing to cooldown.

This fai lure also results in additional mass and energy releases following an SLB or FWLB event.

The NFIVs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii ).

LCO This LCO ensures that the NFIVs will isolate MFW flow to the steam generators. Following an FWLB or SLB, these valves will also isolate the nonsafety related portions from the safety related portions of the system. This LCO requires that two HFIVs in each feedwater line be OPERABLE. The NFIVs are considered OPERABLE when the isolation times are within limits, and are closed on an isolation actuation signal.

Failure to meet the LCO requirements can result in additional mass and energy being released to containment following an SLB or FWLB inside containment. If an NSIS on high steam generator level is relied on to terminate an excess feedwater flow event. fai lure to meet the LCO may result in the introduction of water into the main steam lines.

The four economizer HFIVs are:

SGA-UV 174¹ SGB-UV 132¹ SGB-UV 137¹ SGA-UV 177¹ The four downcomer NFIVs are:

SGB-UV 130¹ SGA-UV 172¹ SGB-UV 135¹ SGA-UV 175¹ (continued)

PALO VERDE UNITS 1,2,3 8 3.7.3-2 REVISION 1

e MFIVs B 3.7.3 BASES APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators. This ensures. that. in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator .

In MODES l. 2, 3, and 4, the MFIVs are required to be OPERABLE, except when they are closed or isolated by a deactivated and closed power operated valve. in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment. When the valves are closed or isolated by a closed power operated valve, they are already performing their safety function.

In MODES 5 and 6, steam generator energy is low. Therefore, the MFIVs are not required.

ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each penetration flow path.

A.l and A.2 With one MFIV inoperable. action must be taken to close or isolate, and deactivate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these valves are closed or isolated, and deactivated, they are performing their required safety function (e.g.. to isolate the line).

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time period that would require isolation of the MFW flow paths.

Inoperable MFIVs that are closed to comply with Required Action A.l must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The seven day completion time is responsible, based on engineering judgement, MFIV status indications available in the control room, and other administrative controls, to ensure these valves are I deactivated and in the closed position.

(continued)

PALO VERDE UNITS 1,2,3 8 3.7.3-3 REVISION 1

0 0

AFW System B 3.7.5 BASES APPL ICABILITY In NODES 1. 2. and 3, the AFW System is required to be OPERABLE and to function in the event that the HFW System is lost. In addition, the AFW System is required to supply enough makeup water to replace steam generator secondary inventory, lost as the unit cools to NODE 4 conditions.

In NODE 4. the AFW System may be used for heat removal via the steam generator.

In NODES 5 and 6, the steam generators are not normally used for decay heat removal, and the AFW System is not required.

ACTIONS A. 1 If one of the two steam supplies to the turbine driven AFW pumps is inoperable, action must be taken to restore OPERABLE status within 7 days. The 7 day Completion Time is reasonable based on the following reasons:

a. The redundant OPERABLE steam supply to the turbine driven AFW pump;

b. The availability of redundant OPERABLE motor driven AFW pumps; and

c. The low probability of an event requiring the inoperable steam supply to the turbine driven AFW pump.

The second Completion Time for Required Action A. 1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of

- fai lure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and 8 are entered concurrently. The AND connector between 7 days and 10 days dictates that both Completion Times apply simultaneously, and the more restrictive must be met.

It should be noted that when in this Condition with one steam supply to the turbine driven AFW pump inoperable, that the AFA train of AFW is considered to be inoperable.

(continued)

PALO VERDE UNITS 1.2,3 B 3.7.5-5 REVISION 1

AFW System B 3.7.5 BASES ACTIONS (continued)

With one of the required AFM trains (pump or flow path) inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two steam supply lines to the turbine driven AFW pump. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the redundant capabilities afforded by the AFM System, the time needed for repairs, and the low probabi lity of a DBA event occurring during this period. Two AFW pumps and flow paths remain to supply feedwater to the steam generators. The second Completion Time for Required Action B. 1 establishes a limit on the maximum time allowed for any combination of Conditions to be inoperable during any continuous failure to meet this LCO.

The 10 day Completion Time provides a limitation time allowed in this specified Condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 days dictates that boat i Completion Times apply simultaneously, and the more restrictive must be met.

C.l and C.2 When either Required Action A.l or B.1 cannot be completed within the required Completion Time, or if two AFW trains are inoperable in NODES 1. 2, and 3, the unit must be placed in a NODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in NODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

This Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply to the turbine driven AFW pump is inoperable, coincident with another ("B" or "N") AFM train inoperable.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

In NODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required (continued)

PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 1

AFW System B 3.7.5 BASES ACTIONS C. 1 and C.2 (continued) in accordance with the Note that modifies the LCO. Although it is not required, the unit may continue to cool down and start the SDC.

D.1 Required Action D. 1 is modified by' Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the conditions is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With all three AFW trains inoperable in MODES 1, 2, and 3, the unit is in a seriously degraded condition with no TS related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety grade equipment. In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.

Required Action E.l is modified by a Note indicating that all required MODE changes or power reductions are suspended unti 1 one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the Condition is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.

With one AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status or to immediately verify, by administrative means, the OPERABILITY of a second train. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.

In MODE 4. either the reactor coolant pumps or the SDC loops can be used to provide forced circulation as discussed in LCO 3.4.6, "RCS Loops - MODE 4."

(continued)

PALO VERDE UNITS 1.2 ' 8 3.7.5-7 REVISION 1

AFW System B 3.7.5 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.7.5.4 (continued)

This SR is modified by two Notes. Note 1 indicates that the SR be deferred unti l suitable test conditions are established. Normal operating pressure is established in the steam generators when RCS temperature reaches 532'F, this corresponds to a P, of 900 psia. This deferral is required because there Ys insufficient steam pressure to perform the test. Note 2 states that the SR is not required in MODE 4. In MODE 4, the required pump is already operating and the autostart function is not requi red.

SR 3.7.5.5 This SR ensures that the AFW System is properly aligned by verifying the flow path from each essential AFW pump to each steam generator prior to entering MODE 2 operation, after 30 days in MODE 5 or 6. OPERABILITY of essential AFW flow paths must be verified before sufficient core heat is generated that would require the operation of the AFW System during a subsequent shutdown. The Frequency is reasonable, based on engineering judgment, and administrative controls to ensure that flow paths remain OPERABLE.

To further ensure AFW System alignment, the OPERABILITY of the essential AFW flow paths is verified following extended outages to determine that no misalignment of valves has occurred. This SR ensures that the flow path from the CST to the steam generators is properly aligned by requiring a verification of minimum flow capacity of 650 gpm at pressures corresponding to 1270 psia at the entrance to the steam generators. (This SR is not required f'r the non-essential AFW pump since it is normally used for startup and shutdown.)

REFERENCES l. UFSAR, Section 10.4.9.

2. ASME, Boiler and Pressure Vessel Code,Section XI, Subsection IWP.

PALO VERDE UNITS 1.2,3 B 3.7.5-10 REVISION 1 i

EW System B 3.7.7 BASES APPLICABLE The EW System is designed to perform its function with a SAFETY ANALYSIS single failure of any active component. assuming a loss of (continued) offsite power.

The EW System also functions to cool the unit from SDC entry conditions (T >, < 350'F) to NODE 5 (T>< < 210'F) during normal and post accident operations. The time required to cool from 350'F to 210'F "is a function of the number of EW and SDC trains operating. One EW train is sufficient to remove decay heat during subsequent operations with T>,

< 210'F. This assumes that the worst case meteorologVcal conditions occur simultaneously with the maximum heat loads on the system.

The EW System satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The EW trains are independent of each other to the degree that each has separate controls and power supplies and the operation of one does not depend on the other. In the event of. a DBA, one EW train is required to provide the minimum heat removal capability assumed in the safety analysis for the systems to which it supplies cooling water. To ensure this requi rement is met. two EW trains must be OPERABLE. At least one EW train will operate assuming the worst single active fai lure occurs coincident with the loss of offsite power.

A EW train is considered OPERABLE when the following: .

a. The associated pump and surge tank are OPERABLE; and

b. The associated piping, valves. heat exchanger and instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of EW from other components or systems renders those components or systems inoperable, but does not necessarily affect the OPERABILITY of the EW System.

Isolation of the EW System to the Essential Chiller, while rendering the Essential Chiller inoperable, is acceptable and does not impact the OPERABILITY of the EW System.

Isolation of the EW System to SDC system heat exchanger is (continued)

PALO VERDE UNITS 1,2,3 B 3.7.7-2 REVISION 1

EW System 8 3.7.7 BASES LCO (continued) not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

APPLICABILITY In MODES 1, 2, 3, and 4, the EW System must be prepared to erform its post accident safety functions, primarily RCS eat removal by cooling the SDC heat exchanger.

When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EW System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.1 Required Action A. 1 is modified by a Note indicating the requirement of entry into the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4," for SDC made inoperable by EW. This note is only applicable in Mode

4. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

With one EW train inoperable. action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE EW train is adequate to perform the heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.

B.l and B.2 If the EW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

PALO VERDE UNITS 1.2,3 B 3.7.7-3 REVISION 1

e e

EW System B 3.7.7 BASES B.l and B.2 (continued)

The allowed Completion Times are reasonable, based on operating experience. to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated.

and automatic valves in the EW flow path provides assurance that the proper flow paths exist for EW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned. such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.

This SR is modified by a Note indicating that the isolation of the EW components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the EW System. Isolation of the EW System to the Essential Chiller, while rendering the Essential Chiller inoperable, is acceptable and does not impact the OPERABILITY of the EW System. Isolation of the EW System to the SDC system heat exchanger is not acceptable and would render both the EW System and the SDC system inoperable (Ref'. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.7.2 This SR verifies proper automatic operation of the EW valves on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under (continued)

PALO VERDE UNITS 1.2.3 B 3.7.7-4 REVISION 1

e 0

EW System B 3.7.7 BASES SURVEILLANCE SR 3.7.7.2 (continued)

REQUIREMENTS administrative controls. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.7.3 This SR verifies proper automatic operation of the EW pumps on an actual or simulated actuation signal. Operating experience has shown these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. UFSAR. Section 9.2.2.

2. UFSAR, Section 9.2.1.

3. CRDR 980794 PALO VEROE UNITS 1,2.3 B 3.7.7-5 REVISION 1

t 1

0 0

ESPS 8 3.7.8 B 3.7 PLANT SYSTEMS 8 3.7.8 Essential Spray Pond System (ESPS)

BASES BACKGROUND The ESPS provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During a normal shutdown, the ESPS also provides this function for various safety related components.

The ESPS consists of two separate, 100K capacity safety related cooling water trains. Each train consists of one 100K capacity pump, one Essential Cooling Water (EW) heat exchanger, piping, valves, instrumentation, and a cleanup and Chemistry Control System. The valves are manually aligned, and secured in position. The pumps are automatically started upon receipt of an ESFAS signal.

Additional information about the design and operation of the ESPS, along with a list of the components served, is presented in the FSAR, Section 9.2. 1 (Ref. 1). The principal safety related function of the ESPS is the removal of decay heat from the reactor via the EW System.

APPLICABLE The design basis of the ESPS is for one ESPS train, in SAFETY ANALYSES conjunction with the EW System and a 100K capacity containment spray system to remove sufficient heat to ensure a safe reactor shutdown coincident with a loss of offsite power . The ESPS is designed to perform its function with a single fai lure of any active component, assuming the loss of offsite power.

The ESPS, in conjunction with the EW System, also cools the unit from shutdown cooling (SDC). as discussed in the UFSAR, Section 5.4.7 (Ref. 2) entry conditions to NODE 5 during normal and post accident operations. The time required for this evolution is a function of the number of EW and SDC System trains that are operating. One ESPS train is sufficient to remove decay heat during subsequent operations in NODES 5 and 6. This assumes that worst case meteorological conditions occur simultaneously with maximum heat loads on the system.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.8-1 REVISION 1

11 lg l

l I

J J

0

ESPS B 3.7.8 BASES APPLICABLE The ESPS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

SAFETY ANALYSES (continued)

LCO Two ESPS trains are requi red to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post, accident, heat loads, assuming the worst single active failure occurs coincident with the loss of offsite power.

An ESPS train is considered OPERABLE when:

a. The associated pump is OPERABLE; and

b. The associated piping, valves, instrumentation, heat exchanger'nd instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of the ESPS from other components or systems renders those components or systems inoperable, but does not necessarily affect the OPERABILITY of the ESPS. Isolation of the ESPS to the Diesel Generator (DG) cooler(s), while rendering the DG inoperable, is acceptable and does not impact the OPERABILITY of the ESPS. Isolation of the ESPS to the essential cooling water heat exchanger is not acceptable and would render both the Essential Cooling Water System and the ESPS inoperable (Ref. 3). The ESPS is inoperable in this situation because it is operating outside of the acceptable limits of the system.

APPLICABILITY In MODES 1, 2, 3, and 4, the ESPS System is required to support the OPERABILITY of the. equipment serviced by the ESPS and required to be OPERABLE in these MODES.

When the plant is in other than MODES 1, 2, 3 or 4, the requirements of the ESPS shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.8-2 REVISION 1

ESPS B 3.7.8 BASES ACTIONS A.l With one ESPS train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE ESPS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single fai lure in the ESPS train could result in loss of ESPS function. Required Action A. 1 is modifie'd by two Notes. The fi rst Note indicates that the applicable Conditions of LCO 3.8. l. "AC Sources Operating,"

must be entered when the inoperable ESPS train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops MODE 4," should be entered if an inoperable ESPS train results in an inoperable SDC System. This note is only applicable in MODE 4. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

B.1 and B.2 If the ESPS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual and power operated, valves in the ESPS flow path ensures that the proper flow paths exist for ESPS operation. This SR does not apply to valves that are locked sealed, or otherwise

~

secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This (continued)

PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION 1

0 IC

ESPS B 3.7.8 BASES SURVEILLANCE SR 3.7.8. 1 (continued)

REQUIREMENTS Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR is modified by a Note indicating that the isolation of the ESPS components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the ESPS. Isolation of the ESPS to the Diesel Generator (DG) cooler(s), while rendering the DG inoperable, is acceptable and does not impact the OPERABILITY of the ESPS. Isolation of the ESPS to the essential cooling water heat exchanger is not acceptable and would render both the Essential Cooling Water System and the ESPS inoperable (Ref. 3). The ESPS is inoperable in this situation because it is operating outside of the acceptable limits of the system.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.8.2 The SR verifies proper automatic operation of the ESPS pumps on an actual or simulated actuation signal. Operating experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency is acceptable from a reliability standpoint.

f REFERENCES 1. UFSAR, Section 9.2.1.

2. UFSAR, Section 5.4.7.

3. CRDR 980795 PALO VERDE UNITS 1,2,3 B 3.7.8-4 REVISION 1

UHS B"3.7.9 BASES LCO The UHS is required to be OPERABLE. The UHS is considered OPERABLE if it contains a sufficient volume of water temperature that would allow the at or ESPS to below the maximum operate for at least 26 days following the design basis LOCA without the loss of net positive suction head (NPSH) and ~

without exceeding the maximum design temperature of the equipment served by the ESPS. To meet this condition, the UHS temperature should not exceed 89'F and the level of each ESP should not fall below 12 ft'usable water depth during normal unit operation. Since the bottom 1.5 ft of the ESPS is not usable. an actual depth of 13.5 ft provides a usable depth of 12 ft to meet the heat loads minimum water requirement.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.

When the plant is in other than MODES 1, 2, 3, or 4. the requirements for the UHS shall be consistent with the definition of OPERABILITY, which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.l and A.2 If the UHS is inoperable. the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.9-2 REUISION 1

0 e

EC System B 3.7.10 BASES APPLICABLE The maximum heat load in the ESF pump room area occurs SAFETY ANALYSIS during the recirculation phase following a loss of coolant (continued) accident. During recirculation, hot fluid from the containment sump is supplied to the high pressure safety injection and containment spray pumps. This heat load to the area atmosphere must be removed by the EC System to ensure that these pumps remain OPERABLE.

The EC satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two EC trains are required to be OPERABLE to provide the required redundancy to ensure that the system functions to remove post accident heat loads, assuming the worst single failure.

An EC train is considered OPERABLE when:

a. The associated pump and surge tank are OPERABLE; and

b. The associated piping, valves, heat exchanger, refrigeration unit, and instrumentation and controls required to perform the safety related function are OPERABLE.

The isolation of the EC System from other components or systems renders those components or systems inoperable, but does not necessarily affect the OPERABILITY of the EC System. Isolation of the EC System to any single EC supplied cooling coil, while rendering the cooling coil inoperable. is acceptable and does not impact the OPERABILITY of the EC System. Isolation of the EC System to any additional cooling coil is not acceptable without an engineering evaluation and an operability determination for that configuration (Ref. 2). The EC System is inoperable in this situation, unless it has been specifically evaluated, because it is operating outside of the acceptable limits of'he system.

APPLICABILITY In NODES 1, 2, 3, and 4, the EC System is requi red to be OPERABLE when a LOCA or other accident would require ESF operation.

(continued)

PALO VERDE UNITS 1.2,3 B 3.7.10-2 REVISION 1

EC System 8 3.7.10 BASES APPLICABILITY (continued) When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EC System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

ACTIONS A.l If one EC train is inoperable. action must be taken to restore OPERABLE status within 72 hours. In this condition, one OPERABLE ECW train is adequate to perform the cooling function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the low probability of an event occurring during this time and the 100K capacity OPERABLE EC train.

B.l and 8.2 If the EC train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EC flow path provides assurance that the proper flow paths exist for EC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not requi re any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

(continued)

PALO VERDE UNITS 1,2,3 8 3.7.10-3 REVISION 1

h

~

l t

l l

EC System B 3.7.10 BASES SURVEILLANCE SR 3.7.10.1 (continued)

REQUIREMENTS The isolation of the EC System from other components or systems renders those components or systems inoperable, but does not necessarily affect the OPERABILITY of the EC System. Isolation of the EC System to any single EC supplied cooling coil, while rendering the cooling coil inoperable. is acceptable and does not impact the OPERABILITY of the EC System. Isolation of the EC System to any additional cooling coil is not acceptable without an engineering evaluation and an operability determination for that configuration (Ref. 2). The EC System is inoperable in this situation, unless it has been specifically evaluated, because it is operating outside of the acceptable limits of the system.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.10.2 This SR verifies proper automatic operation of the EC System components and that the EC pumps will start in the event of any accident or transient that generates an applicable ESFAS signal. This SR also ensures that each automatic valve in the flow paths actuates to its correct position on an actual or simulated ESFAS signal.

The 18 month Frequency is based on the need to perform this Surveillance-under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The 18 month Frequency is based on operating experience and design reliability of the equipment.

REFERENCES 1. UFSAR, Section 9.2.9.

2. CRDR 980796 PALO VERDE UNITS 1.2,3 B 3.7.10-4 REVISION 1

e

~ '

CREFS B 3.7.11 BASES APPLICABLE SAFETY ANALYSES The worst case single active" failure of a component of the (continued) CREFS. assuming a loss of offsite power, does not impair the ability of the system to perform its design function.

The CREFS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO Two independent and redundant trains of the CREFS are required to be OPERABLE to ensure that at least one is available, assuming that a single failure disables the other train. Total system failure could result in a control room operator receiving a dose in excess of 5 rem whole body or its equivalent in the event of a large radioactive release.

The CREFS is considered OPERABLE when the individual components necessary to control operator exposure are OPERABLE in both trains. A CREFS train is considered OPERABLE when the associated:

a. Fan is OPERABLE;

b. HEPA fi lters and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtration functions; and

c. Ductwork, valves, and dampers are OPERABLE. and air circulation can be maintained.

In addition, the control room boundary must be maintained, including the integrity of the walls. floors, cei lings, ductwork, and access doors.

APPLICABILITY In NODES 1, 2, 3, and 4. the CREFS must be OPERABLE to limit operator exposure during and following a DBA.

In NODES 5 and 6, the CREFS is required to cope with the release from a rupture of a waste gas tank.

During movement of irradiated fuel assemblies. the CREFS must be OPERABLE to cope with the release from a fuel handling accident.

(continued)

PALO VERDE UNITS 1,2,3 8 3.7.11-3 REVISION 1

0 CREFS B 3.7.11 BASES SURVEILLANCE REQUIREMENTS SR 3.7. 11. 3 (continued)

This SR verifies each CREFS train starts and operates on an actual or simulated actuation signal. This includes verification that the system is automatically placed into a filtration mode of operation with flow through the HEPA filters and charcoal adsorber banks. The Frequency of 18 months is consistent with that specified in Reference 3.

SR 3.7.11.4 This SR verifies the integrity of the control room enclosure and the assumed inleakage rates of potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper function of the CREFS. During operation, the CREFS is designed to pressurize the control room > 0. 125 inches water gauge positive pressure with respect to adjacent areas in order to prevent unfiltered inleakage. The CREFS is designed to maintain this positive pressure with one train at a ventilation flow rate of

<1000 cfm. The ventilation flowrate is the outside makeup air flowrate. The Frequency of 18 months on a STAGGERED TEST BASIS is consistent with the guidance provided in NUREG-0800, Section 6.4 (Ref. 4).

REFERENCES 1. UFSAR, Section 6.4.

2. UFSAR, Chapter 15.

3. Regulatory Guide 1.52 (Rev. 2).

4. NUREG-0800 'ection 6.4, Rev. 2, July 1981.

5. UFSAR, Section 9.4.

6. UFSAR, Section 2.2 PALO VERDE UNITS 1,2,3 8 3.7.11-6 REVISION 1

CREATCS B 3.7.12 8 3.7 PLANT SYSTEMS B 3.7. 12 Control Room Emergency Air Temperature Control System (CREATCS)

BASES BACKGROUND The CREATCS provides temperature control for the control room following isolation of the control room.

The CREATCS consists of two independent, redundant trains that provide cooling of recirculated control room air . Each train consists of cooling coils, instrumentation, and controls to provide for control room temperature control.

The CREATCS is a subsystem providing air temperature control for the control room.

The CREATCS is an emergency system, which is part of the Control Room Essential Filtration System (CREFS). A single train will provide the required temperature control to maintain the control room between 70'F and 80'F. The CREATCS operation to maintain the control room temperature is discussed in the UFSAR, Section 9.4 (Ref. 1).

APPLICABLE The design basis of the CREATCS is to maintain temperature SAFETY ANALYSES of the control room environment throughout 30 days of continuous occupancy.

The CREATCS components are arranged in redundant safety related trains. During emergency operation, the CREATCS maintains the temperature between 70'F and 80'F. A single active fai lure of a component of the CREATCS, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The CREATCS is designed in accordance with Seismic Category I requirements. The CREATCS is capable of removing sensible and latent heat loads from the control room, considering equipment heat loads and personnel occupancy requirements, to ensure equipment OPERABILITY.

The CREATCS satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii ).

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.12-1 REVISION 1

CREATCS B 3.7.12 BASES (continued)

LCO Two independent and redundant trains of the CREATCS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other train. Total system fai lure could result in the equipment operating temperature exceeding limits in the event of an accident.

The CREATCS is considered OPERABLE when the individual components that are necessary to maintain the control room temperature are OPERABLE in both trains. These components include the cooling coils and associated temperature control instrumentation. In addition, the CREATCS must be OPERABLE to the extent that air circulation can be maintained.

APPLICABILITY In NODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREATCS must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY requirements following isolation of the control room.

ACTIONS With one CREATCS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CREATCS train is adequate to maintain the control room temperature within limits. The 30 day Completion Time is reasonable, based on the low probability of an event occurring requiring control room isolation, consideration that the remaining train can provide the requi red capabilities, and the alternate safety or nonsafety related cooling means that are available.

B.l and B.2 In NODE 1, 2. 3, or 4, when Required Action A. 1 cannot be completed within the required Completion Time, the unit must be placed in a NODE that minimizes the accident risk. To achieve this status, the unit must be placed in at least NODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in NODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

PALO VERDE UNITS 1.2,3 8 3.7.12-2 REVISION 1

e II

Spent Fuel Assembly Storage B 3.7.17 BASES APPLICABLE The analysis of the reactivity effects of fuel storage in SAFETY ANALYSIS the spent fuel storage racks was performed by ABB-Combustion (continued) Engineering (CE) using the two-dimensional discrete ordinates transport theory DOT-IV computer code, with four energy group neutron cross sections generated by the CEPAK code. These codes have been previously used by CE for the analysis of tuel rack reactivity and have been benchmarked against results from numerous critical experiments. These experiments simulate the PVNGS fuel storage racks as realistically as possible with respect to parameters important to reactivity such as enrichment and assembly spacing. In Harch 1992, the NRC issued Information Notice 92-21 and Supplement 1 concerning discrepancies that were discovered in spent fuel pool reactivity calculations. The discrepancies were due to an overestimation of neutron absorption in the CEPAK generation of cross sections. These discrepancies were found to exist only in regions containing a strong neutron absorber (poison). Since neutron poison is not pre'sent. this problem does not exist for the PVNGS racks.

The modeling of Regions 2 and 3 included several conservative assumptions. These assumptions neglected the reactivity effects of axial leakage, poison shims in the assemblies, structural grids, and soluble boron in the 68'F pool water.

These assumptions tend to increase the calculated effective multiplication factor (k,<<) of the racks. The stored fuel assemblies were modeled as CE 16x16 assemblies with a nominal pitch of 0.506 inches between fuel rods, a fuel pellet diameter of 0.33 inches, and a UO(2) density of 10.4 g/cc.

OOT-IV calculations were used to construct a curve of burnup versus initial enrichment for both Regions 2 and 3 (TS Figure 5.6-1) such that all points on the curve produce a k,<< value (without uncertainties or biases) of 0.93. This method of reactivity equivalencing has been accepted by the NRC and .

used for numerous other spent fuel storage pools which take credit for burnup. The NRC criticality acceptance criterion for, fuel storage is that k,<< be no greater than 0.95, including all uncertainties at a 95K probability/95K confidence level. Therefore, the reactivity of assemblies, minimum monolith thickness, temperature variations, minimum L-insert thickness, assembly enrichment, and assembly burnup were obtained as well as a methodology uncertainty and bias.

These were applied to the nominal value of 0.93 to obtain a final k,<< 0.944 for the spent fuel racks. This meets the NRC criterion of no greater than 0.95.

(continued)

PALO VERGE UNITS 1,2.3 B 3.7.17-2 REVISION 1

Spent Fuel Assembly Storage 8 3.7.17 BASES APPLICABLE Host abnormal storage conditions will not result in an SAFETY ANALYSES increase in the k,<< of the racks. However, it is possible (continued) to postulate events, such as an assembly drop on top of a rack or between a rack and the pool walls or the misloading of an assembly, with a burnup and enrichment combination outside of the acceptable area in TS Figure 3.7.17-1, which could lead to an increase in reactivity. However, for such events, credit may be taken for the presence of 2150 ppm of boron in the pool water required by TS 3.7. 15 since the staff does not require the assumption of two unlikely, independent, concurrent events to ensure protection against a criticality accident (double contingency principle). The reduction in k ff caused by the boron more offsets the reacti vi ty addi ti on caused by credible accidents. Therefore, the staff criterion of k,<<no greater than 0.95 for any postulated accident is met.

The criticality aspects of the spent fuel pool meet the requirements of General Design Criterion 62 for the prevention of criticality in fuel storage and handling.

The spent fuel pool heat load calculations were based on a full pool with 1300 fuel assemblies. The maximum number of fuel assemblies that can be stored in the three-region configuration is 1054 fuel assemblies. The actual loading pattern therefore has a lower decay heat than assumed in, the calculations f'r a full pool.

The original licensing basis for the spent fuel pool allowed for spent fuel to be loaded in either a 4x4 array or a checkerboard array, depending on the use of boraflex poison.

Therefore, a fuel handling accident was assumed to occur with maximum loading of the pool. The fuel pool rack construction precludes more than one assembly from being impacted in a fuel handling accident. Therefore, the UFSAR analysis conclusion regarding the worst scenario for a dropped assembly (in which the horizontal impact of a fuel assembly on top of the spent fuel assembly damages fuel rods in the dropped assembly but does not impact fuel in the stored assemblies) continued to be limiting.

The spent fuel assembly storage satisfies Criterion 2 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2,3 B 3.7.17-3 REVISION 1

0 E

AC Sources Operating B 3.8.1 BASES BACKGROUND The onsite standby power source for each 4. 16 kV ESF bus is (continued) dedicated DG. DG-A and DG-B are dedicated to ESF buses PBA-S03 and PBB-S04, respectively. A DG starts automatically (in emergency mode) on a safety injection actuation signal (SIAS) (i.e., low pressurizer pressure or high containment pressure signals), auxiliary feedwater actuation signals (AFAS-1 and AFAS-2) (e.g., low steam generator level), or on a loss of power (an ESF bus degraded voltage or undervoltage signal). After the DG has started, it will automatically tie to its respective bus after offsite power is tripped as a consequence of ESF bus underyoltage or degraded voltage, independent of or coincident with a SIAS or AFAS signal. Following the loss of offsite power, the sequencer sheds nonpermanent loads from the ESF bus. When the DG is tied to the ESF bus loads ~

are then sequentially connected to its respective ESF bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading the DG by automatic load application.

The DGs will also start and operate in the standby mode (running unloaded) without tying to the ESF bus on a SIAS or AFAS.

In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a loss of coolant accident (LOCA).

Certain required unit loads are returned to service in a predetermined sequence in order to prevent overloading the DG in the process. Within 40 seconds after the initiating signal is received, all .loads needed to recover the unit or i.

maintain it in a safe condition are returned to service.

'atings for Train A and Train B DGs satisfy the requirements of Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG is 5500 kW with 10K overload permissible for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in any 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period. The ESF loads that are powered from the 4. 16 kV ESF buses are listed in the updated FSAR, Chapter 8 (Ref. 2).

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.1-2 REVISION 1

t f

l 0

AC Sources Oper ating 8 3.8,1 BASES LCO The startup transformers (NAN-X01. NAN-X02, and NAN-X03)

(continued) convert the 525 kV offsite power to the Non-Class 1E 13.8

,.kV power. Each secondary winding of a startup transformer normally provides power to one of two interconnected 13.8 kV intermediate buses (NAN-S05 5 NAN-S06) per unit, in such a way that the two 13.8 kV intermediate buses of the same unit receive power from two different start-up transformers (preferred offsite sources: normal and alternate supply).

For example, Unit 1 NAN-S05's normal supply is from a NAN-X03 secondary winding and NAN-S05's alternate supply is from a NAN-X01 secondary winding; Unit 1 NAN-S06's normal supply is from a NAN-X02 secondary winding and NAN-S05's alternate supply is from a NAN-X01 secondary winding. The secondary winding are sized to start and carry one-half of the non-Class 1E loads of one unit and two trains of ESF loads, one which is from another unit, during unit trips or during startup/shutdown operation.

The 13.8 kV intermediate buses (NAN-S05 8 NAN-S06), in turn, distribute power to the 4. 16 kV Class 1E buses (PBA-S03 8 PBB-S04) via a 13.8 kV bus (NAN-S03 or NAN-S04) and an ESF transformer (NBN-X03 or NBN-X04).

Two fast bus transfer circuits are also provided to transfer the non-Class 1E house loads fed from NAN-S01 and NAN-S02 to 13.8 kV buses NAN-S03 and NAN-S04 respectively during a plant trip or during startup/shutdown operation. Prior to a plant trip, NAN-S01 and NAN-S02 are fed from the auxiliary transformer, and are fed f'rom NAN-S03 and NAN-S04 respectively after the plant trip, Each DG must be capable of starting, accelerating to rated speed (i.e., frequency) and voltage, and connecting to its respective ESF bus on detection of bus undervoltage. This wi ll be accomplished within (<) 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals. and continue to operate unti 1 offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as DG in standby condition with the engine hot and DG in standby condition with the engine at normal keep-warm conditions. Additional DG capabilities must be demonstrated to meet required Surveillances (e.g.,

capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode).

(continued)

PAI 0 VERDE UNITS 1,2,3 B 3.8.1-4 REVISION 1

AC Sources Operating B 3.8.1 BASES ACTIONS A.l To ensure a highly reliable power source remains with the one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a fai lure of SR 3.8. 1. 1 acceptance criteria does not result in a Required Action not met.

However, if a second requi red ci rcuit fails SR 3.8. 1. 1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

Required Action A.2, which only applies if the train (i .e..

ESF bus) cannot be powered from an offsite source, is intended to provide assurance that, an event coincident with a single failure of the associated OG will not result in a complete loss of safety function of critical redundant required features. These features require Class 1E power from PBA-S03 or PBB-S04 ESF buses to be OPERABLE. and include: charging pumps; radiation monitors Train A RU-29 and Train B RU-30 (TS 3.3.9), Train A RU-31 and Train B RU-145; pressurizer heaters (TS 3.4.9); ECCS (TS 3.5.3 and TS 3.5.4); containment spray (TS 3.6.6); containment isolation valves NCA-UV-402, NCB-UV-403, WCA-UV-62, and WCB-UV-61 (TS 3.6.3); containment hydrogen monitors (TS 3.3. 10); hydrogen recombiners (TS 3.6.7): auxiliary feedwater system (TS 3.7.5); essential cooling water system (TS 3.7.7); essential spray pond system (TS 3.7.8); essential chilled water system (TS 3.7. 10); control room essential filtration system (TS 3.7. 11); control room emergency air temperature control system (TS 3.7. 12); ESF pump room air exhaust cleanup system (TS 3.7.13): shutdown cooling subsystems (TS 3.4.6, 3.4.7, 3.4.8. and 3.4. 15); and fuel building ventilation. Node applicability is as specified in each appropriate TS section.

(continued)

PALO VERDE UNITS 1.2 ' B 3.8.1-6 REVISION 1

AC Sources Operating 8 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load, or equivalent load, without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. Train A Normal Water Chiller (at 842 kW) and Train 8 AFW pump (at 936 kW) are the bounding loads for the DG A and DG B to reject, respectively. These values are listed in Table 8.3-3, Load Bases for Class 1E Buses, in the Updated FSAR (Ref. 2)'.

This Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest post-accident load while solely supplying the bus; or

b. Tripping its associated single largest post-accident load with the DG solely supplying the bus.

As required by IEEE-308 (Ref. 12), the load rejection test is acceptable if the increase in diesel speed does not exceed 75K of the difference between synchronous speed and the overspeed trip setpoint. or 15K above synchronous speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are derived from Regulatory Guide 1.9 (Ref. 3) recormendations for response during load sequence intervals.

The 3 seconds specified is equal to 60X of a typical 5 second load sequence interval associated with sequencing of the largest load. The voltage and frequency specified are consistent with the design range of the equipment powered by the DG. SR 3.8. 1.9.a corresponds to the maximum frequency excursion, while SR 3.8. 1.9.b and SR 3.8. 1.9.c are steady state voltage and frequency values to which the system must recover following load rejection. The 18 month Frequency is consistent with the recoraaendation of Regulatory Guide 1.9 (Ref. 3).

(continued)

PALO VERDE UNITS 1,2,3 8 3.8.1-25 REVISION 1

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 ACTIONS D.1 (continued)

With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not within the required limits, a period of 30 days is allowed for restoring the stored fuel oil properties. This period provides sufficient time to test the stored fuel oil to determine that the new fuel oil, when mixed with previously stored fuel oil, remains acceptable, or restore the stored fuel oil properties. This restoration may involve feed and bleed procedures, filtering, or combinations of these procedures. Even if a DG start and load was required during this time interval and the fuel oil properties were outside limits, there is a high likelihood that the DG would still be capable of performing its intended function.

E.l Each DG is OPERABLE with one air receiver capable of delivering an operating pressure of > 230 psig indicated.

Although there exist two independent and redundant starting air receivers per DG, only one starting air receiver is required for DG OPERABILITY. Each receiver is sized to accomplish 5 DG starts from its normal operating pressure of 250 psig, and each will start the DG in s 10 seconds with a minimum pressure of 185 psig.

(

If the required starting air receiver is 230 psig and > 185 psig, the starting air system is degraded and a period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration to the required pressure prior to declaring the DG inoperable. This 48-hour period is acceptable based on the minimum starting air capacity (>

185 psig). the fact that the DG start must be accomplished on the first attempt (there are no sequencial starts in emergency mode). and the low probability of an event during this brief period. Calculation 13-JC-DG-203 (Ref. 9) supports the proposed values for receiver pressures.

F.l With a Required Action and associated Completion Time not met, or one or more DGs with diesel fuel oil, lube oil, or starting air subsystem inoperable for reasons other than addressed by Conditions A through E, the associated DG may be incapable of performing its intended function and must be

(

immediately declared inoperable.

(continued)

PALO VERDE UNITS 1.2,3 B 3.8.3-5 REVISION 1

0 0

DC Sources Shutdown 8 3.8.5 B 3.8 ELECTRICAL POWER SYSTEHS B 3.8.5 DC Sources Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2). assume that Engineered Safety Feature (ESF) systems are OPERABLE. The OC electrical power system provides normal and emergency OC electrical power for the DGs. emergency auxiliaries, and control and switching during all NODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems'PERABILITY.

The OPERABILITY of the minimum DC electrical power sources during NODES 5 and 6, and during movement of i rradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

In general, when the unit is shut down, the Technical Specification requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single fai lure and concurrent loss of all offsite or all onsite power is not requi red. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in (continued)

PALO VERDE UNITS 1,2,3 B 3.8.5-1 REVISION 1

DC Sources Shutdown 8 3.8.5 BASES APPLICABLE NODES 1, 2, 3, and 4 have no specific analyses in MODES 5 SAFETY ANALYSES and 6. Worst case bounding events are deemed not credible (continued) in NODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and minimal in consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

The DC sources support the equipment and instrumentation required to mitigate the Loss of Shutdown Cooling and Loss of RCS Inventory accidents analyzed in response to NRC Generic Letter 88-17 "Loss of Decay Heat Removal." The Generic Letter does not require the assumption of a single fai lure and concurrent loss of all offsite or all onsite power.

The DC sources satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO The DC electrical power subsystem as defined in this LCO consists of two batteries, one battery charger per battery and the corresponding control equipment and interconnecting cabling within the train. The DC electrical power subsystem is required to ensure the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

In Modes 5 8 6 and during movement of irradiated fuel assemblies. one DC electrical power subsystem, consisting of two batteries, one battery charger per battery and the corresponding control equipment and interconnecting cabling within the train, is required to be OPERABLE to support the requi rements of LCO 3.8.10 "Distribution Systems Shutdown".

This DC electrical power subsystem train also supports the one required OPERABLE Diesel Generator specified in LCO 3.8.2 "AC Sources Shutdown" on that same train. For situations where redundant trains of supported equipment are (continued)

PALO VERDE UNITS 1,2,3 B 3.8.5-2 REVISION 1

0 DC Sources Shutdown B 3.8.5 BASES LCO required to be OPERABLE by LCO 3.8. 10. the necessary (continued) DC buses of that additional DC distribution subsystem train shall be energized by a minimum of its associated battery charger or backup battery charger. Should the minimum battery charger requirements not be maintained for that additional DC distribution subsystem train required by LCO 3.8.10, then LCO 3.8. 10 (Condition 'A') would be applicable and not LCO 3.8.5. This is because the requirements of LCO 3.8.5 would still be met (i .e. one OPERABLE DC electrical power subsystem maintained).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 and 6, and during movement of ir radiated fuel assemblies provide assurance that:

a. Required features needed to mitigate a f'uel handling accident are available;

b. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

c. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.4.

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of irradiated fuel assemblies in Modes 1 through 4.

A. 1. A.2. 1. A.2.2. A.2.3. and A.2.4 If two 125 VDC trains'uses are required to be energized per LCO 3.8. 10, of the two required trains, the remaining buses with DC power available may be capable of supporting sufficient systems to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features inoperable with the associated DC power source(s) inoperable. appropriate restrictions will be (cont>nued)

PALO VERDE UNITS 1,2,3 B 3.8.5-3 REVISION 1

C e

DC Sources Shutdown B 3.8.5 BASES ACTIONS A. l. A.2. 1, A.2.2, A.2.3, and A.2.4 (continued) implemented in accordance with the affected required features assume that the

'A'rain 125 VDC sources areexample, LCO ACTIONS; For requi red to be OPERABLE per LCO 3.8.5. Also assume that two SDC trains are requi red to be OPERABLE and the corresponding 125VDC trains'uses energized (i.e. PK system buses 'A'nd 'C'or train buses 'B'nd 'D'or train 'B') per LCO 3.8.10.

'A'nd Finally, assume that an electrical fault occurs on the PK system channel 'C'us and the bus has been declared INOPERABLE. The action of LCO 3.8.5 would allow declaring the corresponding SDC suction valve J-SIC-UV-653 INOPERABLE.

However the SDC system itself would not necessarily need to be declared INOPERABLE and this would allow CORE ALTERATIONS to continue. However, in many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions). The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the 'required SDN is maintained.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. If moving irradiated fuel assemblies while in NODES 1, 2, 3, or

4. the fuel movement is independent of reactor operations.

Therefore, inability to iranediately suspend movement of i rradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystem and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the unit safety systems.

The Completion Time of immediately is consistent with the required times for actions requi ring prompt attention. The restoration of the requi red DC electrical power subsystem should be completed as quickly as possible in order to (continued)

PALO VERDE UNITS 1,2,3 B 3.8.5-4 REVISION 1

DC Sources Shutdown B 3.8.5 BASES ACTIONS A. l. A.2. 1, A.2.2. A.2.3. and A.2.4 (continued) minimize the time during which the unit safety systems may be without sufficient power.

B.1 and B.2 Condition B represents the loss of the required (in-service) battery charger and assumes that action will be taken iranediately to restore charging capability to the battery with the alternate charger (i.e., normal or backup). Under normal plant load conditions, the loss of the battery charger for ( 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months has a negligible effect on the rated battery capacity and does not impact the DC electrical power subsystem's capability to perform its OBA safety function.

Immediately following the loss of the charging capability, battery cell parameters may not meet Category A limits because these limits assume that the battery is being charged at a minimum float voltage. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows for re-establishing charging capability such that Category A parameters can be met. Operation with the DC electrical power subsystem battery charger inoperable is not allowed for an indefinite period of time even when the battery cell parameters have been verified to meet the category A limits of Table 3.8.6-1. The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time provides a period of time to correct the problem commensurate with the importance of maintaining the DC electrical power subsystem battery charger in an OPERABLE status.

C.1 If the battery cell parameters cannot be maintained within Category A limits as specified in LCO 3.8.6. the short term capability of the battery is also degraded and the battery must be declared inoperable.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 states that Survei llances required by SR 3.8.4.1 through SR 3.8.4.8 are applicable in these MODES. See the corresponding Bases for LCO 3.8.4 for a discussion of each (continued)

PALO VERDE UNITS 1,2,3 B 3.8.5-5 REVISION 1

DC Sources Shutdown 8 3.8.5 BASES SURVEILLANCE SR 3.8.5. 1 (continued)

REQUIREMENTS SR. This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the requi red power supply or otherwise rendered inoperable during the performance of SRs. It is the intent that these SRs must still be capable of being met, but actual performance is not required.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

PALO VERDE UNITS 1,2,3 B 3.8.5-6 REVISION 1

0 Battery Cell Parameters 8 3.8.6 BASES SURVEILLANCE Table 3.8.6-1 (continued)

REQUIREMENTS effects. In addition to this allowance, footnote (a) to Table 3.8.6-1 permits the electrolyte level to be above the specified maximum level during equalizing charge, provided it is not overflowing. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. IEEE-450 (Ref'. 3) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The Category A limit specified for float voltage is > 2. 13 V per cell (low specific gravity cells) or 2 2. 18 V per cell (ATILT). This value is based on the battery vendor recommendation which states that prolonged operation of cells < 2. 13 V (low specific gravity cells) or < 2. 18 V (AT8T) can reduce the life expectancy of cells.

The Category A limit specified for specific gravity for each pilot cell is > 1.200 (low specific gravity cells) or > 1.290 (ATET) (0.015 [low specific gravity cells3 or 0.10 [AT8T]

below the vendor fully charged nominal specific gravity or a battery charging current that had stabilized at a low value).

This value is characteristic of a charged cell with adequate capacity. According to IEEE-450 (Ref. 3), the specific gravity readings are based on a temperature of 77'F (25'C).

The specific gravity readings are corrected for actual electrolyte temperature and level. For each 3'F (1.67'C) above 77'F (25'C). 1 point (0.001) is added to the reading; 1 point is subtracted for each 3'F below 77'F. The specific gravity of the electrolyte in a cell increases with a loss of water due to electrolysis or evaporation.

Category 8 defines the normal parameter limits for each connected cell. The term "connected cell" excludes any battery cell that may be jumpered out.

The Category 8 limits specified for electrolyte level and float voltage are the same as those specified for Category A and have been discussed above. Footnote (d) to Table 3.8.6-1 is applicable to Category 8 float voltage. Footnote (d) requires correction for average electrolyte temperature. The Category 8 limit specified for specific gravity for each connected cell is > 1. 195 (low specific gravity cells) or

> 1.280 (ATILT) (0.020 below the vendor fully charged, nominal (continued)

PALO VERDE UNITS 1,2,3 8 3.8.6-5 REVISION .1

0 e

I

Battery Cel 1 Parameters 8 3.8.6 BASES SURVEILLANCE Table 3.8.6-1'continued)

REQUIREMENTS specific gravity) with the average of all connected cells

> 1.205 (low specific gravity cells) or > 1.290 (AT8T) (0.010 below the vendor fully charged, nominal specific gravity).

These values are based on vendor's recommendations. The minimum specific gravity value required for each cell ensures that, the effects of a highly charged or newly installed cell will not mask overall degradation of the battery .

'Category C defines the limit for each connected cell. These values, although reduced, provide assurance that sufficient capacity exists to perform the intended function and maintain a margin of safety. When any battery parameter is outside the Category C limit. the assurance of sufficient capacity described above no longer exists and the battery must be declared inoperable.

The Category C limit specified for electrolyte level (above the top of the plates and not overflowing) ensures that the plates suffer no physical damage and maintain adequate electron transfer capability. The Category C Allowable Value for float voltage is based on vendor recommendations which state that a cell voltage of 2.07 V or below (low specific gravity cells) or 2. 14 V or below (AT8T), under float conditions and not caused by elevated temperature of the cell, indicates internal cell problems and may require cell replacement.

The Category C limit of average specific gravity > 1. 195 (low specific gravity cells) or > 1.280 (AT&T) is based on vendor recommendations (0.020 below the vendor recommended fully charged, nominal specific gravity). In addition to that it limit, is requi red that the specific gravity for each connected cell must be no less than 0.020 below the average of all connected cells. This limit ensures that the effect of a highly charged or new cell does not mask overall degradation of the battery.

Footnotes (b) and (c) to Table 3.8.6-1 are applicable to Category A, 8, and C specific gravity. Footnote (b) to Table 3.8.6-1 requires specific gravity correction for electrolyte level and temperature, with the exception that level correction is not required when battery charging current is ( 2 amps on float charge. This current provides, in general, an indication of overall battery condition.

(continued)

PALO VERDE UNITS 1,2,3 B 3.8.6-6 REVISION 1

e Inverters Shutdown 8 3.8.8 8 3.8 ELECTRICAL POWER SYSTEMS 8 3.8.8 Inverters Shutdown BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, "Inverters Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and SAFETY ANALYSES transient analyses in the UFSAR Chapter 6 (Ref. 1) and

~

Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC to AC inverters are designed to provide the required capacity, capability. redundancy.

and reliability to ensure the availability of necessary power to the Reactor Protective System and Engineered Safety Features Actuation System instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems'PERABILITY.

The OPERABILITY of the minimum inverters to each AC vital instrument bus during MODES 5 and 6, and during movement of irradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident.

In general, when the unit is shut down, the Technical Specification requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single fai lure and concurrent loss of all offsite or all onsite power is not (continued)

PALO VERDE UNITS 1.2,3 8 3.8.8-1 REVISION 1

0 t

0 0

Inverters Shutdown B 3.8.8 BASES APPLICABLE required. The rationale for this is based on the fact that SAFETY ANALYSES many Design Basis Accidents (DBAs) that are analyzed in (continued) MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and prcssure'nd the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and minimal in consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCO for required systems.

The inverters support the equipment and instrumentation required to mitigate the Loss of Shutdown Cooling and Loss of RCS Inventory accidents analyzed in response to NRC Generic Letter 88-17 "Loss of Decay Heat Removal." The Generic Letter does not require the assumption of a single failure and concurrent loss of all offsite or all onsite power.

The inverters were previously identified as part of the distribution system and, as such. satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

e, The required inverters ensure power for the instrumentation down the reactor and maintain the for it availability of electrical systems required to shut in a safe condition after an anticipated operational occurrence or a postulated DBA.

The battery powered inverters provide uninterruptible supply of AC electrical power to the AC vital instrument buses even if the 4. 16 kV safety buses are de-energized. OPERABILITY of the inverters requi res that the AC vital instrument bus be powered by the inverter. This ensures the availability of sufficient inverter power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

In Modes 5 & 6 and during movement of i rradiated fuel assemblies, one train of inverters, consisting of two channels with one inverter per channel, is required to be OPERABLE to support the requirements of LCO 3.8.10 "Distribution Systems Shutdown". This train of inverters also supports the one required OPERABLE Diesel Generator specified in LCO 3.8.2 "AC Sources Shutdown" on that same train. For situations where redundant trains of supported (continued)

PALO VERDE UNITS 1,2.3 B 3.8.8-2 REVISION 1

A 0

e

Inverters Shutdown B 3.8.8 BASES LCO equipment are required to be OPERABLE by LCO 3.8.10, the (continued) necessary AC vital instrument bus(es) associated with the additional train of inverters shall be energized by either the bus(es)'ssociated inverter or AC voltage regulator.

For those situations where an AC vital instrument bus associated with the additional train of inverters is energized by its inverter, the corresponding DC bus must be energized by a minimum of its associated battery charger or backup battery charger per LCO 3.8.5.

APPLICABILITY The inverters required to be OPERABLE in MODES 5 and 6, and during movement of irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available for the irradiated fuel .in the core:

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Inverter requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.7.

ACTIONS The Actions are modified by a Note that identifies required Action A.2.3 is not applicable to the movement of i rradiated fuel assemblies in Modes 1 through 4.

A. 1. A.2. 1. A.2.2. A.2.3. and A.2.4 If two trains of AC vital instrument buses are required by LCO 3.8. 10, "Distribution Systems Shutdown," of the two required trains, the remaining bus(es) with AC power available may be capable of supporting sufficient requi red features to allow continuation of CORE ALTERATIONS, fuel movement, operations with a potential for draining the reactor vessel, and operations with a potential for positive reactivity additions. By the allowance of the option to declare required features inoperable with the associated inverter(s) inoperable, appropriate restrictions will be (continued)

PALO VERDE UNITS 1,2.3 B 3.8.8-3 REVISION 1

Inverters Shutdown 8 3.8.8 BASES ACTIONS A. 1, A.2. 1 ~ A.2.2, A.2.3 ~ and A.2.4 (continued) implemented in accordance with the affected required features LCOs'equired Actions. In many instances'his option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, movement of irradiated fuel assemblies, and operations involving positive reactivity additions). The Required Action to suspend positive reactivity additions does not preclude actions to maintain or increase reactor vessel inventory, provided the required SDN is maintained.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. If moving i rradiated fuel assemblies while in NODES 1, 2, 3, or 4, the fuel movement is independent of reactor operations.

Therefore, inability to iraaediately suspend movement of i rradiated fuel assemblies would not be sufficient reason to require a reactor shutdown. These actions minimize the probability oi the occurrence of postulated events. It is further required to immediately initiate action to restore the required inverters and to continue this action unti 1 restoration is accomplished in order to provide the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the requi red times for actions requiring prompt attention. The restoration of the required inverters should be completed as quickly as possible in order to minimize the time the unit safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the inverters are f'unctioning properly with all requi red circuit breakers closed and AC vital instrument buses energized from the inverter. The verification of proper voltage and frequency output ensures that the required power is readily available for the instrumentation connected to the AC vital instrument buses. The 7 day Frequency takes into account, the redundant (continued) 8 3.8.8-4 REVISION 1

0 0

Inverters Shutdown B 3.8.8 BASES SURVEILLANCE SR 3.8.8.1 (continued)

REQUIREMENTS capability of the inverters and other indications available in the control room that alert the operator to inverter malfunctions.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.'ALO VERDE UNITS 1,2,3 8 3.8.8-5 REVISION 1

0 Nuclear Instrumentation B 3.9.2 BASES SURVEILLANCE SR 3.9.2.1 REQUIREMENTS SR 3.9.2.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that, the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.

The Frequency is based on operating experience that demonstrates the rarity of channel fai lure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, a CHANNEL'HECK minimizes the chance of loss of function due to fai lure of redundant channels.

SR 3.9.2.2 SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION every 18 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.

The detectors are of simple construction, and any fai lures in the detectors will be apparent as change in channel output. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational.

This SR is an extension of SR 3.3.12 for the Boron Dilution Alarm System CHANNEL CALIBRATION listed here because of its Applicability in these MODES. The 18 month Frequency is based on operating experience which has shown these components usually pass the Surveillance when performed on the 18 month Frequency. The CHANNEL CALIBRATION is normally performed during a plant outage, but can be performed with the reactor at power performed.

if detector curve determination is not (continued)

PALO VERDE UNITS 1,2,3 8 3.9.2-3 REVISION 1

Nucl ear Instrumentati on 8 3.9.2 BASES SURVEILLANCE SR 3.9.2.2 (continued)

REQUIREMENTS Detector curve determination can only be performed under conditions that apply during a plant outage since the flux level needs to be at shutdown levels for detector energization.

REFERENCES l. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC ZB, and GDC 29.

2. UFSAR. Section 15.4.6.

PALO VERDE UNITS 1,2,3 B 3.9.2-4 REVISION 1

0 Containment Penetrati ons 8 3.9.3 BASES SURVEILLANCE SR 3.9.3.1 (continued)

REQUIREMENTS The Surveillance is performed every 7 days during CORE ALTERATIONS or movement of'rradiated fuel assemblies within the containment. The Surveillance interval is selected to be commensurate with the normal duration of time to complete fuel handling operations. A surveillance before the start of'efueling operations will provide two or three survei llance verifications during the applicable period for this LCO. As such, this Surveillance ensures that a postulated fuel handling accident that releases fission product radioactivity within the containment will not result in a release of fission product radioactivity to the environment.

SR 3.9.3.2 This Surveillance demonstrates that each containment purge valve actuates to its isolation position on manual initiation or on an actual or simulated high radiation signal. The 18 month Frequency maintains consistency with other similar ESFAS instrumentation and valve testing requirements. The CPIAS is tested in accordance with LCO 3.3.8, "Containment Purge Isolation Actuation Signal (CPIAS)." SR 3.6.3.5 demonstrates that the isolation time of each valve is in accordance with the Inservice Testing Program requi rements. These survei llances performed during MODE 6 will ensure that the valves are capable of closing after a postulated fuel handling accident to limit a release of fission product radioactivity from the containment.

REFERENCES 1. GPU Nuclear Safety Evaluation SE-0002000-001, Rev. 0.

May 20, 1988.

2. UFSAR, Section 15.7.4.

3. NUREG-0800, Section 15.7.4, Rev. 1, July 1981.

PALO VERDE UNITS 1,2,3 B 3.9.3-5 REVISION 1

0 SDC and Coolant Circulation - High Water Level B 3.9.4 BASES LCO Only one SDC loop is required for decay heat removal in MODE 6, with water level > 23 ft above the top of the reactor vessel flange. Only one SDC loop is required because the volume of water above the reactor vessel flange provides backup decay heat removal capability. At least one SDC loop must be in operation to provide:

a. Removal of decay heat;

b. Mixing of borated coolant to minimize the possibility of a criticality; and

c. Indication of reactor coolant temperature.

An OPERABLE SDC train is composed of an OPERABLE SDC pump (LPSI or CS) capable of providing flow to the SDC heat exchanger for heat removal. SDC pumps are OPERABLE are capable of being powered and are able to provide flow if they (current Section XI), if required.

The LCO is modified by a Note that allows the requi red operating SDC loop to be removed from service for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in each 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided no operations are permitted that would cause a reduction of the RCS boron concentration. Boron concentration reduction is prohibited because uniform concentration distribution cannot be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, surveillance testing of ECCS pumps, and RCS to SDC isolation valve testing. During this 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months eriod, decay heat is removed by natural convection to the arge mass of water in the refueling cavity.

APPLICABILITY One SDC loop must be in operation in MODE 6, with the water level ) 23 ft above the top of the reactor vessel flange, to rovide decay heat removal. The 23 ft level was selected ecause it corresponds to the 23 ft requirement established for fuel movement in LCO 3.9.6, "Refueling Water Level-Fuel Assemblies."

(continued)

PALO VERDE UNITS 1,2.3 B 3.9.4-2 REVISION 1

SDC and Coolant Circulation - Low Water Level B 3.9.5 I

BASES LCO In NODE 6, with the water level < 23 f't above the top of the reactor vessel flange, both SDC loops must be OPERABLE.

Additionally, one loop of the SDC System must be in operation in order to provide:

a. Removal of decay heat;

b. Nixing of borated coolant to minimize the possibility of a criticality; and

c. Indication of reactor coolant temperature.

An OPERABLE SDC train is composed of an OPERABI E SDC pump (LPSI or CS) capable of providing flow to the SDC heat exchanger for heat removal. SDC pumps are OPERABLE if they are capable of being powered and are able to provide flow (current Section XI), if required.

Both SDC pumps may be aligned to the Refueling Water Tank (RWT) to support filling the refueling cavity or for performance of required testing.

The LCO is modified by a Note that allows a required operating SDC loop to be removed from service for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months in each 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period, provided no operations are permitted that would cause a reduction of the RCS boron concentration. Boron concentration reduction is prohibited because uniform concentration distribution cannot, be ensured without forced circulation. This permits operations such as core mapping or alterations in the vicinity of the reactor vessel hot leg nozzles, surveillance testing of ECCS pumps.

and RCS to SDC isolation valve testing. During this I hour eriod, decay heat is removed by natural convection to the e arge mass of water in the refueling cavity.

APPLICABILITY Two SDC loops are required to be OPERABLE, and one SDC loop must be in operation in NODE 6, with the water level < 23 ft above the top of the reactor vessel flange, to provide decay heat removal. Requirements for the SDC System in other NODES are covered by LCOs in Section 3.4, Reactor Coolant System. NODE 6 requirements, with a water level > 23 ft above the reactor vessel flange, are covered in LCO 3.9.4 ~

"Shutdown Cooling and Coolant Circulation - High Water Level."

(continued)

PAI 0 VERDE UNITS 1,2,3 B 3.9.5-2 REVISION 1

l,

)

0

'

ML17313B060

Text

Navigation menu

Search