Text

Issuance of Amendments Nos. 209, 209, and 209 - Regarding Adoption of Risk Informed Completion Times in Technical Specifications (CAC Nos. MF6576, MF6577, and MF6578; EPID L-2015-LLA-0001)
	ML19085A525
Person / Time
Site:	Palo Verde
Issue date:	05/29/2019
From:	Siva Lingam; Plant Licensing Branch IV
To:	Bement R; Arizona Public Service Co
	Lingam S, 301-415-1564
References
	CAC MF6576, CAC MF6577, CAC MF6578, EPID L-2015-LLA-0001
	Download: ML19085A525 (178)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION Mr. Robert S. Bement Executive Vice President Nuclear/

Chief Nuclear Officer Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ 85072-2034 WASHINGTON, D.C. 20555-0001 May 29, 2019

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENT NOS. 209, 209, AND 209 RE: ADOPTION OF RISK-INFORMED COMPLETION TIMES IN TECHNICAL SPECIFICATIONS (CAC NOS. MF6576, MF6577, AND MF6578; EPID L-2015-LLA-0001)

Dear Mr. Bement:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment Nos. 209, 209, and 209, to Renewed Facility Operating License Nos. NPF-41, NPF-51, and NPF-74 for the Palo Verde Nuclear Generating Station, Units 1, 2, and 3, respectively. The amendments consist of changes to the technical specifications (TSs) in response to your application dated July 31, 2015, as supplemented by letters dated April 11, 2016; November 3, 2017; and May 18, June 1, September 21, and October 5, 2018.

The amendments modify the TSs to permit the use of risk-informed completion times in accordance with Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Revision 0-A, "Risk-informed Technical Specification Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines." For selected TS action statements, the associated completion times would be replaced with a reference to a licensee-controlled document.. The required completion times in the licensee-controlled documents will be managed in accordance with the licensee's Risk-Informed Completion Time Program.

A copy of the related safety evaluation is also enclosed. A notice of issuance will be included in the Commission's biweekly Federal Register notice.

Docket Nos. STN 50-528, STN 50-529, and STN 50-530

Enclosures:

1. Amendment No. 209 to NPF-41

2. Amendment No. 209 to NPF-51

3. Amendment No. 209 to NPF-74

4. Safety Evaluation cc: Listserv Sincerely,

~cr* ~

Siva P. Lingam, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. ~5-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-528 PALO VERDE NUCLEAR GENERATING STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 209 Li.cense No. NPF-41

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 31, 2015, as supplemented by letters dated April 11, 2016; November 3, 2017; and May 18, June 1, September 21, and October 5, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraphs 2.C(2) and 2.C(14) of Renewed Facility Operating License No. NPF-41 is hereby amended to read as follows:

(2)

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

( 14)

Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

3.

This license amendment is effective as of the date of issuance and shall be implemented within 270 days of the date of issuance.

Attachment:

Changes to the Renewed Facility Operating License No. NPF-41 and Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance:

May 29, 201 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY. ET AL.

DOCKET NO. STN 50-529 PALO VERDE NUCLEAR GENERATING STATION. UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 209 License No. NPF-51

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 31, 2015, as supplemented by letters dated April 11, 2016; November 3, 2017; and May 18, June 1, September 21, and October 5, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraphs 2.C(2) and 2.C(9) of Renewed Facility Operating License No. NPF-51 is hereby amended to read as follows:

(2)

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(9)

Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

3.

This license amendment is effective as of the date of issuance and shall be implemented within 270 days of the date of issuance.

Attachment:

Changes to the Renewed Facility Operating License No. NPF-51 and Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Dateoflssuance:

May 29, 2019

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-530 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 209 License No. NPF-74

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated July 31, 2015, as supplemented by letters dated April 11, 2016; November 3, 2017; and May 18, June 1, September 21, and October 5, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 1 O CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraphs 2.C(2) and 2.C(5) of Renewed Facility Operating License No. NPF-74 is hereby amended to read as follows:

(2)

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(5)

Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

3.

This license amendment is effective as of the date of issuance and shall be implemented within 270 days of the date of issuance.

Attachment:

Changes to the Renewed Facility Operating License No. NPF-74 and Technical Specifications Date of Issuance: May 29, 2019 FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

A TI ACHMENT TO LICENSE AMENDMENT NOS. 209, 209, AND 209 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 PALO VERDE NUCLEAR GENERATING STATION, UNITS 1. 2. AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530 Replace the following pages of the Renewed Facility Operating Licenses Nos. NPF-41, NPF-51, and NPF-74, Appendix A Technical Specifications and Appendix D Additional Conditions with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Renewed Facility Operating License No. NPF-41 REMOVE 5

6 INSERT 5

6 Renewed Facility Operating License No. NPF-51 REMOVE 6

7 INSERT 6

7 Renewed Facility Operating License No. NPF-74 REMOVE 4

INSERT 4

Technical Specifications REMOVE 1.3-13 3.3.6-1 3.3.6-2 3.4.10-1 3.4.10-2 3.4.12-1 3.4.12-2 3.5.1-1 3.5.1-2 INSERT 1.3-13 1.3-14 1.3-15 3.3.6-1 3.3.6-2 3.4.10-1 3.4.10-2 3.4.12-1 3.4.12-2 3.5.1-1 3.5.1-2 Technical Specifications (Continued)

REMOVE INSERT 3.5.3-1 3.5.3-1 3.5.5-1 3.5.5-1 3.6.2-3 3.6.2-3 3.6.3-1 3.6.3-1 3.6.3-2 3.6.3-2 3.6.3-3 3.6.3-3 3.6.3-4 3.6.3-4 3.6.3-5 3.6.3-5 3.6.3-6 3.6.3-6 3.6.3-7 3.6.6-1 3.6.6-1 3.7.2-2 3.7.2-2 3.7.2-3 3.7.2-3 3.7.3-1 3.7.3-1 3.7.3-2 3.7.3-2 3.7.4-1 3.7.4-1 3.7.4-2 3.7.4-2 3.7.5-1 3.7.5-1 3.7.5-2 3.7.5-2 3.7.5-3 3.7.5-3 3.7.5-4 3.7.5-4 3.7.5-5 3.7.7-1 3.7.7-1 3.7.7-2 3.7.7-2 3.7.8-1 3.7.8-1 3.7.8-2 3.7.8-2 3.7.10-1 3.7.10-1 3.7.10-2 3.8.1-2 3.8.1-2 3.8.1-3 3.8.1-3 3.8.1-4 3.8.1-4 3.8.1-5 3.8.1-5 3.8.1-6 3.8.1-6 3.8.1-7 3.8.1-7 3.8.1-8 3.8.1-8 3.8.1-9 3.8.1-9 3.8.1-10 3.8.1-10 3.8.1-11 3.8.1-11 3.8.1-12 3.8.1-12 3.8.1-13 3.8.1-13 3.8.1-14 3.8.1-14 3.8.1-15 3.8.1-15 3.8.1-16 3.8.1-16 3.8.1-17 3.8.1-17 3.8.1-18 3.8.4-1 3.8.4-1 Technical Specifications (Continued)

REMOVE INSERT 3.8.4-2 3.8.4-2 3.8.4-3 3.8.4-3 3.8.4-4.

3.8.7-1 3.8.7-1 3.8.7-2 3.8.7-2 3.8.9-1 3.8.9-1 3.8.9-2 3.8.9-2 5.5-19 5.5-19 5.5-19a 5.5-20 5.5-20a 5.5-21 5.5-22 Appendix D - Additional Conditions REMOVE 1

2 3

4 5

INSERT 1

2 3

(1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power), in accordance with the conditions specified herein.

(2)

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3)

Antitrust Conditions (4)

(5)

(6)

(7)

This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed license.

Operating Staff Experience Requirements Deleted Post-Fuel-Loading Initial Test Program (Section 14, SER and SSER 2}*

Deleted Environmental Qualification Deleted Fire Protection Program APS shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, as supplemented and amended, and as approved in the SER through Supplement 11, subject to the following provision:

APS may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect th~ ability to achieve and maintain safe shutdown in the event of a fire.

The parenthetical notation following the title of many license conditions denotes the section of the Safety Evaluation Report and/or its supplements wherein the license condition is discussed.

Renewed Facility Operating License No. NPF-41 Amendment No. 209

(8)

(9) Emergency Preparedness Deleted Results of Piping Vibration Test Program (Section 3.9.2, SER)

Deleted (10)

Response to Salem ATWS Event (Section 7.2, SSER 7, and Section 1.11, SSER 8)

Deleted (11)

Supplement No. 1 to NUREG-0737 Requirements Deleted (12)

Radiochemistry Laboratory (Section 7.3.1.5(3), Emergency Plan)

Deleted

( 13)

RCP Shaft Vibration Monitoring Program (Section 5.4.1, SSER 12)

Deleted

( 14)

Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

( 15)

Mitigation Strategy License Condition APS shall develop and maintain strategies for addressing large fires and explosions and that includes the following key areas:

(a)

Fire fighting response strategy with the following elements:

1.

Pre-defined coordinated fire response strategy and guidance.

2.

Assessment of mutual aid fire fighting assets.

3.

Designated staging areas for equipment and materials.

4.

Command and control.

5.

Training of response personnel.

(b)

Operations to mitigate fuel damage considering the following:

1.

Protection and use of personnel assets.

2.

Communications.

Renewed Facility Operating License No. NPF-41 Amendment No. 209

(1)

(2)

(3) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power) in accordance with the conditions specified herein.

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

Antitrust Conditions This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

( 4)

Operating Staff Experience Requirements (Section 13.1.2, SSER 9}*

Deleted (5)

(6)

(7)

Initial Test Program (Section 14, SER and SSER 2)

Deleted Fire Protection Program APS shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, as supplemented and amended, and as approved in the SER through Supplement 11, subject to the following provision:

APS may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

lnservice Inspection Program (Sections 5.2.4 and 6.6, SER and SSER 9)

Deleted

The parenthetical notation following the title of many license conditions denotes the section of the Safety Evaluation Report and/or its supplements wherein the license condition is discussed.

Renewed Facility Operating License No. NPF-51 Amendment No. 209

(8)

(9) Supplement No. 1 to NUREG-0737 Requirements Deleted Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

( 10)

Mitigation Strategy License Condition APS shall develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a)

Fire fighting response strategy with the following elements:

1.

Pre-defined coordinated fire response strategy and guidance.

2.

Assessment of mutual aid fire fighting assets.

3.

Designated staging areas for equipment and materials.

4.

Command and control.

5.

Training of response personnel.

(b)

Operations to mitigate fuel damage considering the following:

1.

Protection and use of personnel assets.

2.

Communications.

3.

Minimizing fire spread.

4.

Procedures for implementing integrated fire response strategy.

5.

Identification of readily-available pre-staged equipment.

6, Training on integrated fire response strategy.

7.

Spent fuel pool mitigation measures.

(c)

Actions to minimize release to include consideration of:

1.

Water spray scrubbing.

2.

Dose to onsite re~ponders.

Renewed Facility Operating License No. NPF-51 Amendment No. 209 (4)

Pursuant to the Act and 10 CFR Part 30, 40, and 70, APS to receive, possess, and use in amounts required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5)

Pursuant to the Act and 10 CFR Parts 30, 40, and 70, APS to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1)

(2)

Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal ( 100% power), in accordance with the conditions specified herein.

Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 209, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3)

Antitrust Conditions (4)

This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

Initial Test Program (Section 14, SER and SSER 2)

Deleted (5)

Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 209, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

Renewed Facility Operating License No. NPF-74

Amendment No. 209

1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

Completion Times 1.3 The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition Bis exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.

EXAMPLES ACTIONS EXAMPLE 1.3-8 CONDITION A. One subsystem A.1 inoperable.

B. ----------NOTES----------

8.1

1. Not applicable when second subsystem intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two subsystems inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION COMPLETION TIME Restore subsystem to 7 days OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months subsystem to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program 1.3-13 AMENDMENT NO. 447-, 209

1.3 Completion Times EXAMPLES ACTIONS EXAMPLE 1.3-8 (continued)

CONDITION REQUIRED ACTION C. Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND C.2 Be in MODE 5.

Completion Times 1.3 COMPLETION TIME 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two Notes. The first note states it is not applicable if the second subsystem is intentionally made inoperable. The second Note provides restrictions applicable to these "loss of function" Conditions. The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service. The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply a RICT or to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and Condition B is not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

PALO VERDE UNITS 1,2,3 1.3-14 AMENDMENT NO. 209

1.3 Completion Times Completion Times 1.3 EXAMPLES EXAMPLE 1.3-8 (continued)

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant conditions result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and Care exited, and therefore, the Required Actions of Condition C may be terminated.

IMMEDIATE COMPLETION TIME When "Immediately" is used as a Completion Time, the Required Action should be pursued without delay and in a controlled manner.

PALO VERDE UNITS 1,2,3 1.3-15 AMENDMENT NO. 209

3.3 INSTRUMENTATION ESFAS Logic and Manual Trip 3.3.6 3.3.6 Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1.

APPLICABILITY: According to Table 3.3.6-1.

ACTIONS

NOTE-----------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION A.

One or more Functions A.1 Restore channel to with one Matrix Logic OPERABLE status.

channel inoperable.

OR Three Matrix Logic channels are inoperable due to a common power source failure de-energizing three matrix power supplies.

B.

One or more Functions B.1 Restore channel to with one Manual Trip or OPERABLE status.

Initiation Logic channel inoperable.

PALO VERDE UNITS 1,2,3 3.3.6-1 COMPLETION TIME 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months 48 hours OR In accordance with the Risk Informed Completion Time Program (continued)

AMENDMENT NO. 44-7, 209

ACTIONS (continued)

CONDITION C.

One or more Functions C.1 with two Initiation Logic channels or Manual Trip channels affecting the same trip leg inoperable.

AND C.2 D.

One or more Functions 0.1 with one Actuation Logic channel inoperable.

E.

Required Action and E.1 associated Completion AND Time of Conditions for Containment Spray E.2 Actuation Signal, Main Steam Isolation Signal or Auxiliary Feedwater Actuation Signal not met.

PALO VERDE UNITS 1,2,3 ESFAS Logic and Manual Trip 3.3.6 REQUIRED ACTION COMPLETION TIME Open at least one Immediately contact in the affected trip leg of both ESFAS Actuation Logics.

Restore channels to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

NO TE---------

One channel of Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillances, provided the other channel is OPERABLE.

Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Be in MODE4.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (continued) 3.3.6-2 AMENDMENT NO. 447,209

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves - Modes 1, 2 and 3 LCO 3.4.10 Four pressurizer safety valves shall be OPERABLE with lift settings

?: 2450.25 psia and~ 2549.25 psia.

APPLICABILITY:

MODES 1, 2, and 3,

NOTE-----------------------------------------

The lift settings are not required to be within LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

ACTIONS CONDITION A. -----------NOTES------------

1. Not applicable when pressurizer safety valve intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

One pressurizer safety valve inoperable.

PALO VERDE UNITS 1,2,3 A.1 REQUIRED ACTION Restore valve to OPERABLE status.

3.4.10-1 COMPLETION TIME 15 minutes OR In accordance with the Risk Informed Completion Time Program AMENDMENT NO. 447, 209

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 ACTIONS (continued)

CONDITION

8.

Required Action and associated Completion Time not met.

OR Two or more pressurizer safety valves inoperable.

REQUIRED ACTION 8.1 Be in MODE 3.

AND 8.2 Be in MODE 4.

SURVEILLANCE REQUIREMENTS SR 3.4.10.1 SURVEILLANCE.

Verify each pressurizer safety valve is OPERABLE in accordance with the INSERVICE TESTING PROGRAM.

Following testing, lift settings shall be within

+/- 1%.

COMPLETION TIME 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours FREQUENCY In accordance with the INSERVICE TESTING PROGRAM PALO VERDE UNITS 1,2,3 3.4.10-2 AMENDMENT NO.~. 209

3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents Pressurizer Vents 3.4.12 LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3.

MODE 4 with RCS pressure ~ 385 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

Two or three required A.1 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer vent paths pressurizer vent paths inoperable.

to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. ----------NOTES-----------

B.1 Restore one 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months

1. Not applicable when pressurizer vent path last pressurizer vent to OPERABLE status.

OR path intentionally made inoperable.

In accordance with

2. The following the Risk Informed Section 5.5.20 Completion Time constraints are Program applicable: parts b, c.2, c.3, d, e, f, g, and h.

All pressurizer vent paths inoperable.

PALO VERDE UNITS 1,2,3 3.4.12-1 AMENDMENT NO. 4$3,209

Pressurizer Vents 3.4.12 ACTIONS (CONTINUED)

CONDITION REQUIRED ACTION COMPLETION TIME C.

Required Action and associated Completion Time of Condition A, or B not met.

C.1 AND C.2 Be in MODE 3.

Be in MODE 4 with RCS pressure< 385 psia.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 24 hours SURVEILLANCE REQUIREMENTS SR 3.4.12.1 SR 3.4.12.2 SURVEILLANCE FREQUENCY Perform a complete cycle of each Pressurizer In accordance Vent Valve.

with the Surveillance Frequency Control Program Verify flow through each pressurizer vent path.

In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.4.12-2 AMENDMENT NO. 4-88, 209

3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.1 Safety Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, SITs-Operating 3.5.1 MODES 3 and 4 with pressurizer pressure ~ 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One SIT inoperable due A.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration OPERABLE status.

not within limits.

OR One SIT inoperable due to inability to verify level or pressure.

B.

One SIT inoperable for B.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status.

Condition A.

C.

NOTES-----------

C.1 Restore all but one SIT to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable when OPERABLE status.

the second or a OR subsequent SIT intentionally made In accordance inoperable.

with the Risk Informed

2. The following Completion Time Section 5.5.20 Program constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons other than Condition A.

PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 448,209

ACTIONS (continued)

CONDITION D.

. Required Action and D.1 associated Completion Time of Condition A, B, AND or C not met.

D.2 SURVEILLANCE REQUIREMENTS REQUIRED ACTION Be in MODE 3.

Reduce pressurizer pressure to

< 1837 psia.

SURVEILLANCE SR 3.5.1.1 SR 3.5.1.2 SR 3.5.1.3 Verify each SIT isolation valve is fully open.

Verify borated water volume in each SIT is ;?:

28% narrow range and $ 72% narrow range.

Verify nitrogen cover pressure in each SIT is ;?:

600 psig and$ 625 psig.

SITs-Operating 3.5.1 COMPLETION TIMI=

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.5.1-2 AMENDMENT NO. 483, 209

3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS -

Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, ECCS -

Operating 3.5.3 MODE 3 with pressurizer pressure ~ 1837 psia or with RCS Tc~ 485°F.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem A.1 Restore subsystem 7 days inoperable.

to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B. One or more trains B.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A.

OR AND In accordance with the Risk Informed At least 100% of the Completion Time ECCS flow equivalent to a Program single OPERABLE ECCS train available.

C.

Required Action and C.1 Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

AND C.2 Reduce pressurizer 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months pressure to

< 1837 psia.

AND C.3 Reduce RCS Tc to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months

< 485°F.

PALO VERDE UNITS 1,2,3 3.5.3-1 AMENDMENT NO.~. 209

3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.5 Refueling Water Tank (RWT)

LCO 3.5.5 The RWT shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION A. RWT boron A.1 Restore RWT to concentration not within OPERABLE status.

limits.

OR RWT borated water temperature not within limits.

B.

NOTES-----------

B.1 Restore RWT to

1. Not applicable when OPERABLE status.

RWT is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

RWT inoperable for reasons other than Condition A.

C. Required Action and C.1 Be in MODE 3.

associated Completion AND Time not met.

C.2 Be in MODE 5.

PALO VERDE UNITS 1,2,3 3.5.5-1 RWT 3.5.5 COMPLETION TIME 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 1 hour OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours AMENDMENT NO. 7, 209

ACTIONS CONDITION B.

(continued) 8.1 AND 8.2 AND 8.3 C.

One or more C.1 containment air locks inoperable for reasons other than Condition A or B.

AND C.2 AND C.3 PALO VERDE UNITS 1,2,3 REQUIRED ACTION Verify an OPERABLE door is closed in the affected air lock.

Lock an OPERABLE door closed in the affected air lock.

NOTE-----------

Air lock doors in high radiation areas may be verified locked closed by administrative means.

Verify an OPERABLE door is locked closed in the affected air lock.

Initiate action to evaluate overall containment leakage rate per LCO 3.6.1.

Verify a door is closed in the affected air lock.

Restore air lock to OPERABLE status.

Containment Air Locks 3.6.2 COMPLETION TIME 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 24 hours Once per 31 days Immediately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 24 hours OR In accordance with the Risk Informed Completion Time Program (continued) 3.6.2-3 AMENDMENT NO. 447, 209

3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Valves Containment Isolation Valves 3.6.3 LCO 3.6.3 Each required containment isolation valve shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS

NOTES---------------------------------------------------

1.

Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.

2.

Separate Condition entry is allowed for each penetration flow path.

3.

Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves.

4.

Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment,"

when leakage results in exceeding the overall containment leakage rate acceptance criteria.

5.

A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in accordance with SR 3.6.1.1.

CONDITION REQUIRED ACTION COMPLETION TIME A.

NOTE-----------

A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path by penetration flow paths use of at least one OR with two required closed and de-activated containment isolation automatic valve, closed In accordance with valves.

manual valve, blind the Risk Informed flange, or check valve Completion Time One or more penetration with flow through the Program flow paths with one valve secured.

required containment AND isolation valve inoperable except for purge valve leakage not within limit.

(continued)

PALO VERDE UNITS 1,2,3 3.6.3-1 AMENDMENT NO. 4-ee, 209

ACTIONS CONDITION A.

(continued)

A.2 B.

NOTES----------

B.1

1. Only applicable to penetration flow paths with two required containment isolation valves.

2. RICT is not applicable when the second containment isolation valve is intentionally made inoperable.

3. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

PALO VERDE UNITS 1,2,3 Containment Isolation Valves 3.6.3 REQUIRED ACTION COMPLETION TIME

NO TE---------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path following isolation for is isolated.

isolation devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months penetration flow path by use of at least one OR closed and de-activated In accordance with the automatic valve, Risk Informed closed manual valve, Completion Time or blind flange.

Program (continued) 3.6.3-2 AMENDMENT NO. 400, 209

ACTIONS (continued)

CONDITION B.

(continued)

One or more penetration flow paths with two required containment isolation valves inoperable except for purge valve leakage not within limit.

C.

NOTE-----------

C.1 Only applicable to penetration flow paths with only one required containment isolation valve and a closed system.

AND One or more penetration flow paths with one C.2 required containment isolation valve inoperable.

PALO VERDE UNITS 1,2,3 Containment Isolation Valves 3.6.3 REQUIRED ACTION COMPLETION TIME Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months penetration flow path by use of at least one OR closed and de-activated automatic valve, closed manual In accordance with the Risk Informed valve, or blind flange.

Completion Time Program

NOTE------------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path is following isolation I

isolated.

3.6.3-3 AMENDMENT NO. 4-ee, 209

ACTIONS (continued)

CONDITION D. -------------NOTES-----------

1. RICT is not applicable when the second containment purge valve is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

One or more penetration flow paths with one or more required containment purge valves not within purge valve leakage limits.

PALO VERDE UNITS 1,2,3 Containment Isolation Valves 3.6.3 REQUIRED ACTION D.1 Isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve with resilient seals, or blind flange.

3.6.3-4 COMPLETION TIME 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued)

AMENDMENT NO. 447, 209

ACTIONS CONDITION D. (continued)

D.2 AND D.3 E.

Required Action and E.1 associated Completion Time not AND met.

E.2 PALO VERDE UNITS 1,2,3 Containment Isolation Valves 3.6.3 REQUIRED ACTION COMPLETION TIME

NO TE----------

Isolation devices in high radiation areas may be verified by use of administrative means.

Verify the affected Once per 31 days penetration flow path following isolation for is isolated.

isolation devices outside containment AND Prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside containment Perform SR 3.6.3.6 for Once per 92 days the resilient seal following isolation purge valves closed to comply with Required Action D.1.

Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months 3.6.3-5 AMENDMENT NO. 4-ii, 209

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS SR 3.6.3.1 SR 3.6.3.2 SR 3.6.3.3 SURVEILLANCE Verify each required 42 inch purge valve is sealed closed except for one purge valve in a penetration flow path while in Condition D of this LCO.

Verify each 8 inch purge valve is closed except when the 8 inch purge valves are open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the valves to be open.

NOTE---------------------------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

Verify each containment isolation manual valve and blind flange that is located outside containment and not locked, sealed or otherwise secured and is required to be closed during accident conditions is closed, except for containment isolation valves that are open under administrative controls.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program

( continued)

PALO VERDE UNITS 1,2,3 3.6.3-6 AMENDMENT NO. 200, 209

Containment Isolation Valves 3.6.3 SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.3.4 SR 3.6.3.5 SR 3.6.3.6 SR 3.6.3.7 SURVEILLANCE

N()TE---------------------------

Valves and blind flanges in high radiation areas may be verified by use of administrative means.

Verify each containment isolation manual valve and blind flange that is located inside containment and not locked, sealed or otherwise secured and required to be closed during accident conditions is closed, except for containment isolation valves that are open under administrative controls.

Verify the isolation time of each required automatic power operated containment isolation valve is within limits.

Perform leakage rate testing for required containment purge valves with resilient seals.

Verify each required automatic containment isolation valve that is not locked, sealed, or otherwise secured in position, actuates to the isolation position on an actual or simulated actuation signal.

FREQUENCY Prior to entering M()DE 4 from M()DE 5 if not performed within the previous 92 days In accordance with the INSERVICE TESTING PR()GRAM In accordance with the Surveillance Frequency Control Program Within 92 days after opening the valve In accordance with the Surveillance Frequency Control Program PAL() VERDE UNITS 1,2,3 3.6.3-7 AMENDMENT N(). 209

3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray System Containment Spray System 3.6.6 LCO 3.6.6 Two containment spray trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3.

MODE 4 when RCS pressure is ;?: 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One containment spray A.1 Restore containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable.

spray train to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B.

Required Action and B.1 Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4 with 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months RCS pressure < 385 psia.

C.

Two containment spray C.1 Enter LCO 3.0.3.

Immediately trains inoperable.

PALO VERDE UNITS 1,2,3 3.6.6-1 AMENDMENT NO. 447, 209

ACTIONS (continued)

CONDITION E.

Three or more MSIV actuator trains inoperable.

OR Required Action and associated Completion Time of Condition A, B, or C not met.

F.

One MSIV inoperable in MODE 1.

G. ----------NOTES-----------

1. Not applicable when the second or a subsequent MSIV intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two or more MSIVs inoperable in MODE 1.

H. Required Action and Associated Completion Time of Condition F or G not met.

PALO VERDE UNITS 1,2,3 E.1 F.1 G.1 H.1 REQUIRED ACTION Declare each affected MSIV inoperable.

Restore MSIV to OPERABLE status.

Restore all but one MSIV to OPERABLE status.

Be in MODE 2.

MSIVs 3.7.2 COMPLETION TIME Immediately 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 3.7.2-2 AMENDMENT NO. 493,209

ACTIONS (continued)

CONDITION REQUIRED ACTION I.

NOTE---------

1.1 Close MSIV.

Separate Condition entry AND is allowed for each MSIV.

1.2 Verify MSIV is closed.

One or more MSIVs inoperable in MODE 2, 3, or 4.

J.

Required Action and J.1 Be in MODE 3.

associated Completion Time of Condition I not AND met.

J.2 Be in MODE 5.

SURVEILLANCE REQUIREMENTS SR 3.7.2.1 SURVEILLANCE

NOTE-------------------------

Not required to be performed prior to entry into MODE 3.

Verify closure time of each MSIV is within limits with each actuator train on an actual or.simulated actuation signal.

MSIVs 3.7.2 COMPLETION TIME 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Once per 7 days 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours FREQUENCY In accordance with the INSERVICE TESTING PROGRAM I

I PALO VERDE UNITS 1,2,3 3.7.2-3 AMENDMENT NO.~. 209

3.7 PLANT SYSTEMS MFIVs 3.7.3 3.7.3 Main Feedwater Isolation Valves (MFIVs)

LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power operated valve.

ACTIONS

NOTE----------------------------------------------------

Separate Condition entry is allowed for each penetration flow path.

CONDITION A.

One or more MFIVs inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION COMPLETION TIME A. 1 Restore MFIV(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.

OR A.2.1 Close or isolate inoperable MFIV(s).

AND A.2.2 Verify inoperable MFIV(s) is closed or isolated.

OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Once per 7 days following Isolation 3.7.3-1 AMENDMENT NO. 4-ai, 209

ACTIONS (continued)

CONDITION REQUIRED ACTION

. B. ----------NOTES------------

B.1 Restore one valve to OPERABLE status.

1. RICT is not applicable when the second valve in the affected flow OR path is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

B.2.1 Isolate affected flow path.

Two valves in the same flow path inoperable.

AND 8.2.2 Verify inoperable MFIV(s) is closed or isolated.

C.

Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND C.2 Be in MODE 5.

SURVEILLANCE REQUIREMENTS SR 3.7.3.1 SURVEILLANCE Verify the closure time of each MFIV is within limits on an actual or simulated actuation signal.

MFIVs 3.7.3 COMPLETION TIME 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk Informed Completion Time Program 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Once per 7 days following Isolation.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours FREQUENCY In accordance with the INSERVICE TESTING PROGRAM PALO VERDE UNITS 1,2,3 3.7.3-2 AMENDMENT NO. ~. 209

3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)

LCO 3.7.4 Four ADV lines shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3, ADVs 3.7.4 MODE 4 when steam generator is being relied upon for heat removal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

NOTE-------------

Separate Condition entry A.1 Restore ADV line to 7 days is allowed for each SG.

OPERABLE status.

OR One required ADV line In accordance with the Risk Informed inoperable.

Completion Time Program B. -----------NOTES------------

B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

1. Not applicable when to OPERABLE status the last ADV on each SG.

OR intentionally made In accordance with inoperable resulting in

~

the Risk Informed loss of safety function.

Completion Time

2. The following Section Program 5.5.20 constraints are applicable when there is a loss offunction:

parts b, c.2, c.3, d, e, f, g, and h.

Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs.

PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 494-, 209

ACTIONS (continued)

CONDITION REQUIRED ACTION C.

Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND ADVs 3.7.4 COMPLETION TIME 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat removal.

SURVEILLANCE REQUIREMENTS SURVEILLANCE SR 3.7.4.1 Verify one complete cycle of each ADV.

PALO VERDE UNITS 1,2,3 3.7.4-2 FREQUENCY

In accordance with the Surveillance Frequency Control Program AMENDMENT NO. 483,209

3. 7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.

AFW System 3.7.5

NOTE---------------------------------------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

APPLICABILITY:

MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS

NOTE----------------------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A.

One steam supply to A. 1 Restore affected 7 days turbine driven AFW equipment to pump inoperable.

OPERABLE status.

OR OR

NO TE------------

In accordance with the Risk Informed Only applicable if MODE Completion Time 2 has not been entered Program following refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

B.

One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.

other than Condition A in OR MODE 1, 2, or 3.

In accordance with the Risk Informed Completion Time Program

( continued)

PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. 4-Q.7, 209

ACTIONS (continued)

CONDITION C. -----------NOTES-------------

1. Not applicable when second AFW train intentionally made inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss offunction:

parts b, c.2, c.3, d, e, f, g, and h.

Two AFW trains inoperable in MODE 1, 2, or 3.

\\

D.

Required Action and associated Completion Time of Condition A, B or C not met.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION C.1 Restore at least one AFW train to OPERABLE status.

D.1 Be in MODE 3.

AND D.2 Be in MODE4.

3.7.5-2 AFW System 3.7.5 COMPLETION TIME 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours

AMENDMENT NO. U7, 209

ACTIONS (continued)

CONDITION E.

Three AFW trains E.1 inoperable in MODE 1, 2, or 3.

F.

Required AFW train F.1 inoperable in MODE 4.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION

*----NOTE-------------

LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to restore one AFW train to OPERABLE status.

NOTE-------------

LCO 3.0.3 and all other LCO Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.

Initiate action to restore one AFW train to OPERABLE status.

AFW System 3.7.5 COMPLETION TIME Immediately Immediately 3.7.5-3 AMENDMENT NO. ~. 209

SURVEILLANCE REQUIREMENTS SR 3.7.5.1 SR 3.7.5.2 SR 3.7.5.3 SURVEILLANCE Verify each AFW manual, power operated, and automatic valve in each water flow path and in both steam supply flow paths to the steam turbine driven pump, that is not locked, sealed, or otherwise secured in position, is in the correct position.

NC>TE----------------------

Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

Verify the developed head of each AFW pump at the flow test point is greater than or equal to the required developed head.

NC>TES----------------------

1.

Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

2.

Not applicable in MC>DE 4 when steam generator is relied upon for heat removal.

Verify each AFW automatic valve that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

AFW System 3.7.5 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the INSERVICE TESTING PRC>GRAM In accordance with the Surveillance Frequency Control Program (continued)

PAL() VERDE UNITS 1,2,3 3.7.5-4 AMENDMENT NC>.~. 209

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.4 SR 3.7.5.5 SURVEILLANCE

N()TES------------------------

1.

Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

2.

Not applicable in M()DE 4 when steam generator is relied upon for heat removal.

Verify each AFW pump starts automatically on an actual or simulated actuation signal.

Verify the proper alignment of the required AFW flow paths by verifying flow from the condensate storage tank to each steam generator.

AFW System 3.7.5 FREQUENCY In accordance with the Surveillance Frequency Control Program Prior to entering M()DE 2 whenever unit has been in M()DE 5 or 6 for

> 30 days PAL() VERDE UNITS 1,2,3 3.7.5-5 AMENDMENT NC). 209

3. 7 PLANT SYSTEMS 3.7.7 Essential Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION A.

One EWtrain A.1

NOTE------------

inoperable.

Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -

MODE 4" for shutdown cooling made inoperable by EW.

Restore EW train to OPERABLE status.

B. -----------NOTES------------

B.1 Restore at least one EW 1. Not applicable when train to OPERABLE second EW train status.

intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two EW trains inoperable.

EW System 3.7.7 COMPLETION TIME 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

oR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,3 3.7.7-1 AMENDMENT NO. 447,209

ACTION (continued)

CONDITION REQUIRED ACTION C. Required Action and associated Completion Time not met.

C.1 Be in MODE 3.

C.2 Be in MODE 5.

SURVEILLANCE REQUIREMENTS SR 3.7.7.1 SR 3.7.7.2 SR 3.7.7.3 SURVEILLANCE

NOTE-------------------------

lsolation of EW flow to individual components does not render the EW System inoperable.

Verify each EW manual, power operated, and automatic valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

Verify each EW automatic valve in the flow path that is not locked, sealed, or otherwise secured in position, actuates to the correct position on an actual or simulated actuation signal.

Verify each EW pump starts automatically on an actual or simulated actuation signal.

EW System 3.7.7 COMPLETION TIME 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.7-2 AMENDMENT NO.~. 209

3. 7 PLANT SYSTEMS

3. 7.8 Essential Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION A.

One ESPS train inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION A.1

NOTES-------------

1. Enter applicable Conditions and Required Actions of LCO 3.8.1. "AC Sources - Operating,"

for emergency diesel generator made inoperable by ESPS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6. "RCS Loops - MODE 4," for shutdown cooling made inoperable by ESPS.

Restore ESPS train to OPERABLE status.

3.7.8-1 ESPS 3.7.8 COMPLETION TIME 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months In accordance with the Risk Informed Completion Time Program AMENDMENT NO. 447, 209

ACTION (continued)

CONDITION REQUIRED ACTION B. ------------NOTES-----------

8.1 Restore at least one

1.

Not applicable when ESPS train to second ESPS train OPERABLE status.

intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and

h.

Two ESPS trains iRoperable.

C.

Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND C.2 Be in MODE 5.

SURVEILLANCE REQUIREMENTS SR 3.7.8.1 SR 3.7.8.2 SURVEILLANCE

Notes----------------------------

lsolation of ESPS flow to individual components does not render ESPS inoperable.

Verify each ESPS manual and power operated valve in the flow path servicing safety related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

Verify each ESPS pump starts automatically on an actual or simulated actuation signal.

ESPS 3.7.8 COMPLETION TIME 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.8-2 AMENDMENT NO. 4-83, 209

3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION A.

One EC train inoperable.

A. 1 Restore EC train to OPERABLE status.

B. ----------NOTES-----------

8.1 Restore at least one EC

1. Not applicable when train to OPERABLE second EC train status.

intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two EC trains inoperable.

C.

Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND C.2 Be in MODE 5.

EC 3.7.10 COMPLETION TIME 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours PALO VERDE UNITS 1,2,3 3.7.10-1 AMENDMENT NO. 483,209

SURVEILLANCE REQUIREMENTS SR 3.7.10.1 SR 3.7.10.2 SURVEILLANCE Verify each EC System manual, power operated, and automatic valve in the flow path, that is not locked, sealed, or otherwise secured in position, is in the correct position.

Verify the proper actuation of each EC System component on an actual or simulated actuation signal.

PALO VERDE UNITS 1,2,3 3.7.10-2 EC 3.7.10 FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program AMENDMENT NO. 209

ACTIONS CONDITION A.

(continued)

B.

One DG inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION A.3 Restore required offsite circuit to OPERABLE status.

B.1 Perform SR 3.8.1.1 for the OPERABLE required offsite circuit(s).

AND B.2 Declare required feature(s) supported by the inoperable DG inoperable when its redundant required feature( s) is inoperable.

AND B.3.1 Determine OPERABLE DG is not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 for OPERABLE DG.

AND AC Sources - Operating 3.8.1 COMPLETION TIME 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time Program 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from discovery of Condition B concurrent with inoperability of redundant required feature(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 24 hours (continued) 3.8.1-2 AMENDMENT NO. 497,209

ACTIONS CONDITION B.

(continued)

C.

Two required offsite circuits inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION B.4 Restore DG to OPERABLE status.

C.1 Declare required feature(s) inoperable when its redundant required feature(s) is inoperable.

AND C.2 Restore one required offsite circuit to OPERABLE status.

AC Sources - Operating 3.8.1 COMPLETION TIME 10 days OR In accordance with the Risk Informed Completion Time Program 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from discovery of Condition C concurrent with inoperability of redundant required feature(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed Completion Time Program (continued) 3.8.1-3 AMENDMENT NO. ;mo, 209

ACTIONS (continued)

CONDITION D.

One required offsite circuit inoperable.

AND One DG inoperable.

NOTES-----------

1. Not applicable when second DG intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and

h.

E.

Two DGs inoperable.

PALO VERDE UNITS 1,2,3 REQUIRED ACTION AC Sources - Operating 3.8.1 COMPLETION TIME

*-NOTE---------------

Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems - Operating," when Condition D is entered with no AC power source to a train.

0.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuits to OPERABLE status.

OR OR In accordance with the Risk Informed Completion Time Program 0.2 Restore DG 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program E.1 Restore one DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program

( continued) 3.8.1-4 AMENDMENT NO. 447, 209

ACTIONS (continued)

CONDITION F.

One automatic load sequencer inoperable.

G.

NOTE------------

Condition G is not applicable for Class 1 E bus(es) provided with a two stage time delay for the degraded voltage relays and a fixed time delay for the loss of voltage relays.

One or more required offsite circuit(s) do not meet required capability.

PALO VERDE UNITS 1,2,3 AC Sources - Operating 3.8.1 REQUIRED ACTION COMPLETION TIME F.1 Restore automatic load 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months sequencer to OPERABLE status.

OR AND In accordance with the Risk Informed Completion Time Program F.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported by discovery of the inoperable Condition F sequencer inoperable concurrent with when its redundant inoperability of required feature(s) is redundant required inoperable.

feature(s)

G.1 Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months capability of the offsite circuit(s).

OR

NOTE----------------

Enter LCO 3.8.1 Condition A or C for required offsite circuit(s) inoperable.

G.2 Transfer the ESF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months bus(es) from the offsite circuit(s) to the EDG(s).

( continued) 3.8.1-5 AMENDMENT NO.~. 209

ACTIONS (continued)

CONDITION H. ------------NOTES----------.

1.

Not applicable when the third or a subsequent required AC source intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Three or more required AC sources inoperable.

I.

Required Action and Associated Completion Time of Condition A, B, C, D, E, F, G, or H not met.

PALO VERDE UNITS 1,2,3 H.1 1.1 AND 1.2 REQUIRED ACTION Restore required AC AC Sources - Operating 3.8.1 COMPLETION TIME 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months source(s) to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months 3.8.1-6 AMENDMENT NO. 488, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS SR 3.8.1.1 SR 3.8.1.2 SURVEILLANCE Verify correct breaker alignment and indicated power availability for each required offsite circuit.

NOTES--------------------------

1.

Performance of SR 3.8.1. 7 satisfies this SR.

2.

All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3.

A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer.

When modified start procedures are not used, the time, voltage, and frequency tolerances of SR 3.8.1.7 must be met.

4.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts from standby condition and achieves steady state voltage~ 4000 V and

~ 4377.2 V, and frequency~ 59.7 Hz and

~ 60.7 Hz.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-7 AMENDMENT NO. ~. 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.3 SR 3.8.1.4 SR 3.8.1.5 SR 3.8.1.6 SURVEILLANCE

NOTES--------------------------

1.

DG loadings may include gradual loading as recommended by the manufacturer.

2.

Momentary transients outside the load range do not invalidate this test.

3.

This Surveillance shall be conducted on only one DG at a time.

4.

This SR shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.2 or SR 3.8.1.7.

Verify each DG is synchronized and loaded, and operates for~ 60 minutes at a load~ 4950 kW ands 5500 kW.

Verify each day tank contains ~ 550 gal of fuel oil (minimum level of 2.75 feet).

Check for and remove accumulated water from each day tank.

Verify the fuel oil transfer system operates to automatically transfer fuel oil from the storage tank to the day tank.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program

( continued)

PALO VERDE UNITS 1,2,3 3.8.1-8 AMENDMENT NO. 488, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.7 SR 3.8.1.8 SURVEILLANCE

NOTE--------------------------

1.

All DG starts may be preceded by an engine prelube period followed by a warmup period prior to loading.

2.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts from standby condition and achieves

a.

In~ 10 seconds, voltage~ 3740 V and frequency~ 58.8 Hz; and

b.

Steady state voltage~ 4000 V and

~ 4377.2 V, and frequency~ 59.7 Hz and

~ 60.7 Hz.

NOTE--------------------------

This Surveillance shall not normally be performed in MODE 1 or 2. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify manual transfer of AC power sources from the normal offsite circuit to each alternate offsite circuit.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-9 AMENDMENT NO. 4-Si, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.9 SR 3.8.1.10 SURVEILLANCE

NOTE---------------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG rejects a load greater than or equal to its associated single largest post-accident load, and:

a.

Following load rejection, the frequency is s 64.5 Hz;

b.

Within 3 seconds following load rejection, the voltage is~ 3740 V ands 4580 V; and

c.

Within 3 seconds following load rejection, the frequency is ~ 58.8 Hz and s 61.2 Hz.

NOTE--------------------------

lf performed with the DG synchronized with offsite power, it shall be performed at a power factor of s 0.89. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verify each DG does not trip, and voltage is maintained s 6200 V during and following a load rejection of~ 4950 kW and s 5500 kW.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-10 AMENDMENT NO. 483,209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.11 SURVEILLANCE

NOTE-----------------------------

1.

All DG starts may be preceded by an engine prelube period.

2.

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3.

Momentary voltage and frequency transients induced by load changes do not invalidate this test.

4.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated loss of offsite power signal:

a.

De-energization of emergency buses;

b.

Load shedding from emergency buses;

c.

DG auto-starts and:

1.

energizes permanently connected loads in_ 5 10 seconds,

2.

energizes auto-connected emergency loads through automatic load sequencer,

3.

maintains steady state voltage

~ 4000 V and 5 4377.2 V,

4.

maintains steady state frequency

~ 59.7 Hz and 5 60.7 Hz, and

5.

supplies permanently connected and auto-connected emergency loads for

~ 5 minutes.

FREQUENCY In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.1-11 (continued)

AMENDMENT NO. 483,209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.12 SURVEILLANCE

NOTES-------------------------

1.

All DG starts may be preceded by an engine prelube period.

2.

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated Engineered Safety Feature (ESF) actuation signal (without a loss of offsite power) each DG auto-starts and:

a.

In ~ 10 seconds, achieves voltage

~ 3740 V and frequency~ 58.8 Hz;

b.

Achieves steady state voltage~ 4000 and

~ 4377.2 V and frequency~ 59.7 Hz and

~ 60.7 Hz;

c.

Operates for ~ 5 minutes on standby (running unloaded);

d.

Permanently connected loads remain energized from the offsite power system; and

e.

Emergency loads are energized (auto-connected through the automatic load sequencer) from the offsite power system.

FREQUENCY In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-12 AMENDMENT NO. 483,209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.13 SURVEILLANCE Verify each DG automatic trip is bypassed on actual or simulated loss of voltage signal on the emergency bus concurrent with an actual or simulated ESF actuation signal except:

a.

Engine overspeed;

b.

Generator differential current;

c.

Engine low lube oil pressure; and

d.

Manual emergency stop trip.

FREQUENCY In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-13 AMENDMENT NO. 4,gg, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.14 SURVEILLANCE

NOTES--------------------------

1.

Momentary transients outside the load range do not invalidate this test.

2.

If performed with the DG synchronized with offsite power, it shall be performed at a power factor of~ 0.89. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

3.

All DG starts may be preceded by an engine prelube period followed by a warmup period prior to loading.

4.

DG loading may include gradual loading as recommended by the manufacturer.

Verify each DG operates for 2 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s:

a.

For 2 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months loaded 2 4950 kW and

~ 5500 kW; and

b.

For the remaining hours (2 2) of the test loaded 2 5775 kW and ~ 6050 kW.

FREQUENCY In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-14 AMENDMENT NO. 483,209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.15 SR 3.8.1.16 SURVEILLANCE

NOTES----------------------------

1.

This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG, loaded ~ 4950 kW and s 5500 kW, has operated ~ 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or until temperatures have stabilized.

Momentary transients outside of load range do not invalidate this test.

2.

All DG starts may be preceded by an engine prelube period.

3.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify each DG starts and achieves

a.

Ins 10 seconds, voltage~ 3740 Vand frequency~ 58.8 Hz; and

b.

Steady state voltage ~ 4000 V and s 4377.2 V, and frequency~ 59.7 Hz and s 60.7 Hz.

NOTE---------------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify each DG:

a.

Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power;

b.

Transfers loads to offsite power source; and

c.

Returns to ready-to-load operation.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance

Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.1-15 (continued)

AMENDMENT NO. 4-88, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SR3.8.1.17 SR 3.8.1.18 SURVEILLANCE

NOTE---------------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify, with a DG operating in test mode and connected to its bus, an actual or simulated ESF actuation signal overrides the test mode by:

a.

Returning DG to ready-to-load operation; and

b.

Automatically energizing the emergency load from offsite power.

NOTE----------------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

Verify interval between each sequenced load block is within +/- 1 second of design interval for each automatic load sequencer.

FREQUENCY In accordance with the Surveillance Frequency Control Program In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1 -16 AMENDMENT NO. 483, 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.19 SURVEILLANCE

NOTES--------------------------

1.

All DG starts may be preceded by an engine prelube period.

2.

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.

3.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify on an actual or simulated loss of offsite power signal in conjunction with an actual or simulated ESF actuation signal:

a.

De-energization of emergency buses;

b.

Load shedding from emergency buses;

c.

DG auto-starts from standby condition and:

1.

energizes permanently connected loads in ~ 10 seconds,

2.

energizes auto-connected emergency loads through load sequencer,

3.

achieves steady state voltage 2 4000 V and~ 4377.2 V,

4.

achieves steady state frequency 2 59.7 Hz and~ 60.7 Hz, and

5.

supplies permanently connected and auto-connected emergency loads for 2 5 minutes.

FREQUENCY In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3.8.1-17 AMENDMENT NO.~. 209

AC Sources - Operating 3.8.1 SURVEILLANCE REQUIREMENTS continued SR 3.8.1.20 SURVEILLANCE

*-----NOTES-------------------------

1.

All DG starts may be preceded by an engine prelube period.

2.

The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.

Verify, when started simultaneously, each DG achieves

a.

Ins 10 seconds, voltage 2 3740 V and frequency 2 58.8 Hz; and

b.

Steady state voltage 2 4000 V and s 4377.2 V, and frequency 2 59.7 Hz and s 60.7 Hz.

FREQUENCY In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.1-18 AMENDMENT NO. 209

3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources -

Operating DC Sources -

Operating 3.8.4 LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION A.

One battery charger on A.1 Restore battery one subsystem terminal voltage to inoperable.

greater than or equal to the minimum established float voltage.

AND A.2 Verify battery float current ~ 2 amps.

AND A.3 Restore battery charger to OPERABLE status.

B.

One DC electrical power B.1 Restore DC electrical power subsystem to subsystem inoperable for OPERABLE status.

reasons other than Condition A.

COMPLETION TIME 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 72 hours OR In accordance with the Risk Informed Completion Time Program 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OR In accordance with the Risk Informed Completion Time Program

PALO VERDE UNITS 1,2,3 3.8.4-1 AMENDMENT NO. 493, 209

ACTIONS (continued)

CONDITION C. -----------NOTES-----------

1.

Not applicable when second DC electrical power subsystem intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two DC electrical power subsystems inoperable.

D.

Required Action and associated Completion Time not met.

PALO VERDE UNITS 1,2,3 C.1 D.1 AND D.2 REQUIRED ACTION DC Sources -

Operating 3.8.4 COMPLETION TIME Restore at least one DC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months electrical power subsystem to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months 3.8.4-2 AMENDMENT NO. 4-W, 209

DC Sources -

Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is greater than or In accordance equal to the minimum established float voltage.

with the Surveillance Frequency Control Program SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 Deleted SR 3.8.4.5 Deleted I

SR 3.8.4.6 Verify each battery charger supplies In accordance

~ 400 amps for Batteries A and B and with the

~ 300 amps for Batteries C and D at Surveillance greater than or equal to the minimum Frequency established float voltage for~ 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Control Program OR Verify each battery charger can recharge the battery to the fully charged state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying the largest combined demands of the various continuous steady state loads, after a battery discharge to the bounding design basis event discharge state.

(continued)

PALO VERDE UNITS 1,2,3 3.8.4-3 AMENDMENT NO. ~. 209 I

DC Sources -

Operating 3.8.4 SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.4.7 SR 3.8.4.8 SURVEILLANCE

NOTES--------------------------

1.

The modified performance discharge test in SR 3.8.6.9 may be performed in lieu of SR 3.8.4.7.

2.

This Surveillance shall not be performed in MODE 1, 2, 3, or 4.

Verify battery capacity is adequate to supply, and maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test.

Deleted FREQUENCY In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.4-4 AMENDMENT NO. 209

Inverters - Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters -

Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.

1\\JOTE----------------------------------------

One inverter may be disconnected from its associated DC bus for

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided

a.

The associated AC vital instrument bus is energized from its Class 1 E constant voltage source regulator; and

b.

All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIOI\\IS COI\\IDITIOI\\I A.

One required inverter inoperable.

PALO VERDE UI\\IITS 1,2,3 REQUIRED ACTIOI\\I A.1

I\\IOTE-----------

Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems -

Operating" with any vital instrument bus de-energized.

Restore inverter to OPERABLE status.

COMPLETIOI\\I TIME 7 days OR In accordance with the Risk Informed Completion Time Program 3.8.7-1 (continued)

AMEI\\IDMEI\\IT 1\\10. 400,209

ACTIONS (continued)

CONDITION REQUIRED ACTION B. ------------NOTES------------

8.1 Restore all but one inverter

1.

Not applicable when to OPERABLE status.

the second or a subsequent required inverter intentionally made inoperable resulting in loss of safety function.

2.

The following Section 5.5.20 constraints are applicable when there is a loss of function:

parts b, c.2, c.3, d, e, f, g, and h.

Two or more required inverters inoperable.

C.

Required Action and C.1 Be in MODE 3.

associated Completion Time not met.

AND C.2 Be in MODE 5.

SURVEILLANCE REQUIREMENTS SURVEILLANCE SR 3.8.7.1 Verify correct inverter voltage, frequency, and alignment to required AC vital instrument buses.

Inverters - Operating 3.8.7 COMPLETION TIME 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours FREQUENCY In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.7-2 AMENDMENT NO. 488,209

3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems -

Operating Distribution Systems - Operating 3.8.9 LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

One AC electrical A.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution subsystem inoperable.

subsystem to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program B.

One AC vital instrument B.1 Restore AC vital 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months bus electrical power instrument bus distribution subsystem electrical power OR inoperable.

distribution subsystem to OPERABLE status.

In accordance with the Risk Informed Completion Time Program C.

One DC electrical power C.1.

Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months distribution subsystems power distribution inoperable.

subsystem to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 3.8.9-1 AMENDMENT NO. -W-7, 209

A CTIONS (continued)

CONDITION D. -----------NOTES------------

1. Not applicable when the second or a subsequent electrical power distribution subsystem intentionally made inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Two or more electrical power distribution subsystems inoperable.

E. Required Action and associated Completion Time not met.

Distribution Systems - Operating 3.8.9 REQUIRED ACTION COMPLETION TIME D.1 Restore electrical 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months power distribution subsystem(s) to OR OPERABLE status.

In accordance with the Risk Informed Completion Time Program E.1 Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months AND E.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SR 3.8.9.1 SURVEILLANCE Verify correct breaker alignments and voltage to required AC, DC, and AC vital instrument bus electrical power distribution subsystems.

FREQUENCY In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.9-2 AMENDMENT NO. 497,209

Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.19 Battery Monitoring and Maintenance Program (continued)

4.

In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following statements in paragraph (d) may be omitted: "When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full charge. These measurements shall be made after the initially high charging current decreases sharply and the battery voltage rises to approach the charger output voltage."

5.

In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string."

b.

The program shall include the following provisions:

1.

Actions to restore battery cells with float voltage < 2.13 V;

2.

Actions to determine whether the float voltage of the remaining battery cells is ~ 2.13 V when the float voltage of a battery cell has been found to be < 2.13 V;

3.

Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates;

4.

Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and

5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.

PALO VERDE UNITS 1,2,3 5.5-19 AMENDMENT NO.~. 209

Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09 (Revision 0) -

A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a.

The RICT may not exceed 30 days;

b.

A RICT may only be utilized in MODE 1 and 2.

c.

When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d.

Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e.

Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f.

Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0) -

A. However, the following additional constraints shall be applied to the criteria for "PRA Functional."

PALO VERDE UNITS 1,2,3 5.5-20 AMENDMENT NO. 209

5.5 Programs and Manuals (continued)

Programs and Manuals 5.5 5.5.20 Risk Informed Completion Time Program (continued)

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g.

Upon entering a RICT for an emergent'condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1.

The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2.

Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of thefailed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review.

h.

A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

PALO VERDE UNITS 1,2,3 5.5-21 AMENDMENT NO. 209

5.5 Programs and Manuals (continued)

After SFP transition Programs and Manuals 5.5 5.5.21 Spent Fuel Storage Rack Neutron Absorber Monitoring Program Certain storage cells in the spent fuel storage racks utilize neutron absorbing material that is credited in the spent fuel storage rack criticality safety analysis to ensure the limitations of Technical Specifications 3.7.17 and 4.3.1.1 are maintained.

In order to ensure the reliability of the neutron absorber material, a monitoring program is provided to confirm the assumptions in the spent fuel pool criticality safety analysis.

The Spent Fuel Storage Rack Neutron Absorber Monitoring Program shall require periodic inspection and monitoring of spent fuel pool test coupons and neutron absorber inserts on a performance-based frequency, not to exceed 10 years.

Test coupons shall be inspected as part of the monitoring program.

These inspections shall include visual, B-10 areal density and corrosion rate.

Visual in-situ inspections of inserts shall also be part of the program to monitor for signs of degradation. In addition, an insert shall be removed periodically for visual inspection, thickness measurements, and determination of retention force.

PALO VERDE UNITS 1,2,3 5.5-22 AMENDMENT NO. 209 I

APPENDIX D ADDITIONAL CONDITIONS RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 The licensee shall comply with the following conditions on the schedules noted below:

Amendment Number 205 Additional Conditions APS shall apply a radial power fall off (RFO) curve penalty, equivalent to the fuel centerline temperature reduction in Section 4 of Attachment 8 to the Palo Verde license amendment request dated July 1, 2016, to accommodate the anticipated impacts of thermal conductivity degradation {TCD) on the predictions of FATES3B at high burnup for Westinghouse Next Generation Fuel.

To ensure the adequacy of this RFO curve penalty, as part of its normal reload process for each cycle that analysis using FATES3B is credited, APS shall verify that the FATES3B analysis is conservative with respect to an applicable confirmatory analysis using an acceptable fuel performance methodology that explicitly accounts for the effects of TCD. The verification shall confirm satisfaction of the following conditions:

i.

The maximum fuel rod stored energy in the confirmatory analysis is bounded by the maximum fuel rod stored energy calculated in the FATES3B and STRIKIN-11 analyses with the RFO curve penalty applied.

ii.

All fuel performance design criteria are met under the confirmatory analysis.

If either of the above conditions cannot be satisfied initially, APS shall adjust the RFO curve penalty or other core design parameters such that both conditions are met.

Implementation Date The license amendment shall be implemented within 90 days of the date of issuance.

Amendment No. 209

Amendment Number 207 Additional Conditions APS is approved to implement 10 CFR 50.69 using the processes for categorization of Risk-Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 structures, systems, and components (SSCs) using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, internal flooding, internal fire, and seismic; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (AN0-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards using the external hazard screening significance process identified in ASME/ANS PRA Standard RA-Sa-2009; as specified in license amendment 207 dated October 10, 2018.

Prior NRC approval, under 10 CFR 50.90, is required for a change to the categorization process specified above (e.g., change from a seismic margins approach to a seismic probabilistic risk assessment approach).

APS will complete the implementation items listed in the Enclosure of APS letter 102-07546, dated July 19, 2017, to the NRC and in, Table 1-1 of APS letter 102-07690, dated May 9, 2018, prior to implementation of 10 CFR 50.69. All issues identified in the enclosure will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2),.and any findings will be resolved and reflected in the PRA of record prior to implementation of the 10 CFR 50.69 categorization process.

Implementation Date The license amendment shall be implemented within 90 days of the date of issuance.

Amendment No. 209 Amendment Number Additional Conditions 209 Arizona Public Service Company (APS) is approved to implement the risk-informed completion time (RICT) program specified in license amendment 209 dated May29, 2019.

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

APS will complete the implementation items listed in the Enclosure of APS letter 102-07587, dated November 3, 2017, to the NRC and in Attachment 1, Table 1-1 of APS letter 102-07691, dated May 18, 2018, as updated by APS letter 102-07801, dated October 5, 2018, prior to implementation of RICTs.

All issues identified will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the RICT program.

Implementation Date Prior to implementation of RICT program.

Amendment No. 209

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 209,209, AND 209 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51, AND NPF-74 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530

1.0 INTRODUCTION

By application dated July 31, 2015 (Reference 1 ), as supplemented by letters dated April 11, 2016; November 3, 2017; and May 18, June 1, September 21, and October 5, 2018 (References 2, 3, 4, 5, 6, and 7, respectively), Arizona Public Service Company (APS, the licensee) requested changes to the technical specifications (TSs) for Palo Verde Nuclear Generating Station (Palo Verde), Units 1, 2, and 3. Specifically, the licensee proposed changes to the TSs consistent with the adoption of Technical Specifications Task Force (TSTF) traveler, TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF

[Risk-Informed TSTF] Initiative 4b" (Reference 8). The U.S. Nuclear Regulatory Commission (NRC, the Commission) published in the Federal Register (FR) a notice of availability of the model safety evaluation (SE) for the plant-specific adoption of TSTF-505, Revision 1, on March 15, 2012 (77 FR 15399) (Reference 9).

The license amendment request (LAR) was originally noticed in the Federal Register on December 8, 2015 (80 FR 76317). The licensee originally proposed to adopt, with plant-specific variations, TSTF-505, Revision 1. By letters dated November 15, 2016 (References 10 and 11 ),

the NRC staff informed the TSTF and all operating reactor licensees of its decision to suspend NRC approval of TSTF-505, Revision 1, because of concerns identified during the review of plant-specific LARs for adoption of TSTF-505, Revision 1. In its letters, the staff stated that it would continue reviewing applications already received and site-specific proposals to address the staff's concerns. Although the scope of the amendment request has not changed, the bases for the amendments no longer rely on TSTF-505. By letter dated November 3, 2017 (supersedes the application dated July 31, 2015), the licensee supplemented its application to address the staff's concerns in the letter dated November 15, 2016. Subsequently, by supplemental letters dated May 18 and June 1, 2018, the licensee provided additional information that expanded the scope of the amendment request as originally noticed in the Federal Register. Accordingly, the NRC published a second proposed no significant hazards consideration determination in the Federal Register on August 14, 2018 (83 FR 40345), which superseded the original notice in its entirely. The additional supplemental letters dated September 21, and October 5, 2018, provided additional information that clarified the application, did not expand the scope of the application as noticed, and did not change the staff's second proposed no significant hazards determination as published in the Federal Register on August 14, 2018 (83 FR 40345).

By e-mail dated April 4, 2018 (Reference 12), the NRC sent the licensee requests for additional information {RAls). By letters dated May 18, June 1, September 21, and October 5, 2018, the licensee responded to the RAls.

2.0

2.1 REGULATORY EVALUATION

Description of Risk-Informed Completion Times The TSs contain limiting conditions for operations (LCOs), which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When an LCO is not met, the licensee must shut down the reactor or follow any remedial or required action (e.g., testing, maintenance, or repair activity) permitted by the TSs until the condition can be met. The remedial actions (i.e., ACTIONS) associated with an LCO contain conditions that typically describe the ways in which the requirements of the LCO can fail to be met. Specified with each stated condition are required action(s) and completion times (CTs). The CTs are referred to as the "front stops" in the context of this SE. For certain conditions, the TSs require exiting the mode of applicability of an LCO (i.e., shut down the reactor).

On May 17, 2007, the NRC staff approved the Nuclear Energy Institute (NEI) Topical Report NEI 06-09, Revision 0-A, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines" (Reference 13), to the extent specified and under the limitations set forth in the staff's SE for NEI 06-09, Revision 0-A. NEI 06-09, Revision 0-A (Reference 14), provides a methodology for modifying selected required actions to provide an optional risk-informed completion time (RICT). NEI 06-09, Revision 0-A provides a methodology for extending CTs and, thereby, delay exiting the operational mode of applicability or taking required actions if risk is assessed and managed within the limits and programmatic requirements established by an RICT Program or a configuration risk management program.

2.2 Description of Proposed Changes The licensee's submittal requested approval to add a new program, "Risk Informed Completion Time Program," in Section 5.0, "Administrative Controls," of the Palo Verde TSs, and modify selected CTs to permit extending the CTs, provided risk is assessed and managed as described in NEI 06-09, Revision 0-A. The licensee's application for the changes proposed to use NEI 06-09, Revision 0-A, and included documentation regarding the technical adequacy of the probabilistic risk assessment (PRA) models for the RICT Program, consistent with the guidance in Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated March 2009 (Reference 15).

As proposed in the LAR, as supplemented, TS 5.5.20, which describes the licensee's RICT Program, would be added to the TS and reads as follows:

5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09 (Revision 0) - A, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days.

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f.

Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0)-A. However, the following additional constraints shall be applied to the criteria for "PRA Functional."

1. Any SSCs [structures, systems, and components] credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure.

Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2. Prior to exceeding the front stop, RMAs [risk management actions] not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components, (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review.

h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

The licensee requested to revise the CTs for the TS required actions in the following section by providing the option to calculate RICTs. The following section reflects proposed changes as supplemented by the licensee's letter dated November 3, 2017 (Reference 3).

2.2.1 Modifications to LCO Required Actions and CTs The typical CT would be modified by the application of the RICT Program as shown in the following example. The changed portion is indicated in italics.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable.

to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program Where necessary, conforming changes would be made to CTs to make them accurate following use of an RICT. For example, most TSs have requirements to close/isolate containment isolation devices if one or more containment penetrations have inoperable devices. This is followed by a requirement to periodically verify the penetration is isolated. By adding the flexibility to use an RICT to determine a time to isolate the penetration, the periodic verifications must then be based on the time "following isolation."

Individual LCO Required Actions and CTs modified by the proposed change are identified below.

There are three major categories of changes to the LCOs:

1. The option of calculating an RICT is being added for the listed required actions.

2. For conditions involving loss of function (LOF), the condition is modified by Notes prohibiting voluntary entry and clarifying the applicable TS 5.5.20 criteria.

3. In some cases, additional changes are made to accommodate incorporation of the RICT Program. For example, the required actions are modified to require restoration of equipment to operable status, where noted. In addition, editorial/conforming changes are made to accommodate the incorporation of the RICT Program.

Technical Specification 1.3, Completion Times The following example is included to TS 1.3 as Example 1.3-8:

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable.

to OPERABLE status.

OR In accordance with the Risk Informed Completion Time Program B.

NOTES------

B.1 Restore at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months

1. Not applicable one subsystems to when second OPERABLE OR subsystem status.

intentionally made In accordance with the inoperable.

Risk Informed Completion Time

2. The following Program Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two subsystems inoperable.

C. Required Action and C.1 Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met.

AND C.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7-day CT may be applied as discussed in Example 1.3-8. However, the licensee may elect to apply the RICT Program, which permits calculation of an RICT that may be used to complete the Required Action beyond the 7-day CT. The RICT cannot exceed 30 days. After the 7-day CT has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two notes. The first note states it is not applicable if the second subsystem is intentionally made inoperable. The second note provides restrictions applicable to these "loss of function" Conditions. The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service. The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply an RICT or to extend the CT beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the requirements of the RICT Program are met. If two subsystems are inoperable and Condition Bis not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there is no applicable Condition.

The RICT Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action CT (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7-day CT clock of Condition A or the 1-hour CT clock of Condition B has expired, and subsequent changes in plant condition result in exiting the applicability of the RICT Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the CT clocks for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the CT clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and Care exited, and therefore, the required actions of Condition C may be terminated.

The following TSs are modifications to LCO Required Actions and CTs:

TS 3.3.6, "Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip" Required Action 8.1 o

The option of calculating an RICT is applied to the action to restore channel to OPERABLE status (for Condition B, one or more functions with one manual trip or initiation logic channel inoperable).

Required Action D.1 o

The option of calculating an RICT is applied to the restore channel to OPERABLE status (for Condition D, one or more functions with one Actuation Logic channel inoperable").

TS 3.4.10, "Pressurizer Safety Valves" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore valve to OPERABLE status.

o The condition is modified by notes stating that it is not applicable when pressurizer safety valve intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.4.12, "Pressurizer Vents" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore required pressurizer vent paths to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore one pressurizer vent path to OPERABLE status (for Condition B, all pressurizer vent paths inoperable).

o The condition is modified by notes stating that it is not applicable when pressurizer last pressurizer vent path intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.5.1, "Safety Injection Tanks (SITs) - Operating" Required Action C.1 o

The option of calculating an RICT is applied to the action to restore all but one SIT to OPERABLE status (for new Condition C, Two or more SITs inoperable for reasons other than Condition A).

o The condition is modified by notes stating that it is not applicable when the second or a subsequent SIT intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.5.3, "ECCS [Emergency Core Colling System - Operating" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore subsystem to OPERABLE status (for Condition A, One LPSI subsystem inoperable).

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore train(s) to OPERABLE status (for Condition B, "One or more trains inoperable for reasons other than Condition A AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available")

(Note-not LOF).

TS 3.5.5, "Refueling Water Tank (RWT)"

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore RWT to OPERABLE status (for Condition B, "RWT inoperable for reasons other than Condition A").

~ 9 -

o The condition is modified by notes stating that it is not applicable when RWT is intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h."

TS 3.6.2, "Containment Air Locks" Required Action C.3 o

The option of calculating a RICT is applied to the action to restore air lock to OPERABLE status.

TS 3.6.3, "Containment Isolation Valves" Required Action A.1 o

The option of calculating an RICT is applied to the action to isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured.

Required Action 8.1 o

The option of calculating an RICT is applied to the action to isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange.

o The condition is modified by notes stating that RICT is not applicable when the second containment isolation valve is intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Required Action C.1 o

The option of calculating an RICT is applied to the action to isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, closed manual valve, or blind flange.

Required Action C.2 o

The Completion Time is revised to state "Once per 31 days following isolation."

Required Action D.1 o

The option of calculating an RICT is applied to the action to isolate the affected penetration flow path by use of at least one closed and de-activated automatic valve, with resilient seals, or blind flange.

o The condition is modified by notes stating that RICT is not applicable when the second containment purge valve is intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.6.6, "Containment Spray System" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore containment spray train to OPERABLE status.

TS 3.7.2, "Main Steam Isolation Valves (MSIVs)"

Required Action F.1 o

The option of calculating an RICT is applied to the action to restore MSIV to OPERABLE status.

Required Action G.1 o

The option of calculating an RICT is applied to the action to restore all but one MSIV to OPERABLE status.

o The condition is modified by notes stating that it is not applicable when the second or a subsequent MSIV intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.3, "Main Feedwater Isolation Valves (MFIVs)"

Required Action A 1 o

The option of calculating an RICT is applied to the action to restore MFIV(s) to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore one valve to OPERABLE status (for Condition B, "Two valves in the same flow path inoperable").

o The condition is modified by notes stating that RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.4, "Atmospheric Dump Valves (ADVs)"

Required Action A.1 o

The option of calculating an RICT is applied to the action to restore ADV line to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore one ADV line to OPERABLE status on each steam generator.

o The condition is modified by notes stating that it is not applicable when the last ADV intentionally made inoperable resulting in loss of safety function; and that the following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.5, "Auxiliary Feedwater (AFW) System" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore affected equipment to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore AFW train to OPERABLE status.

Required Action C.1 o

The option of calculating an RICT is applied to the action to restore at least one AFW train to OPERABLE status (for new Condition C, Two AFW trains inoperable in MODE 1, 2, or 3").

o The condition is modified by notes stating that it is not applicable when the second AFW train intentionally made inoperable resulting in the loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.7, "Essential Cooling Water (EW) System" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore EW train to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore at least one EW train to OPERABLE status (for new Condition B, Two EW trains inoperable").

o The condition is modified by notes stating that it is not applicable when second EW train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.8, "Essential Spray Pond System (ESPS)"

Required Action A.1 o

The option of calculating an RICT is applied to the action to restore ESPS train to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore at least one ESPS train to OPERABLE status (for new Condition B, "Two ESPS trains inoperable").

o The condition is modified by notes stating that it is not applicable when the second ESPS train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.10, "Essential Chilled Water (EC) System" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore EC train to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore at least one EC train to OPERABLE status (for new Condition B, "Two EC trains inoperable").

o The condition is modified by notes stating that it is not applicable when second EC train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Note: See Section 3.1.2.2 of this SE for a detailed description of changes to TS 3.8.1, TS 3.8.4, TS 3.8.7, and TS 3.8.9.

TS 3.8.1, "AC [Alternating Current] Sources - Operating" Required Action A.3 o

The option of calculating an RICT is applied to the action to restore required offsite circuit to OPERABLE status.

Required Action B.4 o

The option of calculating an RICT is applied to the action to restore Diesel Generator (DG) to OPERABLE status.

Required Action C.2 o

The option of calculating an RICT is applied to the action to restore one required offsite circuit to OPERABLE status.

Required Action D.1 o

The option of calculating an RICT is applied to the action to restore required offsite circuits to OPERABLE status.

Required Action D.2 o

The option of calculating an RICT is applied to the action to restore DG to OPERABLE status.

Required Action E.1 o

The option of calculating an RICT is applied to the action to restore one DG to OPERABLE status.

o The condition is modified by notes stating that it is not applicable when second DG intentionally made inoperable; and that the following Section 5.5.22 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Required Action F.1 o

The option of calculating an RICT is applied to the action to restore automatic load sequencer to OPERABLE status.

Required Action H.1 o

The option of calculating an RICT is applied to the action to restore required AC source(s) to OPERABLE status (for new Condition H, "Three or more AC sources inoperable").

o The condition is modified by notes stating that it is not applicable when the third or a subsequent required AC source intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.8.4, "DC [Direct Current] Sources - Operating" Required Action A.3 o

The option of calculating an RICT is applied to the action to restore battery charger to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore DC electrical power subsystem to OPERABLE status.

Required Action C.1 o

The option of calculating an RICT is applied to the action to restore at least one DC electrical power subsystem to OPERABLE status (for Condition C, "Two DC electrical power subsystems inoperable").

o The condition is modified by notes stating that it is not applicable when second DC electrical power subsystem intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.8.7, "Inverters - Operating" Required Action A.1 o

The option of calculating a RICT is applied to the action to "Restore inverter to OPERABLE status."

Required Action B.1 o

The option of calculating a RICT is applied to the action to "Restore all but one inverter to OPERABLE status" (for new Condition B, "Two or more required inverters inoperable").

o The condition is modified by notes stating that it is not applicable when the second or a subsequent required inverter intentionally made inoperable resulting in loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.8.9, "Distribution Systems - Operating" Required Action A.1 o

The option of calculating an RICT is applied to the action to restore AC electrical power distribution subsystem to OPERABLE status.

Required Action B.1 o

The option of calculating an RICT is applied to the action to restore AC vital instrument bus electrical power distribution subsystem to OPERABLE status.

Required Action C.1 o

The option of calculating an RICT is applied to the action to restore DC electrical power distribution subsystem to OPERABLE status.

Required Action D.1 o

The option of calculating an RICT is applied to the action to restore electrical power distribution subsystem(s) to OPERABLE status (for Condition D, "Two or more electrical power distribution subsystems inoperable").

o The condition is modified by notes stating that it is not applicable when the second or a subsequent electrical power distribution subsystem intentionally made inoperable resulting in a loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

2.2.2 Application of the RICT Program to New Conditions The licensee has proposed to establish new conditions and required actions that permit application of an RICT when all trains are inoperable. Under the existing TSs, such configurations would typically result in applicability of LCO 3.0.3, which requires an orderly reactor shutdown to a safe condition. The licensee has proposed the addition of new conditions and required actions that allow up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to determine an RICT in accordance with the RICT Program or require a reactor shutdown. Therefore, the new proposed required actions are consistent with the existing actions of LCO 3.0.3, if an RICT is not used. In accordance with NEI 06-09, Revision 0-A, the use of an RICT, when all trains of a TS system are inoperable, is restricted to conditions in which at least one train of the TS system retains PRA functionality and the configuration risk management program can discern which TS functions are available and which are failed due to the inoperability.

The NRC staff's SE for NEI 06-09, Revision 0-A, dated May 17, 2007 (Reference 13), provides guidance on the application of an RICT when all trains are inoperable. In this situation, if at least one train remains PRA functional, as described in NEI 06-09, Revision 0-A, an RICT may be applied. The staff's SE for NEI 06-09, Revision 0-A, did indicate that application of an RICT was not appropriate for voluntary entry into a condition with all trains inoperable. The SE indicated that the TS safety function should retain the capability to meet its design-basis analysis requirements even though all trains are inoperable. Section 4.0, "Limitations and Conditions," of the staff's SE for NEI 06-09, adds that the licensee should justify the scope of the PRA model, including applicable success criteria (i.e., number of SSCs required, flowrate, etc.) are consistent with the licensing basis assumptions (e.g., 10 CFR 50.46, ECCS flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided. Instead of providing justification for using PRA success criteria that differ from the design basis, APS added several programmatic restrictions to its definition of PRA functional to ensure that the design-basis success criteria can be fulfilled when the determination is made that at least one train remains PRA functional. Additionally, new TS 5.5.20.e limits the associated RICT under these conditions to a backstop of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months instead of 30 days. These restrictions are discussed in Section 3.1.1 of this SE.

The following is a list of those TS sections to which the licensee has proposed the addition of a new action and associated changes to support the addition, including allowance of inoperability of each component if PRA functionality is maintained:

TS 3.5.1, "Safety Injection Tanks (SIT)"

New Condition C is added and states: "Two or more SITs inoperable for reasons other than Condition A" (boron concentration not within limits, or level or pressure not within limits). The condition is modified by notes stating that it is not applicable when the second or a subsequent SIT intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action C.1 and states: "Restore all but one SIT to OPERABLE status."

Existing Condition C is renumbered as Condition D and modified to be applicable if the "Required Action and associated Completion Time of Conditions A, B, or C not met."

TS 3.7.2, "Main Steam Isolation Valves (MSIVs)"

New Condition G is added and states: "Two or more MSIVs inoperable in MODE 1." The condition is modified by notes stating that it is not applicable when the second or a subsequent MSIV intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action G.1 and states: "Restore all but one MSIV to OPERABLE status."

Existing Condition G is renumbered as Condition H and modified to be applicable if the "Required Action and associated Completion Time of Condition F, or G not met."

Existing Condition His renumbered as Condition I, and existing Condition I is renumbered as Condition J.

TS 3.7.3, "Main Feedwater Isolation Valves (MFIVs)"

New Required Action A.1 is added and states: "Restore MFIV(s) to OPERABLE status." The associated CT is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with the option of calculating a RICT. An OR logical connector is added after Required Action A.1. Existing Required Action A.1 is renumbered Required Action A.2.1 and Required Action A.2 is renumbered A.2.2.

New Required Action B.1 is added and states: "Restore one valve to OPERABLE status." The associated CT is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months with the option of calculating a RICT. An OR logical connector is added after Required Action B.1. Existing Required Action B.1 is renumbered Required Action B.2.1 and Required Action B.2 is renumbered B.2.2. Condition Bis modified by notes stating that RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

TS 3.7.5, "Auxiliary Feedwater (AFW) System" New Condition C is added and states: "Two AFW trains inoperable in MODE 1, 2, or 3." The condition is modified by notes stating that it is not applicable when second AFW train intentionally made inoperable resulting in loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action C.1 and states: "Restore at least one AFW train to OPERABLE status."

Existing Condition C is renumbered as Condition D and modified to be applicable if the "Required Action and associated Completion Time of Conditions A, B, or C not met."

Existing Condition Dis renumbered as Condition E, and existing Condition Eis renumbered as Condition F.

TS 3.7.7, "Essential Cooling Water (EW) System" New Condition B is added and states: 'Two EW trains inoperable." The condition is modified by notes stating that it is not applicable when second EW train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action B.1 and states: "Restore at least one EW train to OPERABLE status."

Existing Condition B is renumbered as Condition C and modified to be applicable if the "Required Action and associated Completion Time not met."

TS 3.7.8, "Essential Spray Pond System (ESPS)"

New Condition B is added and states: "Two ESPS trains inoperable." The condition is modified by notes stating that it is not applicable when second ESPS train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action B.1 and states: "Restore at least one ESPS train to OPERABLE status."

Existing Condition B is renumbered as Condition C and modified to be applicable if the "Required Action and associated Completion Time not met."

TS 3.7.10, "Essential Chilled Water (EC}"

New Condition B is added and states: "Two EC trains inoperable." The condition is modified by notes stating that it is not applicable when second EC train intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action B.1 and states: "Restore at least one EC train to OPERABLE status."

Existing Condition B is renumbered as Condition C and states: "Required Action and associated Completion Time not met."

Note: See Section 3.1.2.2 of this SE for a detailed description of changes to LCO 3.8.1, LCO 3.8.4, LCO 3.8.7, and LCO 3.8.9.

TS 3.8.1, "AC Sources - Operating" New Condition H is added and states: "Three or more required AC sources inoperable." The condition is modified by notes stating that it is not applicable when the third or a subsequent required AC source intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action H.1 and states: "Restore required inoperable AC source(s) to OPERABLE status."

Existing Condition H is renumbered as Condition I and modified to be applicable if the "Required Action and associated Completion Time of Condition A, B, C, D, E, F, G or Hnot met."

Existing Condition I is deleted.

TS 3.8.4, "DC Sources - Operating" New Condition C is added and states: "Two DC electrical power subsystems inoperable." The condition is modified by notes stating that it is not applicable when second DC electrical power subsystem intentionally made inoperable; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h."

The option of calculating an RICT is applied to the action to new Required Action C.1 and states: "Restore at least one DC electrical power subsystem to OPERABLE status."

Existing Condition C is renumbered as Condition D and states: "Required Action and associated Completion Time not met."

TS 3.8.7, "Inverters - Operating" New Condition Bis added and states: "Two or more required inverters inoperable." The condition is modified by notes stating that it is not applicable when the second or a subsequent required inverter intentionally made inoperable resulting in loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h."

The option of calculating a RICT is applied to the action to new Required Action B.1 and states: "Restore all but one inverter to OPERABLE status."

Existing Condition C is renumbered as Condition D and states: "Required Action and associated Completion Time not met."

TS 3.8.9, "Distribution Systems - Operating" New Condition D is added and states: "Two or more electrical power distribution subsystems inoperable." The condition is modified by notes stating that it is not applicable when the second or a subsequent electrical power distribution subsystem intentionally made inoperable resulting in loss of safety function; and that the following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The option of calculating an RICT is applied to the action to new Required Action 0.1 and states: "Restore electrical power distribution subsystem(s) to OPERABLE status."

Existing Condition Dis renumbered as Condition E and states: "Required Action and associated Completion Time of Condition not met."

Existing Condition Eis deleted.

2.2.3 Editorial Changes and Variations from TSTF-505 The licensee proposes certain editorial changes and variations from the TSs described in TSTF-505-A, Revision 2, and applicable parts of the NRC model SE dated March 15, 2012.

Differences between the Palo Verde proposed LAR and TSTF-505-A and its related justifications are provided in Table 1, "TSTF-505-A Reconciliation," of the APS LAR dated July 31, 2015, and the supplement dated November 3, 2017 (References 1 and 3, respectively).

In some instances, the Palo Verde TSs use different numbering and titles than NUREG 1432, "Standard Technical Specifications, Combustion Engineering Plants" (Reference 16), on which TSTF-505-A was based. These differences are administrative and do not affect the applicability of TSTF-505-A to the Palo Verde TSs. The APS LAR includes the LCOs from TSTF-505-A that are applicable to Palo Verde.

To adopt TSTF-505-A, APS adopted via previously submitted Letter No. 102-07002, "License Amendment Request for Adoption of Technical Specifications Task Force (TSTF) Traveler TSTF-439-A, Revision 2, 'Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO,"' dated February 27, 2015 (Reference 17). The LAR proposed removal of the second completion times from the following TS sections, as described in TSTF-439-A:

TS 1.3, "Completion Times" TS 3.7.5, "Auxiliary Feedwater (AFW) System" TS 3.8.1, "AC Sources - Operating" TS 3.8.9, "Distribution Systems - Operating" The following plant-specific LCOs for which APS proposes to apply the RICT Program are not within the scope of TSTF-505-A. These LCOs are variations (as identified in the above-mentioned Table 1) with additional justification provided:

TS 3.4.12, "Pressurizer Vents." There is no pressurizer vent TS in NUREG-1432 or in TSTF-505-A. The Palo Verde TS addresses the pressurizer vent lines and valves that can be used to depressurize and de-gas the reactor coolant system.

The pressurizer vent paths are modeled in the PRA and credited in the Palo Verde safety analysis for the steam generator tube rupture event as described in the Palo Verde Updated Final Safety Analysis Report (UFSAR)

Section 15.6.3 (Reference 18). The pressurizer vent TS at Palo Verde has similarities to vents in the pressurizer power-operated relief valves TS 3.4.11 addressed by TSTF-505-A. Although the Palo Verde design does not include power-operated relief valves, APS proposes to apply the RICT Program to Palo Verde TS LCO 3.4.12 for the pressurizer vents using TSTF-505-A TS 3.4.11 RA B.3 as a guide. The licensee proposes to apply the RICT Program to Palo Verde restoration items RA 3.4.12.A.1 and RA 3.4.12.B.1 for the pressurizer vents.

TS 3.7.3, "Main Feedwater Isolation Valves (MFIVs)." The MFIV TS was not included in TSTF-505-A because the TS LCO conditions do not include restoration actions for an inoperable MFIV. The licensee proposes adding restoration actions to RA 3. 7.3.A.1 ( one or more MFIVs inoperable) and RA 3.7.3.B.1 (two valves in the same flow path inoperable) and including both in the RICT Program. A description of the MFIVs is included in Palo Verde UFSAR Section 10.4.7, "Condensate and Feedwater System" (Reference 18). The

2.3 MFIVs are modeled in the PRA and credited in the safety analysis to close during a steam line break and a feedwater line break.

Editorial variations: In TS 3.7.7, Palo Verde uses the terminology Essential Cooling Water (EW) System rather than Component Cooling Water (CCW)

System as in TSTF-505-A. In TS 3.7.8 Palo Verde uses the terminology Essential Spray Pond System (ESPS) rather than Service Water System (SWS) as in the TSTF.

Regulatory Review The NRC staff considered the following regulatory requirements, policy statements and guidance during its review of the proposed changes.

2.3.1 Applicable Regulations Title 10 of Code of Federal Regulations (10 CFR) Section 50.90, "Application for amendment of license, construction permit, or early site permit," requires that whenever a holder of a license wishes to amend the license, including TSs in the license, an application for amendment must be filed fully describing the changes desired. The regulation under 10 CFR 50.92(a) requires that the NRC, in determining whether to grant a license amendment request, will be guided by the considerations that govern the issuance of initial licenses or construction permits to the extent applicable and appropriate.

The regulation under 10 CFR 50.36( c)(2), "Limiting conditions for operation," requires that TSs contain LCOs, which "are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the [LCO] can be met." Typically, the TSs require restoration of equipment in a timeframe commensurate with its safety significance, along with other engineering considerations. In determining whether the proposed TSs remedial actions should be granted, the Commission will apply the "reasonable assurance" standards of 10 CFR 50.40(a) and 10 CFR 50.57(a)(3).

The regulation under 10 CFR 50.36(c)(5), "Administrative controls," states, in part, that "Administrative controls are the provisions relating to organization and management, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner."

The regulation under 10 CFR 50.40(a) states that in determining whether to grant the licensing request, the Commission will be guided by, among other things, consideration of whether "the processes to be performed, the operating procedures, the facility and equipment, the use of the facility, and other technical specifications, or the proposals, in regard to any of the foregoing collectively provide reasonable assurance that the applicant will comply with the regulations in this chapter, including the regulations in part 20 of this chapter, and that the health and safety of the public will not be endangered."

The regulation under 10 CFR 50.55a(h), "Protection and safety systems," requires, compliance with the Institute of Electrical and Electronics Engineers (IEEE) Standard (Std) 603-1991,

"Criteria for Safety Systems for Nuclear Power Generating Stations," and the correction sheet dated January 30, 1995. For nuclear power plants with construction permits issued before January 1, 1971, the applicant or licensee may elect to comply instead with its plant-specific licensing basis. For nuclear power plants with construction permits issued between January 1, 1971, and May 13, 1999, the applicant or licensee may elect to comply inste~d with the requirements stated in IEEE Std 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations." Both IEEE 279 and IEEE 603 stipulate aspects of diversity and defense-in-depth, for example, both require the protection system to include means for manual initiation of each automatically initiated protective action (i.e., an independent and diverse means of initiating the protective action). The Palo Verde UFSAR Section 7.1, states compliance with IEEE Std 279-1971.

Clause 4.2, "Single Failure Criterion," of the IEEE Std 279-1971 requires that, "Any single failure within the protection system shall not prevent proper protective action at the system level when required."

Clause 4.11, "Channel Bypass of Removal from Operation," of the IEEE Std 279-1971, requires, "The system shall be designed to permit any one channel to be maintained, and when required, tested or calibrated during power operation without initiating a protective action of the systems level. During such operation, the active parts of the system shall of themselves continue to meet the single failure criterion."

However, the "Channel Bypass or Removal from Operation" criterion is allowed to be violated by the "Exception" specified in this clause as "one-out-of-two" systems are permitted to violate the single failure criterion during channel bypass provided that acceptable reliability of operation can be otherwise demonstrated."

The regulation under 1 O CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants" (i.e., the Maintenance Rule), requires, in part, licensees to monitor "the performance or condition of structures, systems, or components, against licensee-established goals in a manner sufficient to provide reasonable assurance that these structures, systems, or components,... are capable of fulfilling their intended functions."

Paragraph 50.65(a)(4) of 10 CFR requires the assessment and management of the increase in risk that may result from a proposed maintenance activity.

As part of evaluating defense-in-depth, the NRC staff utilized 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 17, "Electric power systems." This GDC states, in part, that:

An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Although GDC 18, "Inspection and testing of electric power systems," is generally applicable to electrical power systems, the design and maintenance of the electrical power system equipment are not being changed by the proposed extension of the CTs and only the CTs in the TSs are being changed. Therefore, the proposed changes do not affect compliance with GDC 18, as incorporated into the plant licensing basis through the UFSAR. The review addressed by this SE is only within the requirements of GDC 17 with respect to defense-in-depth (e.g.,

availability/capacity/capability of the electrical power systems).

Some of the GDC for protections systems also stipulate certain aspects of diversity and defense-in-depth, as described below. The NRC staff also utilized 10 CFR Part 50, Appendix A, GDCs 21, 22, 23, and 29 to evaluate the compliance with defense-in-depth design.criteria for the proposed changes.

The NRC staff recognizes that the designs of the systems addressed by GDCs 34, 35, 38, 41, 44, 55, and 56 are not being modified, however, TSs associated with these systems are included in Tables 1 and 2 of TSTF-505 as amended. The RICT Program ensures that adequate defense-in-depth and compensatory measures are established, as necessary, to ensure the necessary functions provided by the systems addressed in the GDCs are maintained.

2.3.2 Commission Policy The NRC provided details concerning the use of PRA in the "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement" published in the Federal Register on August 16, 1995 (60 FR 42622-42629). In this publication, the Commission stated:

The Commission believes that an overall policy on the use of PRA methods in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that would promote regulatory stability and efficiency. In addition, the Commission believes that the use of PRA technology in NRC regulatory activities should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach. [... ]

PRA addresses a broad spectrum of initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for multiple and common cause failures [CCFs]. The treatment therefore goes beyond the single failure requirements in the deterministic approach. The probabilistic approach to regulation is, therefore, considered an extension and enhancement of traditional regulation by considering risk in a more coherent and complete manner. [... ]

Therefore, the Commission believes that an overall policy on the use of PRA in nuclear regulatory activities should be established so that the many potential applications of PRA can be implemented in a consistent and predictable manner that promotes regulatory stability and efficiency. This policy statement sets forth the Commission's intention to encourage the use of PRA and to expand the scope of PRA applications in all nuclear regulatory matters to the extent supported by the state-of-the-art in terms of methods and data. [... ]

Therefore, the Commission adopts the following policy statement regarding the expanded NRC use of PRA:

(1) The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

(2) PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed. It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

(3) PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

(4) The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

2.3.3 Regulatory Guidance RG 1.17 4, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated January 2018 (Reference 19), describes an acceptable risk-informed approach for assessing the nature and impact of proposed permanent licensing basis changes by considering engineering issues and applying risk insights. This RG also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," dated May 2011 (Reference 20), describes an acceptable risk-informed approach specifically for assessing proposed TS changes. This RG identifies a three-tiered approach for a licensee's evaluation of the risk associated with a proposed TS CT change, as follows.

Tier 1 assesses the risk impact of the proposed change in accordance with acceptance guidelines consistent with the Commission's Safety Goal Policy Statement, as documented in RG 1.17 4 and RG 1.177. The first tier assesses the impact on plant risk as expressed by the change in core damage frequency (b.CDF) and change in large early release frequency (b.LERF). It also evaluates plant risk while equipment covered by the proposed CT is out of service, as represented by incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP). The limits for ICCDP and ICLERP are consistent with the criteria for incremental core damage probability (ICDP) and incremental large early release probability (ILERP) from Nuclear Management and Resources Council (NUMARC) 93-01, Revision 4A, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants" (Reference 21 ), guidance for managing the risk of on line maintenance activities. ICDP and ILERP are the limits on which the licensee will base the RICT. This guidance was endorsed by the NRC staff in RG 1.160, Revision 3, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," dated May 2012 (Reference 22), for compliance with the Maintenance Rule, 10 CFR 50.65(a)(4). Tier 1 also addresses PRA quality, including the technical adequacy of the licensee's plant-specific PRA for the subject application.

Tier 2 identifies and evaluates any potential risk-significant plant equipment outage configurations that could result if equipment, in addition to that associated with the proposed license amendment, is removed from service simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The purpose of this evaluation is to ensure that there are appropriate restrictions in place such that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed CT is implemented.

Tier 3 addresses the licensee's configuration risk management program (CRMP) to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and appropriate compensatory measures are taken to avoid risk-significant configurations that may not have been considered when the Tier 2 evaluation was performed. Compared with Tier 2, Tier 3 provides additional coverage to ensure risk-significant plant equipment outage configurations are identified in a timely manner, and that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule, which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, subject to the guidance provided in RG 1.177, Section 2.3. 7.1, and the adequacy of the licensee's program and PRA model for this application. The CRMP ensures that equipment removed from service prior to or during the proposed extended CT will be appropriately assessed from a risk perspective.

RG 1.200, Revision 2 (Reference 15), describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light-water reactors (LWRs). RG 1.200 provides guidance for assessing the technical adequacy of a PRA. RG 1.200, Revision 2, endorses, with clarifications and qualifications, the use of the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) Standard, RA-Sa-2009, Addenda to ASME RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" (i.e., the ASME PRA standard) (Reference 23).

As discussed in RG 1.177, Revision 1, and RG 1.174, Revision 3, a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

1.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption;

2.

The proposed change is consistent with the defense-in-depth philosophy;

3.

The proposed change maintains sufficient safety margins;

4.

When proposed changes result in an increase in core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement; and

5.

The impact of the proposed change should be monitored using performance measurement strategies.

3.0 TECHNICAL EVALUATION

The licensee proposed to add an RICT Program to the administrative controls section of the TSs, add new conditions and associated required actions in some TSs, and modify selected required actions to permit extending CTs if risk is assessed and managed as described in NEI 06-09, Revision 0-A. In accordance with NEI 06-09, Revision 0-A, PRA methods are used to justify each extension to a required action CT based on the specific plant configuration that exists at the time of the applicability of the required action and are updated when plant conditions change. The licensee's LAR for the changes proposed included documentation regarding the technical adequacy of the PRA models used in the CRMP, consistent with the requirements of RG 1.200.

Most TSs identify one or more conditions for which the LCO may not be met to permit a licensee to perform required testing, maintenance, or repair activities. Each condition has an associated required action for restoration of the LCO or for other actions, each with some fixed time interval referred to as the CT, which specifies the time interval permitted to complete the required action. Upon expiration of the CT, the licensee is required to shut down the reactor or follow the required action(s) stated in the Actions requirements. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or required actions if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance level of TS required equipment is unchanged, and the required action(s) including the requirement to shut down the reactor, are also unchanged. Only the CTs for the required actions are extended by the RICT Program.

The NRC staff reviewed the licensee's PRA methods and models to determine if they are technically acceptable for use in the proposed RICT extensions. The staff also reviewed the licensee's proposed RICT Program to determine if it provides the necessary administrative controls to permit CT extensions.

3.1 Review of PRA Methodology for Using RICTs RG 1.174, Revision 3 and RG 1.177, Revision 1 (References 19 and 20, respectively), identify five key safety principles to be applied to risk-informed changes to the TSs. Each of these principles is addressed in NEI 06-09, Revision 0-A. The NRC staff evaluated the licensee's proposed use of RICTs against these key safety principles, as discussed below.

3.1.1 Key Principle 1: Evaluation of Compliance with Current Regulations As stated in 10 CFR 50.36(c)(2):

Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee shall shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met.

When the necessary redundancy is not maintained (e.g., one train of a two-train system is inoperable), the TSs permit a limited period of time to restore the inoperable train to operable status and/or take other remedial measures. If these actions are not completed within the CT, the TSs normally require that the plant exit the mode of applicability for the LCO. With one train of a two-train system inoperable, the TS safety function is accomplished by the remaining operable train. In the current TSs, the CT is specified as a fixed time period (termed the "front stop"). The addition of the option to determine the CT in accordance with the RICT Program would allow an evaluation to determine a configuration-specific CT. The evaluation would be done in accordance with the methodology prescribed in NEI 06-09, Revision 0-A (Reference 14), and TS 5.5.20. The RICT is limited to a maximum of 30 days (termed the "back stop"), provided there is no loss of TS safety function. The CTs in the current TSs were established using experiential data, risk insights, and engineering judgment. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or required actions if risk is assessed and managed appropriately within specified limits and programmatic requirements.

When the necessary redundancy is not maintained, and the system loses the capability to perform its safety function(s) without any further failures (e.g., two trains of a two-train system are inoperable), there is a loss of TS safety function and the plant must exit the mode of applicability for the LCO, as specified in the TSs. A configuration-specific RICT may not be determined and used following a total loss of TS safety function because the system has lost the capability to perform its safety function(s). Therefore, with the incorporation of the RICT Program, the required performance levels of equipment specified in LCOs are not changed.

Only the required CT for the Required Actions are modified.

For cases when a redundant structure, system, and component (SSC) in the RICT Program is declared inoperable and is an unplanned event, the change in the TSs provide an allowance of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore a train to operable status or implement the RICT Program as described in TS 5.5.20 (see Section 2.2 of this SE). Specifically, a PRA functionality determination is made based on NEI 06-09, Revision 0-A, with further constraints, as stated in Part f of proposed TS 5.5.20 and addressing the issue of CCF mechanisms described in Part g of proposed TS 5.5.20. Once entry into the RICT Program is justified, the estimate is limited and may not exceed the 24-hour action statement (Part e of proposed TS 5.5.20). The PRA functionality is not the same as functional assessment, as stated in page 5 of the NRC staff's SE approval for NEI 06-09, Revision 0-A (Reference 13), which states, in part "[t]he RMTS define 'PRA functionality' as that which can be explicitly credited in a RICT calculation of a TS inoperable SSC, and is not to be confused with the use of the term, 'functionality,' in the Operability Determination Process described in Regulatory Issue Summary 2005-20, 'Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability.... "' (Reference 24).

3.1.1.1 Key Principle 1 Conclusions Sections 3.1.2 and 3.1.3 of this SE provide an evaluation of the defense-in-depth and safety margin considerations associated with the RICT Program. For the reasons described in Sections 3.1.2 and 3.1.3 and for the reasons described above, the NRC staff concludes that the requirements of 10 CFR 50.36 are satisfied. This ensures that the plant will be operated in accordance with the design (i.e., the application, as amended) and is safe. Therefore, the requirements of 10 CFR 50.57(a)(2) and 10 CFR 50.57(a)(6) are met.

Based on the discussion provided above, the NRC staff finds that the proposed changes meet the first key safety principle of RG 1.174, Revision 3 and RG 1.177, Revision 1.

3.1.2 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon.

Defense-in-depth includes the use of access controls, physical barriers, redundant and diverse key safety functions, and emergency response measures.

As discussed throughout RG 1.17 4, Revision 3 (Reference 19), consistency with the defense-in-depth philosophy is maintained by the following measures:

Preserve a reasonable balance among the layers of defense.

Preserve adequate capability of design features without an overreliance on programmatic activities as compensatory measures.

Preserve system redundancy, independence, and diversity commensurate with the expected frequency and consequences of challenges to the system, including consideration of uncertainty.

Preserve adequate defense against potential CCFs.

Maintain multiple fission product barriers.

Preserve sufficient defense against human errors.

Continue to meet the intent of the plant's design criteria.

The proposed change represents a robust technical approach that preserves a reasonable balance among avoidance of core damage, avoidance of containment failure, and consequence mitigation. The three-tiered approach to risk-informed TS CT changes provides additional assurance that defense-in-depth will not.be significantly impacted by such changes to the licensing basis. The licensee is proposing no changes to the design of the plant or any operating parameter, no new operating configurations, and no new changes to the design basis in the proposed changes to the TSs.

The effect of the proposed changes, when implemented, will be that the RICT Program will allow CTs to vary based on the risk significance of the given plant configuration (i.e., the equipment out of service at any given time) provided that the system(s) retain(s) the capability to perform the applicable safety function(s) without any further failures (e.g., one train of_ a two-train system are inoperable). A configuration-specific RICTmay not be determined and used following a loss of TS safety function when the system has lost the capability to perform its safety function( s ). These restrictions on loss of TS-specified safety function or inoperability of all required trains of a system ensure that consistency with the defense-in-depth philosophy is maintained by following existing guidance when the capability to perform TS safety function(s) is lost.

The proposed RICT Program uses plant-specific operating experience for component reliability and availability data. Thus, the allowances permitted by the RICT Program are directly reflective of actual component performance in conjunction with component risk significance. In some cases, the RICT Program may use compensatory actions to reduce calculated risk in some configurations. Where credited in the PRA, these actions are incorporated into station procedures or work instructions and have been modeled using appropriate human reliability considerations. Application of the RICT Program determines the risk significance of plant configurations. It also permits the operator to identify the equipment that has the greatest effect on the existing configuration risk. With this information, the operator can manage the out-of-service duration and determine the consequences of removing additional equipment from service.

The application of the RICT Program places high value on key safety functions and works to ensure they remain a top priority over all plant conditions. The RICT will be applied to extend CTs on key electrical power distribution systems. Failures in electrical power distribution systems can simultaneously affect multiple safety functions; therefore, potential degradation to defense-in-depth during the extended CTs are discussed further below.

3.1.2.1 Use of Compensatory Measures to Retain Defense-in-Depth Application of the RICT Program provides a structure to assist the operator in identifying effective compensatory actions for various plant maintenance configurations to maintain and manage acceptable risk levels. NEI 06-09, Revision 0-A (Reference 14 ), addresses potential compensatory actions and RMA measures by stating, in generic terms, that compensatory measures may include but are not limited to the following:

Reduce the duration of risk sensitive activities.

Remove risk sensitive activities from the planned work scope.

Reschedule work activities to avoid high risk-sensitive equipment outages or maintenance states that result in high risk plant configurations.

Accelerate the restoration of out-of-service equipment.

Determine and establish the safest plant configuration.

NEI 06-09, Revision 0-A, requires that compensatory measures be initiated when the PRA-calculated risk management action time (RMAT) is exceeded, or for preplanned maintenance for which the RMAT is expected to be exceeded, RMAs shall be implemented at the earliest appropriate time. Compensatory measures are developed to provide assurance that additional defenses are in place for specific plant configurations, as appropriate. Therefore, the NRC staff finds that compensatory measures support the conclusion that the RICT Program is consistent with the principle of defense-in-depth.

3.1.2.2 Evaluation of Electrical Power Systems 3.1.2.2.1 Electrical Systems Descriptions According to the Palo Verde UFSAR, the plant is designed such that the safety functions are maintained assuming a single failure within the electrical power system. By incorporating an electrical power supply perspective, this concept is further reflected in a number of principal design criteria for Palo Verde. Single failure requirements are typically suspended for the time that a plant is not meeting a TS LCO (i.e., in an action statement). This section considers the plant configurations from a defense-in-depth perspective.

3.1.2.2. 1.1 Offsite Power System As described in the Palo Verde UFSAR Chapter 8, "Electrical Power (Reference 18)," the offsite power system consists of eight physically independent circuits from the Arizona-New Mexico-California-Southern Nevada power grid to the Palo Verde switchyard. Offsite power is provided from the switchyard through three startup transformers (SUTs) and six intermediate buses to supply two physically independent preferred power circuits to the AC power distribution system of each unit. The transmission system associated with Palo Verde supplies offsite AC power at 525 kilovolts (kV) for startup, normal operation, and safe shutdown of Palo Verde Units 1, 2, and 3.

The 525-kV switchyard was designed with a breaker-and-half configuration, in which three

breakers are provided for every two terminations, either line or transformers. The switchyard is connected to the eight 525 kV transmission lines associated with Palo Verde, the 525/24 kV turbine-generator main transformers, and the 525/13.8 kV SUTs. Each turbine generator connects to the switchyard through a main transformer, a 525-kV tie line, and two 525 kV switchyard breakers. The three SUTs connect to the switchyard through two 525 kV switchyard breakers each, and feed six 13.8 kV intermediate buses. These buses are arranged in three pairs. each pair feeding only one unit. The intermediate buses for Palo Verde, Units 1, 2, and 3 are interconnected to the SUTs so that each unit's buses can access all three SUTs when all SUTs are connected to the switchyard. The intermediate buses are connected to the onsite power system by one 13.8 kV transmission line per bus (two per unit).

3. 1. 2. 2. 1. 2 Onsite Power Systems 3.1.2.2.1.2.1 AC Power Systems 3.1.2.2.1.2.1.1 Non-Class 1E AC Power System As described in Chapter 8 of the Palo Verde UFSAR, the non-Class 1 E AC system distributes power at 13.8 kV, 4.16 kV, 480 volts (V), and 208/120 V for nonsafety-related loads. Only nonsafety-related loads are supplied by the non-Class 1 E AC system. During normal plant operation, power for the onsite non-Class 1 E AC system is supplied through the unit auxiliary transformer connected to the generator isolated phase bus. Two offsite sources are provided to meet startup, shutdown, and post-shutdown requirements of the unit. Each unit's non-Class 1 E power system is divided into two parts arranged so that the possibility of a forced shutdown, due to loss of one part, will be minimized. Each part supplies a load group including approximately half of the unit auxiliaries.

Three SUTs connected to the 525-kV switchyard are shared between Palo Verde, Units 1, 2, and 3 and are connected to 13.8-kV buses of the units. Each SUT is capable of supplying 100 percent of the startup or normally operating loads of one unit simultaneously with the engineered safety feature (ESF) loads associated with two load groups of another unit. The non-Class 1 E AC buses normally are supplied through the unit auxiliary transformer, and the Class 1 E buses normally are supplied through the SUTs. In the event of loss of supply from the unit auxiliary transformer ( except for overcurrent trip), an automatic fast transfer of the 13.8 kV buses to the SUTs is initiated to provide power to the auxiliary loads. Preferred power for Class 1 E buses is supplied from the SUTs through the 13.8-kV switchgear and the 13.8-to 4.16-kV ESF transformers.

3.1.2.2.1.2.1.2 Class 1 EA C Power System As described in Chapter 8 of the Palo Verde UFSAR, the Class 1 E AC system distributes power at 4.16 kV, 480 V, and 120 V to all Class 1 E loads. Also, the Class 1 E AC system supplies power to certain selected loads that are not directly safety-related but are important to the plant.

The onsite Class 1 E AC system contains standby power sources that automatically provide the power required for safe shutdown in the event of loss of the Class 1 E bus voltage.

The safety-related equipment is divided into two load groups per unit {Load Groups 1 and 2).

For each unit, either one of the load groups is capable of providing power for safely shutting down the unit. Each AC load group consists of one 4.16-kV bus, three 480-V load centers, and four 480-V motor control centers (MCCs). In addition, two non-Class 1 E MCCs are connected to each load group and are tripped on a safety injection actuation signal. Each 4.16-kV load group is supplied by two preferred power supply feeders and one diesel generator (DG) supply feeder. Each 4.16-kV bus supplies three 750 kV ampere, 4.16 kV, 480 V station service transformers and associated load centers.

Loss of offsite power when both buses are connected to the same preferred source, results in an automatic trip of both ESF bus main breakers. Thus, failure of one breaker to trip will not result in paralleling the DGs. Circuit breaker interlocks are provided to prevent manually paralleling the DGs.. During manually initiated testing, only one DG at a time may be paralleled with the offsite source power. There are provisions for manually connecting both ESF buses to a single standby power source during emergency conditions. Additionally, power can be supplied to a single ESF bus of one unit from a standby power source of another Palo Verde unit. Restrictions and instructions governing the use of these two abnormal electrical lineups are given in the applicable emergency and abnormal operating procedures.

3.1.2.2.1.2.2 Direct Current Power Systems As described in Chapter 8 of the Palo Verde UFSAR, the Class 1 E 125 V DC system for each unit is made up of two trains (A and B) of four independent channels (A, B, C and D).

Channels A and C are designated as Load Group 1 or Train A; Channels B and D are designated as Load Group 2 or Train B. Channels A and B provide control power to AC Load Groups 1 {Train A) and 2 (Train B), to vital instrumentation and control (l&C) power for Channels A and B of the reactor protection and ESF systems and DGs A and B. Channels C and D also provide l&C power to the reactor protection and ESF system and other safety-related loads. Each channel contains a battery (greater than or equal to 100 percent capacity), a battery charger, a control center, a distribution panel, and is supplied with Class 1 E 480-volt alternating current (VAC) power from a different MCC within its associated load group.

Each load group or train additionally contains a backup battery charger aligned to its respective A and B direct current train, which can be manually connected to Channels A or C for Load Group 1 and Channels B or D for Load Group 2.

Each of the four DC channels is energized by one battery, which is maintained at a float voltage by a battery charger. Additionally, each train contains a backup battery charger aligned to its respective A or B direct current train, which can be manually connected to Channels A or C for Load Group 1 and Channels B or D for Load Group 2. The backup battery charger provides backup service in the event that the normal battery charger is out of service. Each battery is exclusively associated with a single 125-volt direct current (VDC) bus. The battery and the battery charger exclusively associated with one of these four 125-VDC channels cannot be interconnected with any other 125-VDC channel. The battery chargers are supplied from the same AC load group for which the associated DC channel supplies the control power. The Class 1 E backup chargers are mechanically interlocked to prevent Channels A or C and B or D from being simultaneously connected. Four inverters supplied from the DC channel provide four independent 120-VAC vital l&C power for the four channels of the reactor protection and ESF systems.

Non-Class 1 E DC loads are not fed from Class 1 E DC buses. The non-Class 1 E loads for the station are supplied by a separate DC system. The non-Class 1 E DC system consists of two 125-V batteries, two DC control centers, three battery chargers, and four DC distribution panels for control and power loads. A spare battery charger is provided as a backup to the primary battery chargers. The spare charger cannot provide power to both systems simultaneously.

Two physically independent circuits are provided for offsite power to the onsite distribution system for each unit. The offsite source normally connected to each ESF bus is immediately available to supply components important to safety following a postulated loss-of-coolant accident (LOCA). Distribution circuits to redundant equipment are independent of each other.

Some nonsafety-related circuits may be supplied from the safety-related DC buses. When this is done, those circuits are treated as safety-related up to the equipment terminations or isolation devices.

If preferred power is available to the Class 1 E bus following an engineered safety feature actuation system (ESFAS), the required Class 1 E loads will be started through a solid-state sequencer. However, in the event that preferred power is lost, the Class 1 E system functions to shed Class 1 E loads and to connect the standby power source to the Class 1 E bus. The load sequencer, one for each load group, then functions to start the required Class 1 E loads in programmed time increments. Each redundant ESF load sequencer system is supplied from a separate 120-V vital AC distribution bus and a separate Class 1 E 125-VDC distribution bus.

3. 1. 2. 2. 2 Evaluation The licensee has requested the use of the RICT Program to extend the existing CT for TS 3.8, "Electrical Power Systems," conditions. The licensee has proposed no changes to the design of the plant equipment associated with these TS conditions. No changes to the design basis are proposed in the application. The licensee has utilized the methodology described in the NRG-approved guidance in NEI 06-09, Revision 0-A, for its proposed RICT Program. The NRC staff notes that APS is not proposing any deviations from the NEI guidance.

The NRC staff's evaluation of the proposed changes considered a number of potential plant conditions that could be encountered while exercising the RICT Program. The NRC staff also considered the available redundant or diverse means to respond to various plant conditions. In these evaluations, the staff examined the safety significance of different plant conditions resulting in both shorter and longer CTs.

The proposed language in TS 5.5.20, "Risk Informed Completion Time Program," of the supplemental LAR dated November 3, 2017 (Reference 3), indicates that the RICT may not exceed 30 days, and hereinafter referred to as "backstop." Use of a RICT is not permitted for voluntary entry into a configuration, which represents a loss of function (LOF). Use of an RICT is permitted for emergent conditions, which represent an LOF or inoperability of all required trains of a system required to be operable if one or more of the trains are considered "PRA functional" as defined in NEI 06-09, Revision 0-A. The RICT for these LOF conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Design-basis success criteria parameters shall be met for all design-basis accident (OBA) scenarios for establishing PRA functionality during a TS LOF condition where an RICT is applied.

With regard to PRA functionality, in the supplemental LAR dated June 1, 2018 (Reference 5),

the licensee stated that the PRA functionality evaluations will be performed using draft Procedure 40DP-9RS04, "PRA Functionality Determination." The draft procedure specifies that components that are declared inoperable for meeting TS requirements, are not considered PRA functional until a PRA functionality evaluation is performed. The procedure provides both guidance and a form for performing a PRA functionality evaluation. In LOF conditions (i.e., all trains of a safety system inoperable), the PRA functionality determination criteria requires at least one train to be capable of meeting its design-basis success criteria parameters for OBA scenarios (e.g., the train is inoperable only for administrative reasons). Upon completion of a successful PRA functionality evaluation, the component may be credited in the RICT Program calculation. Until the PRA functionality determination is made, the existing TS front stop is applicable.

The NRC staff notes that when the TS LOF occurs, the licensee will perform the PRA functionality evaluations prior to the use of the RICT Program. The guidance in NEI 06-09, Revision 0-A, directs that a risk calculation shall be performed to determine a revised RMAT and RICT within the shorter of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or the most limiting front-stop CT after a plant configuration change affecting the RICT has occurred. The guidance further states that the RICT assessment shall assume equipment declared inoperable is also non-functional unless a condition exists that is explicitly modeled in the PRA, and the PRA functionality criteria are satisfied.

The NRC staff reviewed information pertaining to the proposed electrical power systems TS conditions in the LAR, the UFSAR, and the applicable TS LCO and TS Bases to verify the capability of the affected electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained. To achieve that objective, the staff verified whether the proposed TS condition's design success criteria (DSC) reflect the redundant or absolute minimum electrical power source/subsystem required to be operable by the associated LCO to support the safety functions necessary to mitigate postulated DBAs, safely shutdown the reactor, and maintain the reactor in a safe shutdown condition. The DSC are provided in Table A5-1 in Attachment 5 of the LAR supplement dated November 3, 2017, and Table A5-1 in Attachment 1 of the LAR supplement dated September 21, 2018 (Reference 6). The staff further reviewed the remaining credited power source/equipment to verify whether the proposed condition satisfies its DSC. In conjunction with reviewing the remaining power source/equipment, the staff considered supplemental electrical power sources/equipment (not necessarily required by the LCOs and can be either safety or nonsafety-related) that are/is available at Palo Verde and capable of performing the same safety function of the inoperable electrical power source/equipment.

For the proposed TS conditions identified as LOF, the NRC staff verified whether the 24-hour LOF backstop is identified as applicable to the CT. The staff also verified whether the restrictions described in the proposed language in TS 5.5.20 in the LAR supplement dated November 3, 2017 (e.g. backstop, equipment/power source is not voluntarily made inoperable, and constrains, etc.), are properly identified as applicable to the TS condition. In addition, the staff reviewed the proposed RMA examples for reasonable assurance that these RMAs are appropriate to monitor and *control risk for applicable TS conditions.

3.1.2.2.2.1 TS 3. 8. 1, "AC Sources - Operating" LCO 3.8.1 The following AC electrical sources shall be OPERABLE:

3.1.2.2.2. 1.1

, a.

Two circuits between the offsite transmission network and the onsite Class 1 E AC Electrical Power Distribution System;

b.

Two diesel generators (DGs) each capable of supplying one train of the onsite Class 1 E AC Electrical Power Distribution System; and

c.

Automatic load sequencers for Train A and Train B.

TS 3. 8. 1 Condition A - One Required Offsite Circuit Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017 (Reference 3), the licensee has requested to use the RICT Program to extend the existing CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for TS 3.8.1 Condition A. The proposed CT to restore the required offsite circuit to operable status is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the RICT Program.

Table A5-2, "Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate," in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.1 Condition A. The backstop for this condition is 30 days. According to Table A5-1, in Attachment 1 of the LAR supplement dated September 21, 2018 (Reference 6), the DSC for TS 3.8.1 Condition A is "1 of 4 AC Sources."

According to the Palo Verde UFSAR, the onsite electric power system for each unit contains two independent load groups, each with its own offsite and onsite power supplies, buses, transformers, loads, and associated 125-VDC control power. Each load group is independently capable of safely shutting down the unit. Further, each of the three SUTs is capable of supplying 100 percent of the startup or normally operating loads of one unit simultaneously with the ESF loads associated with two load groups of another unit. The NRC staff notes that during the entry of the RICT Program for TS 3.8.1 Condition A, when one required offsite circuit inoperable, the remaining required LCO 3.8.1a offsite circuit and two LCO 3.8.1 b DGs will be capable of supplying power to the ESF systems required to mitigate DBAs with offsite power available. In case offsite power is lost concurrently with the DBAs, as assumed in the Palo Verde UFSAR Chapter 15 analysis, the two LCO 3.8.1 b DGs will have the capability to power the minimum ESF systems required to mitigate the DBAs.

In addition, according to the Palo Verde UFSAR, the six intermediate buses for Palo Verde, Units 1, 2, and 3 are interconnected to three SUTs so that each unit's buses can access all three SUTs when all SUTs are connected to the switchyard. Furthermore, the UFSAR indicates that AC power can be supplied to an ESF bus of one unit by a standby power source of another unit. The NRC staff notes that in this design configuration, when one offsite circuit is inoperable, the affected unit's intermediate buses have capability to access to the remaining offsite circuit via other SUT, and the ESF bus has capability to access to the other unit's onsite standby power (i.e., emergency diesel generators (EDGs)). Therefore, the staff considers the offsite circuit(s) and onsite EDG(s) of other unit(s) as the potential supplemental AC power sources for the affected unit upon one of its offsite circuits inoperable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition A and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.1 minimum requirement to support the TS safety functions; and (b) during the RICT

Program entry for TS 3.8.1 Condition A, the remaining required offsite power circuit and DGs and the supplemental AC power sources will be capable of supplying power to the safety-related loads and to shut down the plant safely, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.1, Condition A, is acceptable because during the entry of TS 3.8.1, Condition A, the capability of the AC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.1.2 TS 3.8.1 Condition B - One DG Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 10 days for TS 3.8.1, Condition B. The proposed CT to restore the required DG to operable status is 10 days or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplemental dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.1, Condition B. The backstop for this condition is 30 days. According to Table A5-1 in Attachment 1 of the LAR supplement dated September 21, 2018, the DSC for TS 3.8.1, Condition B is "1 of 4 AC Sources."

According to the Palo Verde UFSAR, the onsite electric power system for each unit contains two independent load groups, each with its own offsite and onsite power supplies, buses, transformers, loads, and associated 125 VDC control power. Each load group is independently capable of safely shutting down the unit. Further, each of the three SUTs is capable of supplying 100 percent of the startup or normally operating loads of one unit simultaneously, with the ESF loads associated with two load groups of another unit. The NRC staff notes that during the entry of the RICT Program for TS 3.8.1 Condition B, when one DG inoperable, the remaining LCO 3.8.1 b DG and two LCO 3.8.1 a offsite circuits will be capable of supplying power to the ESF systems required to mitigate DBAs with offsite power available. In the event offsite power is lost concurrent with the DBAs, the remaining LCO 3.8.1 b DG will be relied on to power the minimum ESF systems required to mitigate the DBAs.

In addition, as discussed above in Section 3.1.2.2.2.1.1, the NRC staff considers the offsite circuit(s) and onsite EDG(s) of other unit(s) as potential supplemental AC power sources for the affected unit upon one of its DGs inoperable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition B and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.1 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.1 Condition B, the required offsite power circuit, the remaining DG, and the supplemental AC power sources will be capable of supplying power to the safety-related loads and to shut down the plant safely, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.1 Condition B is acceptable because during the entry of TS 3.8.1 Condition B, the capability of the AC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.1.3 TS 3. 8. 1 Condition C - Two Required Offsite Circuits Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for TS 3.8.1 Condition C. The proposed CT to restore the required DG to operable status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.1 Condition C. The backstop for this condition is 30 days. According to Table A5-1 in Attachment 1 of the LAR supplement LAR dated September 21, 2018, the DSC for TS 3.8.1 Condition C is "1 of 4 AC Sources."

As described in the Palo Verde UFSAR, the onsite electric power system for each unit contains two independent load groups, each with its own offsite and onsite power supplies, buses, transformers, loads, and associated 125-VDC control power. Each load group is independently capable of safely shutting down the unit. The function of LCO 3.8.1 is to provide AC power sources to power ESF loads. The NRC staff notes that the Palo Verde AC sources include offsite circuits and onsite EDGs. During normal operation, the offsite circuits supply power to the onsite Class 1 E power distribution system, and the EDGs are on standby. When the offsite circuits are inoperable (TS 3.8.1 Condition C), the power for the Class 1 E power distribution system is, by design, supplied by the EDGs (two LCO 3.8.1 b DGs), thus, the TS function is maintained.

In addition, as discussed above in Section 3.1.2.2.2.1.1, the NRC staff considers the offsite circuit(s) and onsite EDG(s) of other unit(s) as potential supplement AC power sources for the affected unit upon its two offsite circuits inoperable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition C and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.1 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.1 Condition C, the two LCO 3.8.1 b DGs and the supplemental AC sources will be capable of supplying power to the safety-related loads and to shut down the plant safely, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.1 Condition C is acceptable because during the entry of TS 3.8.1 Condition C, the capability of the AC electrical power systems to perform their safety functions (assuming no additional electrical equipment failures) is maintained.

3.1.2.2.2.1.4 TS 3. 8. 1 Condition D - One Required Offsite Circuit and One DG Inoperable As described in Attachments 1 and 2.of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for TS 3.8.1 Condition D. The proposed CT, to restore the required offsite circuit or the DG to operable status, is 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.1 Condition D. The backstop for this condition is 30 days. According to Table A5-1 in Attachment 1 of the LAR supplement dated September 21, 2018, the DSC for TS 3.8.1 Condition Dis "1 of 4 AC Sources."

As described in the Palo Verde UFSAR, the onsite electric power system for each unit contains two independent load groups, each with its own offsite and onsite power supplies, buses, transformers, loads, and associated 125-VDC control power. Each load group is independently capable of safely shutting down the unit. Further, each of the three SUTs is capable of supplying 100 percent of the startup or normally operating loads of one unit simultaneously with the ESF loads associated with two load groups of another unit. The NRC staff notes that during the entry of the RICT Program for TS 3.8.1 Condition D, when one required offsite circuits and one DG inoperable, the remaining LCO 3.8.1 a offsite circuit and the remaining LCO 3.8.1 b DG will be capable of supplying power to ESF systems required to mitigate DBAs with offsite power.

In the event offsite power is lost concurrent with the DBAs, as assumed in the Palo Verde UFSAR Chapter 15 analysis, the remaining LCO 3.8.1 b DG will be relied on to power the minimum ESF systems required to mitigate the DBAs.

In addition, as discussed above in Section 3.1.2.2.2.1.1, the NRC staff considers the offsite.

circuit(s) and onsite EDG(s) of other unit(s) as potential supplement AC power sources for the affected unit upon one required offsite circuit and one DG inoperable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition D and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.1 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.1 Condition D, the remaining LCO 3.8.1 offsite power circuit, the remaining LCO 3.8.1 DG, and the supplemental AC power sources will be capable of supplying power to the safety-related loads and to shut down the plant safely, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.1 Condition D is acceptable because during the entry of TS 3.8.1 Condition D the capability of the* AC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.1.5 TS 3.8.1 Condition E-Two DGs Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for TS 3.8.1 Condition E. The proposed CT to restore one DG to operable status is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the RICT Program. The licensee has identified this TS condition as LOF and the following notes are proposed to be added for this condition to provide restrictions on the use of RICT Program.

NOTES----------------------------------------------------

1.

Not applicable when second DG intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

As stated in the enclosure of the LAR supplement dated November 3, 2017, proposed TS 5.5.20 provides the following restrictions applicable to the above notes and this review:

b.

A RICT may only be utilized in MODE 1 and 2.

c.2.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

c.3.

Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d.

Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e.

Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0)-A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f.

Use of a RICT is permitted for emergent conditions, which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered "PRA Functional" as defined in Section 2.3.1 of NEI 06-09 (Revision 0)-A.

However, the following additional constraints shall be applied to the criteria for "PRA Functional."

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied.

g.

Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CG failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review.

h.

A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

The NRC staff notes that the above restrictions are consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that these restrictions associated with TS 3.8.1 Condition E are reasonable.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as both RICT calculated low and high estimates for TS 3.8.1 Condition E. This TS condition is identified as LOF and the backstop for this condition is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . According to Table A5-1 in of the LAR supplement dated September 21, 2018, the DSC for TS 3.8.1 Condition Eis "1 of 4 AC Sources."

As described in the Palo Verde UFSAR, the onsite electric power system for each unit contains two independent load groups, each with its own offsite and onsite power supplies, buses, transformers, loads, and associated 125-VDC control power. Each load group is independently capable of safely shutting down the unit. Further, each of the three SUTs is capable of supplying 100 percent of the startup or normally operating loads of one unit simultaneously with the ESF loads associated with two load groups of another unit. The NRC staff notes that during the entry of the RICT Program for TS 3.8.1 Condition E, when two DGs inoperable, two LCO 3.8.1 a offsite circuits will be capable of supplying power to the ESF systems required to mitigate DBAs with offsite power available. In the event offsite power is lost concurrent with the DBAs during an RICT Program entry for TS 3.8.1 Condition E, no AC power source available to power the minimum ESF systems is required to mitigate the DBAs.

The NRC staff notes that during normal operation, the LCO 3.8.1a offsite circuits supply power to the onsite Class 1 E power distribution system and the LCO 3.8.1 b DGs are on standby. In this case, the inoperability of the DGs does not technically encompass a loss of the TS safety function. However, in the event offsite power is lost concurrent with the DBAs, as assumed in the Palo Verde UFSAR accident analysis, two LCO 3.8.1 b DGs inoperable would result in no AC power source available to power the minimum ESF systems required to mitigate the DBAs.

Furthermore, while the nonsafety-related offsite circuits are assumed to be unavailable in several accident analyses, the safety-related DGs are the credited source of power to the Class 1 E buses in the accident analysis that assume a loss of offsite power. For these reasons, the inoperability of two LCO 3.8.1 b DGs should be treated as LOF. The staff notes that the licensee has identified TS 3.8.1 Condition E as LOF and provided an adequate backstop (24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) as well as appropriate restrictions on the use of RICT Program as described above.

As discussed above in Section 3.1.2.2.2.1.1, the NRC staff considers the offsite circuit(s) and onsite EDG(s) of other unit(s) as potential supplement AC power sources for the affected unit upon two DGs inoperable.

The following are the RMA examples, provided in Attachment 16 of the LAR supplement dated November 3, 2017, associated with TS 3.8.1 Condition E:

1.

Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

2.

Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs

[station blackout generators] should local operation of the SBOGs be required as a result of on-site weather-related damage.

3.

Maintain availability of 4160 VAC safety buses.

4.

Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e.,

power peaking to the grid).

5.

Suspend/minimize discretionary activities in the SRP [Salt River Project]

switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

6.

The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

7.

The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

8.

Consider establishing the OCC [Outage Control Center] for oversight and monitoring of the compensatory measures and the actions described in this section.

The NRC staff notes that the actions specified above are consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that the examples of the RMAs associated with TS 3.8.1 Condition E are reasonable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition E and supporting documentation. Based on the discussion above, the staff finds that the licensee has appropriately identified TS 3.8.1 Condition E as LOF and provided 24-hour LOF backstop as well as adequate restrictions on the use of the RICT Program (e.g., any SSCs credited in the PRA functionality determination shall be the same SSCs relied upon to perform the specified TS safety function). The staff also finds that the demonstration of identifying and implementing compensatory measures or RMAs, in accordance with the RICT Program, provides reasonable assurance that these RMA examples are appropriate to monitor and control risk. Therefore, the staff finds that the proposed change to TS 3.8.1 Condition E is acceptable.

3.1.2.2.2.1.6 TS 3. 8. 1 Condition F - One Automatic Load Sequencer Inoperable The load sequencers are part of the ESF system and their function is to sequentially load the DGs. In the event that preferred offsite power is lost, the Class 1 E system functions to shed Class 1 E loads and to connect the standby power source to the Class 1 E bus. The load sequencer then starts the required Class 1 E loads in programmed time increments. A sequencer is provided for each load group. The sequencer loads safe shutdown and ESF equipment onto the ESF bus so that essential loads are started within the time limits.

Undervoltage on the ESF bus trips all bus load automatically. After the DG attains rated speed and voltage, its own circuit breaker is ready to close automatically without delay, but automatic or manual closure is blocked whenever an ESF bus fault exists. A DG breaker closed signal starts the loading sequence.

As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for TS 3.8.1 Condition F, Required Action F.1. The proposed CT to restore the automatic load sequencer to operable status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 19 days as the RICT calculated low estimate and 30 days as the RICT calculated high estimate for TS 3.8.1 Condition F. The backstop for this condition is 30 days. According to Table A5-1 in of the LAR supplement dated September 21, 2018, the DSC for TS 3.8.1 Condition Fis "1 of 2 automatic load sequencers."

As described in the Palo Verde UFSAR, each redundant ESF load sequencer system has the capacity to perform logic functions to generate the loss of offsite power signal or load shed signal, the DG start signal, and the load sequencer start and permissive signals. The NRC staff notes that during the entry of the RICT Program for TS 3.8.1 Condition F, when one autOmatic load sequencer inoperable, the remaining LCO 3.8.1 c automatic load sequencer will be capable of sequencing the start of emergency loads required to mitigate DBAs.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition F and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.1 minimum requirement to s1,1pport the TS safety functions; and (b) during the RICT Program entry for TS 3.8.1 Condition F, the remaining automatic load sequencer will be capable of sequencing the start of emergency loads, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.1 Condition F is acceptable because during the entry of TS 3.8.1 Condition F, the capability of the AC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.1. 7 TS 3.8.1 Condition H-Three or More Required AC Sources Inoperable TS 3.8.1 Condition His currently TS 3.8.1 Condition I, which states, "Three or more required AC sources inoperable." The existing required action is to immediately enter LCO 3.0.3. The proposed required action is to restore required AC source(s) to operable status. The proposed CT is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or in accordance with the RICT Program. The licensee has identified this TS condition as LOF and the following notes are proposed to be added for this condition to provide restrictions on the use of RICT Program.

NOTES--------------------------------------------------

1.

Not applicable when the third or a subsequent required AC source intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The NRC staff notes that the above restrictions are consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that these restrictions associated with TS 3.8.1 Condition H are reasonable.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months as the RICT calculated low estimate and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as the RICT calculated high estimates for TS 3.8.1 Condition H. The backstop for this condition is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following are the RMA examples, provided in Attachment 2 of the LAR supplement dated September 21, 2018, associated with TS 3.8.1 Condition H:

1.

Suspend/minimize discretionary activities on the Station Blackout Generators (SBOGs), the main and unit auxiliary transformers associated with the unit, and the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2.

Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3; Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power availability to the unit.

4.

The system load dispatcher will be contacted once per day to ensure no I

significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-Informed Completion Time.

5.

If applicable, the redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no aiscretionary maintenance activities will be scheduled on the redundant Available DG.

6.

Maintain Availability of 4160 VAC safety buses.

7.

Consider staging and connecting portable generators to a 4160 VAC safety bus.

8.

Consider establishing the Outage Control Center (OCC) for oversight and monitoring of the compensatory measures. and the actions described in this section.

The NRC staff notes that the actions specified above are consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that the examples of the RMAs associated with TS 3.8.1 Condition H are reasonable.

As discussed above in Section 3.1.2.2.2.1.1, the NRC staff considers the offsite circuit(s) and onsite EDG(s) of other unit(s) as potential supplement AC power sources for the affected unit upon three or more required AC sources inoperable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.1 Condition H and supporting documentation. The staff finds that the licensee has appropriately identified TS 3.8.1 Condition H as LOF and provided 24-hour LOF backstop as well as adequate restrictions on the use of RICT Program (e.g., any SSCs credited in the PRA functionality determination shall be the same SSCs relied upon to perform the specified TS safety function). The staff also finds that the demonstration of identifying and implementing compensatory measures or RMAs, in accordance with the RICT Program, provides reasonable assurance that these RMA examples are appropriate to monitor and control risk. Therefore, the staff finds that the proposed change to TS 3.8.1 Condition H is acceptable.

3.1.2.2.2.2 TS 3. 8.4, "DC Sources - Operating" LCO 3.8.4 states, "The Train A and Train B DC electrical power subsystems shall be OPERABLE."

3.1.2.2.2.2.1 TS 3.8.4 Condition A - One Battery Charger on One Subsystem Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017 (Reference 3), the licensee has requested to use the RICT Program to extend the existing CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for TS 3.8.4 Condition A, Required Action A.3. The proposed CT to restore the battery charger to operable status is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplemental dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.4 Condition A. The backstop for this condition is 30 days. According to Table A5-1, "In Scope TS/LCO Conditions to Corresponding PRA Functions," of Attachment 5 of the LAR supplement dated November 3, 2017, the DSC for TS 3.8.4 Condition A is "1 of 2 [DC] electrical power subsystems."

As described in the Palo Verde UFSAR, the Class 1 E DC electrical power system for each unit consists of two redundant trains (subsystems) with four independent channels (two channels per train). Each channel contains equipment including a battery and a battery charger. Each train contains an additional backup battery charger aligned to its respective train. The NRC staff notes that during the entry of the RICT Program for TS 3.8.4 Condition A, when one battery charger on one subsystem inoperable, the remaining LCO 3.8.1 battery charger from other channels of the same train and the backup battery charger will be capable of providing the Class 1 E DC power the respective Class 1 E AC load group. In addition, the other train of the Class 1 E DC electrical power system is also available to provide the same function as the affected train.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.4 Condition A and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.4 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.4 Condition A, the remaining battery charger and the backup battery charger will be capable of providing the charger's function, thus, the DSC are met. In addition, the other train of the Class 1 E DC electrical power system is also available to provide the same function as the affected train. The staff concludes that the proposed change to TS 3.8.4 Condition A is acceptable because during the entry of TS 3.8.4 Condition A, the capability of the DC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3. 1.2.2.2.2.2 TS 3.8.4 Condition 8-One DC Electrical Power Subsystem Inoperable for Reasons Other Than A As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for TS 3.8.4 Condition B. The proposed CT to restore the DC electrical power subsystem to operable status is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 3 days as the RICT calculated low estimate and 6 days as the RICT calculated high estimates for TS 3.8.4 Condition B. The backstop for this condition is 30 days. According to Table A5-1 of of the LAR supplement dated November 3, 2017, the DSC for TS 3.8.4 Condition Bis "1 of 2 [DC] electrical power subsystems."

As described in the Palo Verde UFSAR, the Class 1 E DC electrical power system for each unit consists of two redundant trains (subsystems) with four independent channels. Two of the four channels, one per each load group, supply control power for its respective load groups. Thus, each train is capable of providing required power to its respective Class 1 E AC load group. The NRC staff notes that during the entry of the RICT Program for TS 3.8.4 Condition A, when one train of DC electrical power system inoperable, the other train (the remaining LCO 3.8.4 Class 1 E DC electrical power subsystem) will be capable of providing the Class 1 E DC power to the respective Class 1 E AC load group.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.4 Condition B and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8.4 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.4 Condition B, the remaining DC electrical power subsystem (other train) will be capable of providing power to the AC emergency power system, selected safety-related equipment, and AC vital instrument bus, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.4 Condition B is acceptable because during the entry of TS 3.8.4 Condition B, the capability of the DC electrical power systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3. 1.2.2.2.2.3 TS 3. 8.4 Condition C - Two DC Electrical Power Subsystems Inoperable The licensee has requested a new TS condition to TS 3.8.4, as follows:

Condition Required Action Completion Time C. Two DC electrical power C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months subsystems inoperable.

DC electrical power OR subsystem to OPERABLE status.

In accordance with the Risk Informed Completion Time Program The licensee has identified this TS condition as LOF and the following notes are proposed to be added for this condition to provide restrictions on the use of RICT Program.

NOTES-------------------------------------------------

1.

Not applicable when second DC electrical power subsystem intentionally made inoperable.

2.

The following Section 5.5.20 constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

The NRC staff notes that the above restrictions are consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that these restrictions associated with TS 3.8.4 Condition C are reasonable.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months as both RICT calculated low and high estimates for TS 3.8.4 Condition C. Note No. 6 of Table A5-2 in Attachment 5 of the LAR supplement, states that the RICT calculated estimates were evaluated with both Class 1 E DC electrical power subsystems (Train A and Train B - (all four channels)) being impacted. The licensee has identified TS 3.8.4 Condition C as LOF and provided restrictions as described in the proposed notes and Section 3.1.2.2.2.1.5 of this SE. The backstop for this condition is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following are the RMA examples, provided in Attachment 2 of the LAR supplement September 21, 2018 (Reference 6), associated with TS 3.8.4 Condition C:

1.

Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and the startup transformers. The SBOGs will not be used for non-safety functions (i.e.,

power peaking to the grid).

2.

Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

3.

Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient ( unit trip) or Loss of Off site Power (LOOP).

4.

Work to establish alternate power to the 125 VDC bus by temporary modification or by implementation of FLEX [Diverse and Flexible Mitigation Capability] procedure....

5.

Maintain Availability of redundant and diverse electrical systems.

6.

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather per [the appropriate procedure].

7.

Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

The NRC staff notes that the actions specified above are consistent with the NRG-approved guidance in NEI 06-09 Revision 0-A. Therefore, the staff finds that the examples of the RMAs associated with TS 3.8.4 Condition C are reasonable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.4 Condition C and supporting documentation. The staff finds that the licensee has appropriately identified TS 3.8.4 Condition C as LOF and provided 24-hour LOF backstop as well as adequate restrictions on the use of the RICT Program. The staff also finds that the demonstration of identifying and implementing compensatory measures or RMAs, in accordance with the RICT Program, provides reasonable assurance that these RMA examples are appropriate to monitor and control risk. Therefore, the staff finds that the proposed change to TS 3.8.4 Condition C is acceptable.

3. 1.2.2.2.3 TS 3.8. 7, "Inverters-Operating" LCO 3.8.7, states, The required Train A and Train B inverters shall be OPERABLE.

NOTE----------------------------------------------

0 n e inverter may be disconnected from its associated DC bus for :s; 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital instrument bus is energized from its Class 1 E constant voltage source regulator; and

b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

3.1.2.2.2.3.1 TS 3.8. 7 Condition A - One Required Inverter Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017 (Reference 3), the licensee has requested to use the RICT Program to extend the existing CT of 7 days for TS 3.8. 7 Condition A. The proposed CT to restore the DC electrical power subsystem to operable status is 7 days or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8. 7 Condition A. The backstop for this condition is 30 days. According to Table A5-1 in Attachment 5 of the LAR supplement, the DSC for TS 3.8. 7 Condition A is "1 of 2 inverter trains."

As described in the Palo Verde UFSAR, four inverters, each supplied by a separate Class 1 E 125-VDC channel, provide four independent 120-VAC vital l&C power for the four channels of the reactor protection and ESF systems. In addition to the four inverters above, two additional 480 V, three-phase inverters from channel C and D batteries supply dedicated power to the shutdown cooling motor-operated valves. The NRC staff notes that during the entry of the RICT Program for TS 3.8. 7 Condition A, when one required inverter inoperable, the remaining inverters will be capable of providing power to the AC vital buses.

The NRC staff reviewed the licensee's proposed CT for TS 3.8. 7 Condition A and supporting documentation. Based on the discussion above, the staff finds that (a) the DSC reflect the LCO 3.8. 7 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8. 7 Condition A, the remaining inverters will be capable of providing power to power to the AC vital buses, thus the DSC are met. The staff concludes that the proposed change to TS 3.8. 7 Condition A is acceptable because during the entry of TS 3.8. 7 Condition A, the capability of the inverter systems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.3.2 TS 3.8. 7 Condition B-Two or More Required Inverters Inoperable The licensee has requested a new TS condition to TS 3.8.7, as follows:

Condition Required Action Completion Time B. Two or more required B.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inverters inoperable.

inverter to OPERABLE OR status.

In accordance with the Risk Informed Completion Time Program The licensee has identified this TS condition as "May be LOF" and the following notes are proposed to be added for this condition to provide restrictions on the use of RICT Program.

NOTES------------------------------------------------

1.

Not applicable when the second or a subsequent required inverter intentionally made inoperable resulting in loss of safety function.

2.

The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as the RICT calculated low estimate and 30 days as the RICT calculated high estimates for TS 3.8. 7 Condition B. The backstop for this condition is 30 days for a non-LOF condition and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the condition results in a LOF. For conditions that result in a LOF, the licensee provided the restrictions on the use of the RICT Program as described in the proposed notes and Section 3.1.2.2.2.1.5 of this SE.

Depending on the combinations of the inoperable inverters, an entry of TS 3.8. 7 Condition B may result in a LOF. To clarify the "May be LOF" terminology, in the LAR supplement dated September 21, 2018 (Reference 6), the licensee stated, in part, that "[i]f two inverters in the same train are inoperable and the other two inverters on the opposite train remain operable, it is not a LOF.... If the inoperable inverters impact both trains, it is considered a LOF, as the remaining channel(s) do not constitute a redundant train assumed in UFSAR Chapter 15." In the same supplement, the licensee provided a list of combinations of inoperable inverters and the result of each combination with respect to LOF as illustrated below:

SSC Loss of Notes Function (YES/NO)

Channel A and Channel C NO Two inverters on the opposite train remain operable.

Channel A and Channel B YES One inverter on each train is inoperable.

Channel A and Channel D YES One inverter on each train is inoperable.

SSC Loss of Notes Function (YES/NO)

Channel B and Channel D NO Two inverters on the opposite train remain operable.

Channel B and Channel C YES At least one inverter on each train is Inoperable.

Channel C and Channel D YES At least one inverter on each train is Inoperable.

ChannelA,ChannelC,and YES At least one inverter on each train is ChannelB Inoperable.

Channel A, ChannelC,and YES At least one inverter on each train is Channel D Inoperable.

ChannelB,ChannelD,and YES At least one inverter on each train is ChannelC Inoperable.

Channel 8, ChannelD,and YES At least one inverter on each train is Channel A Inoperable.

Channel A, Channel B, YES All inverters are inoperable.

Channel C, and Channel D The following are the RMA examples provided in Attachment 2 of the LAR supplement d~ted September 21, 2018, associated with TS 3.8.7 Condition B:

1.

Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and the startup transformers. The SBOGs will not be used for non-safety functions (i.e.,

power peaking to the grid).

2.

Suspend/minimize discretionary activities in the SRP switchyard and the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power availability to the unit.

3.

Maintain Availability of DC electrical systems within the same train and the redundant train, associated 480 V bus, and associated regulating transformer.

4.

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather per [the appropriate procedure].

5.

Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

The NRC staff notes that the actions specified above are consistent with the NRC-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that the examples of the RMAs associated with TS 3.8. 7 Condition B are reasonable.

As described in the Palo Verde UFSAR, four inverters, each supplied by a separate Class 1 E 125-VDC channel, provide four independent 120-VAC vital l&C power for the four channels of the reactor protection and ESF systems. The NRC staff notes that during the entry of the RICT Program for TS 3.8. 7 Condition B, when two inverters on the opposite train remain operable, the remaining inverters will be capable of providing power to the AC vital buses. For the other cases that represent LOF, as shown in the table above, the restrictions on the use of the RICT Program will be applied.

The NRC staff reviewed the licensee's proposed CT for TS 3.8. 7 Condition B and supporting documentation. The licensee has identified scenarios that result in a LOF and provided 24-hour backstops as well as adequate restrictions on the use of the RICT Program. The staff also finds that the demonstration of identifying and implementing compensatory measures or RMAs, in accordance with the RICT Program, provides reasonable assurance that these RMA examples are appropriate to monitor and control risk. Therefore, the staff finds that the proposed change to TS 3.8. 7 Condition B is acceptable.

3.1.2.2.2.4 TS 3. 8. 9, "Distribution Systems - Operating" The Palo Verde TS LCO 3.8.9, states that, "Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE."

3.1.2.2.2.4.1 TS 3.8.9 Condition A - One AC Electrical Power Distribution Subsystem Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017 (Reference 3), the licensee requested to use the RICT Program to extend the existing CT of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months in TS 3.8.9 Condition A. The proposed CT, to restore the AC electrical power distribution subsystem to operable status, is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 6 days as the RICT calculated low estimate and 22 days as the RICT calculated high estimates for TS 3.8.9 Condition A. The backstop for this condition is 30 days. According to Table A5-1 in of the LAR supplement dated September 21, 2018 (Reference 6), the DSC for TS 3.8.9 Condition A is "1 of 2 AC distribution subsystems."

The function of the AC electrical power distribution system is to provide power to the ESF system. As described in the Palo Verde UFSAR, each unit consists of two independent AC electrical power distribution subsystems (train). Each train is capable of providing power to the ESF systems. The NRC staff notes that during the entry of the RICT Program for TS 3.8.9 Condition A, when one AC electrical power distribution subsystem inoperable, the remaining AC electrical power distribution subsystem will be capable of providing power to the ESF systems.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.9 Condition A and supporting documentation. The staff finds that (a) the DSC reflect the LCO 3.8.9 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.9 Condition A, the remaining AC electrical power distribution subsystem will be capable of providing power to the ESF systems, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.9 Condition A is acceptable because during the entry of TS 3.8.9 Condition A, the capability of the AC electrical distribution subsystems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.4.2 TS 3.8.9 Condition B-One AC Vital Instrument Bus Electrical Power Distribution Subsystem Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee has requested to use the RICT Program to extend the existing CT of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for TS 3.8.9 Condition B. The proposed CT to restore the AC vital instrument bus electrical power distribution subsystem to operable status is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 30 days as both RICT calculated low and high estimates for TS 3.8.9 Condition B. The backstop for this condition is 30 days. According to Table A5-1 in Attachment 1 of the LAR supplement dated September 21, 2018, the DSC for TS 3.8. 7 Condition B is "1 of 2 vital AC distribution subsystems."

As stated in the Palo Verde U FSAR, for each unit, four independent Class 1 E, 120-V vital l&C AC power supplies are provided to supply the four channels of the reactor protection and ESF actuation systems. The four-bus arrangement provides single-phase, ungrounded, electric power to each of the four protection channels of the reactor protection system that is electrically and physically isolated from the other protection channels. The NRC staff notes that during the entry of the RICT Program for TS 3.8.9 Condition B, when one AC vital instrument bus electrical power distribution subsystem inoperable, the remaining subsystems will be capable of providing power to the ESF systems.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.9 Condition B and supporting documentation. The staff finds that (a) the DSC reflect the LCO 3.8.9 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.9 Condition B, the remaining AC vital instrument bus electrical power distribution subsystems will be capable of providing power to the ESF systems, thus, the DSC are met. The staff concludes that the proposed change to TS 3.8.9 Condition B is acceptable because during the entry of TS 3.8.9 Condition B, the capability of the AC vital instrument bus electrical power distribution subsystems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.4.3 TS 3.8.9 Condition C-One DC Electrical Power Distribution Subsystem Inoperable As described in Attachments 1 and 2 of the LAR supplement dated November 3, 2017, the licensee requested to use the RICT Program to extend the existing CT of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for TS 3.8.9 Condition C. The proposed CT to restore the DC electrical power distribution subsystem to operable status is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or in accordance with the RICT Program.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies 3 days as the RICT calculated low estimate and 6 days as the RICT calculated high estimates for TS 3.8.9 Condition C. The backstop for this condition is 30 days. According to Table A5-1 in of the LAR supplement dated September 21, 2018, the DSC for TS 3.8.9 Condition C is "1 of 2 DC distribution subsystems."

As stated in the Palo Verde UFSAR for each unit, the Class 1 E 125-VDC systems is made up of two trains (A and B) of four independent channels (A, B, C and D). Channels A and Care designated as Load Group 1 or Train A; Channels B and D are designated as Load Group 2 or Train B. Channels A and B provide control power to AC Load Groups 1 and 2, to vital l&C power for Channels A and B of the reactor protection and ESF systems, and DGs A and B.

Channels C and D also provide l&C power to the reactor protection and ESF system and other safety-related loads. Each channel contains a battery bank (hereby referred to as a battery), a battery charger, a control center, or a distribution panel. The NRC staff notes that during the entry of the RICT Program for TS 3.8.9 Condition B, when one DC electrical power distribution subsystem (train) inoperable, the remaining subsystem will be capable of providing power to the reactor protection and ESF systems.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.9 Condition C and supporting documentation. The staff finds that (a) the DSC reflect the LCO 3.8.9 minimum requirement to support the TS safety functions; and (b) during the RICT Program entry for TS 3.8.9 Condition C, the remaining DC electrical power distribution subsystem will be capable of providing power to the reactor protection and ESF systems, thus, the DSC are met. The staff concluded that the proposed change to TS 3.8.9 Condition C is acceptable because during the entry of TS 3.8.9 Condition C, the capability of the DC electrical power distribution subsystems to perform their safety functions (assuming no additional failures of electrical components) is maintained.

3.1.2.2.2.4.4 TS 3.8.9 Condition D-Two or More Electrical Power Distribution Subsystems Inoperable The licensee has requested a new TS 3.8.9 Condition D, as follows:

Condition Required Action Completion Time D. Two or more electrical D. 1 Restore electrical 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months power distribution power distribution OR subsystems inoperable.

subsystem(s) to OPERABLE status.

In accordance with the Risk Informed Completion Time Program The licensee has identified this TS condition as LOF and the following notes are proposed to be added for this condition to provide restrictions on the use of RICT Program.

NOTES------------------------------------------------

1. Not applicable when the second or a subsequent electrical power distribution subsystem intentionally made inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

The NRC staff notes that the above restrictions are consistent with the NRC approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff finds that these restrictions associated with TS 3.8.4 Condition C are reasonable.

Table A5-2 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months as the RICT calculated low estimate and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as the RICT calculated high estimates for TS 3.8.9 Condition D. This condition is identified as LOF and the backstop for this condition is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following are the RMA examples, provided in Attachment 2 of the LAR supplement dated September 21, 2018, associated with TS 3.8.9 Condition D:

1.

Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of a Class 1 E 4160 VAC bus, AC vital instrument bus, or DC electrical power distribution subsystem.

2.

Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or LOOP.

3.

Maintain Availability of redundant and diverse electrical systems.

4.

Evaluate weather predictions and take appropriate actions to mitigate potential impacts of severe weather per [appropriate] procedure....

5.

Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

The NRC staff notes that the actions specified above are consistent with the NRG-approved guidance in NEI 06-09 Revision 0-A. Therefore, the staff finds that the examples of the RMAs associated with TS 3.8.9 Condition Dare reasonable.

The NRC staff reviewed the licensee's proposed CT for TS 3.8.9 Condition D and supporting documentation. The staff finds that the licensee has appropriately identified TS 3.8.9 Condition D as LOF and provided 24-hour backstop as well as adequate restrictions on the use of the RICT Program. The staff also finds that the demonstration of identifying and implementing compensatory measures or RMAs, in accordance with the RICT Program, provides reasonable assurance that these RMA examples are appropriate to monitor and control risk. Therefore, the staff finds that the proposed change to TS 3.8.9 Condition Dis acceptable.

Technical Conclusion of Electrical Power Systems The NRC staff reviewed the proposed changes to Palo Verde electrical power systems TSs 3.8.1, 3.8.4, 3.8. 7, and 3.8.9 and supporting documentation. The changes would add alternate CTs in accordance with the RICT Program for certain required actions of the proposed TS. Based on the above technical evaluation, the staff determined that the proposed changes do not make any design bases changes and continue to meet the intent of the design criteria described in GDC 17 concerning availability, capacity, and capability of the electrical power systems. The proposed changes are consistent with 10 CFR 50.36(c)(2) because the lowest functional capability or performance levels of equipment required for safety is maintained. The proposed changes are also consistent with the NRG-approved guidance in NEI 06-09, Revision 0-A. Therefore, the staff concludes that the proposed changes are acceptable.

3.1.2.3 Evaluation of Instrumentation and Control Systems This evaluation of the Palo Verde adoption of the RICT Program for TS 3.3.6 does not include consideration of any TS LOF conditions (entire system inoperable) for instrumentation systems.

The NRC staff evaluated the proposed changes to the instrumentation functions against the following relevant principles defined in RG 1.177, Revision 1 (Reference 20), which "are written in terms typically used in traditional engineering decisions.... "

1.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption. Applicable rules and regulations that form the regulatory basis for TS are discussed in Regulatory Position 2.1 of RG 1.177.

2.

The proposed change is consistent with the defense-in-depth philosophy. The guidance contained in Regulatory Position 2.2.1 of RG 1.177 applies the various aspects of maintaining defense-in-depth to the subject of changes in TS.

3.

The proposed change maintains sufficient safety margins. The guidance contained in Regulatory Position 2.2.2 of RG 1.177 applies various aspects of maintaining sufficient safety margin to the subject of changes to TS.

4.

The proposed change satisfies the Maintenance Rule, which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, subject to the guidance provided in RG 1.177, Section 2.3.7.1 and the adequacy of the licensee's program and PRA model for this application. The configuration risk management program ensures that equipment removed from service prior to or during the proposed extended completion time will be appropriately assessed from a risk perspective.

3. 1. 2. 3. 1 Compliance with Current Regulations The Palo Verde TS 3.3, "Instrumentation" LCOs were developed to assure that the Palo Verde operation maintains the necessary redundancy, and/or diversity, which comply with: (1) the "Single Failure Criterion," as defined in Clause 4.2 of IEEE Std 279-1971 ; (2) "Channel Bypass or Removal from Operation," as defined in Clause 4.11 of IEEE Std 279-1971; and (3) adequate diversity as defined in GDC 22.

The equipment that will have an RICT, consists of: (1) four channels of Manual Trip or Initiation Logic, only a selective two of which are required to initiate the protective action, and (2) two trains of Actuation Logic, only one of which is required to initiate the credited protective action.

For Palo Verde, the "Single Failure Criterion" and "Channel Bypass or Removal from Operation" requirements for the ESFAS functions are met using additional redundancy (four channels) or an adequate reliability demonstration (two channels), as described below.

For this design of four channels of initiation logic, only a select two of which are necessary to meet coincidence criteria, one channel may be removed from operation, and the remaining three can still initiate the required protective actions, in the presence of a single failure.

For a two train system (e.g., ESF actuation logic and equipment), one of which is sufficient to meet OBA analysis criteria, the "Channel Bypass or Removal from Operation" criterion cannot be met without invoking the exception. That is, the inoperable channels are effectively removed from operation and based on the IEEE Std 279-1971, Clause 4.11, "Exception" provision, the "Channel Bypass or Removal from Operation" requirement can be relaxed based on a reliability justification. In accordance with the RICT Program defined in TS 5.5.20, the RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delays reactor shutdown or required actions. Because the risk is assessed and managed appropriately within specified limits and programmatic requirements, the NRC staff considers that the affected system operation reliability remains acceptable and is consistent with overall system reliability and risk considerations. Therefore, the staff concludes that the proposed changes to TS 3.3 meet requirements defined in Clause 4.2 and Clause 4.11 of IEEE Std 279-1971.

In accordance with the detailed technical evaluation presented in Section 3.1.2.3.2 of this SE, all of the instrumentation safety functions identified in the LAR supplement dated November 3, 2017 (Reference 3), maintain the capability to perform their safety functions when in a condition with a completion time that can be risk informed. Therefore, the instrumentation system diversity configuration remains unchanged. Based on the evaluation presented in Section 3.1.2.3.2, the NRC staff concludes that the proposed changes to TS 3.3 meet current diversity requirements as defined in GDC 22.

In summary, the NRC staff concludes that the proposed changes do not impede the affected instrumentation systems accomplishing their safety functions and comply with the instrumentation single failure criterion, channel bypass or removal from operation, and diversity requirements identified in Section 2.3.1 of this SE.

3. 1. 2. 3. 2 Evaluation of Defense-in-Depth The NRC staff followed the guidance in the RG 1.174, Revision 3 (Reference 19), as further elaborated in RG 1.177, Revision 1 (Reference 20), to assess the proposed changes' consistency with the defense-in-depth criteria. The applicable criteria to the affected Palo Verde instrumentation systems are:

System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system.

Defenses against potential CCFs are maintained and the potential for the introduction of new CCF mechanisms is assessed.

The intent of the plant's design criteria is maintained.

The NRC staff verified that in accordance with the Palo Verde UFSAR, in all applicable operating modes, the affected protective feature would perform its intended function by ensuring the ability to detect and mitigate the associate event when the CT of a channel is extended.

Therefore, the staff concludes that the intent of the plant's design criteria for the instrumentation functions identified in the amendment is maintained.

The NRC staff finds that while in a TS Action statement, each affected function will have its redundancy temporarily reduced, and consequently the system reliability will be reduced accordingly. The staff reviewed the design information in the Palo Verde UFSAR and the proposed risk-informed LCO Conditions for the affected instrumentation functions. Based on this information, the affected instrumentation protective features would maintain adequate defense-in-depth by either necessary redundancy (e.g., at least one redundant channel) and/or necessary diversity (e.g., at least one alternative safety features).

The licensee confirmed in the LAR that the proposed changes do not alter Palo Verde instrumentation system designs. Consequently, the NRC staff concludes that the proposed changes do not alter the ways in which Palo Verde instrumentation systems fail, do not introduce new CCF modes, and the system independence is maintained. The staff finds that some proposed changes reduce the level of redundancy of the affected instrumentation systems, and this reduction may reduce the level of defense against some CCFs; however, the staff finds, as described below, such reduction in redundancy and defense against CCFs is acceptable because diversity is part of the design for the functions identified in the LAR.

The following sections summarize the NRC staff's evaluation with respect to the defense-in-depth principle for the functions identified in the LAR.

3.1.2.3.2.1 Palo Verde Engineered Safety Features Actuation System Instrumentation

3. 1. 2. 3. 2. 1. 1

System Description

Palo Verde UFSAR Section 7.3, "Engineered Safety Feature Systems," describes the Nuclear Steam Supplier System (NSSS) ESFAS logic. The NSSS ESFAS logic (consisting of matrix, initiation, and actuation logic) is structured to provide an ESF actuation of both trains of equipment when any two of the four sensor channels indicate a trip is needed. This is a two-out-of-four trip logic scheme. Once a coincident trip in the same parameter is sensed, the matrix logic activates the four channels of initiation logic, each with two initiation relays (one for each actuation train). Contacts from these actuation relays, when de-energized, actuate specific ESF equipment.

Similar to the automatic functions, the manual ESFAS initiation allows the operator to manually actuate an ESF system when necessary. In the Palo Verde control room, each ESF function has four hand switches. Operating at least one hand switch in both trip legs will result in a full actuation of ESF.

3.1.2.3.2.1.2 Evaluation of Changes to TS 3.3.6, "Engineered Safety Features Actuation System (ESFAS) Logic and Manual Trip" LCO 3.3.6 requires that, "Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1." The NRC staff's evaluation does not include the acceptability of the RICT Program for matrix logic channels as the licensee did not propose its inclusion. Palo Verde action statements for Conditions B and D are applicable to all three Units and would state (emphasis added to changes):

CONDITION REQUIRED ACTION COMPLETION TIME B. One or more Functions B 1. Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Manual Trip or OPERABLE status.

Initiation Logic channel OR inoperable.

In accordance with the Risk Informed Completion Time Proqram CONDITION REQUIRED ACTION COMPLETION TIME D. One or more Functions D. 1 ----------NOTE----------

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Actuation Logic One channel of Actuation channel inoperable.

Logic may be bypassed OR for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillances, provided In accordance with the Risk the other channel is Informed Completion Time OPERABLE.

Program Restore fnoporab.le channel to OPERABLE status.

LCO 3.3.6 Condition B applies when one manual trip or initiation logic channel is inoperable, for one or more functions. With the proposed changes, the licensee would have the option to restore the channel to OPERABLE status either within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or in accordance with the RICT Program. The Palo Verde manual trip and initiation logic channels, consist of four channels with a two-out-of-four coincidence logic. With one channel inoperable, three channels remain. The NRC staff finds that three operable channels of manual trip or initiation logic would be capable of supporting ESFAS actuation. However, the function's redundancy is degraded from two-out-of-four to two-out-of-three.

The NRC staff concludes that the proposed RICT for LCO 3.3.6 Condition B does not impede accomplishing safety functions, as three channels of manual trip or initiation logic satisfy the minimum requirements during the RICT window that is supported by the risk evaluation.

Additionally, the proposed changes do not alter the existing diversity to the affected functions.

The staff finds these changes are consistent with the defense-in-depth philosophy, and are therefore, acceptable.

For LCO 3.3.6 Condition D, it applies when one actuation logic channel is inoperable, which may inhibit automatic actuation of one train of ESF. The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or in accordance with the RICT Program.

The Palo Verde actuation logic channels consist of two redundant channels. A minimum of one channel is required to satisfy the design-basis analysis. With one channel inoperable, one channel remains operable. The NRC staff finds that one operable channel of actuation logic would be capable of supporting ESFAS actuation. However, the function's redundancy is degraded from two channels to one channel.

The NRG staff concludes that the proposed RICT for LCO 3.3.6 Condition D does not impede accomplishing safety functions, as one channel actuation logic satisfies the minimum requirement during the RICT window that is supported by the risk evaluation. Additionally, the proposed changes do not alter the existing diversity to the affected functions. The staff finds these changes are consistent with the defense-in-depth philosophy, and are therefore, acceptable.

The licensee also proposed an editorial change to Condition D. TS 3.3.6 Required Action D.1 would state, "Restore channel to OPERABLE status," deleting the term "inoperable" that currently comes before "channel." The NRC staff finds that this change simplifies the requirements, but does not change the intent, and therefore, it is acceptable.

3.1.2.3.3 Evaluation of Safety Margin In accordance with the discussion presented in Section 3.1.2.3.1 above, the design, operation, testing methods, and acceptance criteria for Palo Verde instrumentation SSCs, specified in applicable codes and standards (or alternatives approved for use by the NRC), are not affected by the proposed risk-informed changes to the CTs, and continue to meet the plant licensing basis. The NRC staff finds the safety margin for the Palo Verde instrumentation systems remain unchanged.

3.1.2.3.4 Evaluation of Maintenance and Surveillance Rules In accordance with the discussion presented in Section 3.1.2.3.1 above, the licensee did not propose any changes to the existing maintenance rules and surveillance requirements for the Palo Verde instrumentation systems. The proposed changes to the instrumentation systems do not alter existing maintenance rules and surveillance requirements for the Palo Verde instrumentation systems.

3.1.2.3.5 Technical Conclusion The licensee did not propose any changes to quality standards, materials, operating specifications, acceptance criteria for equipment operability, or design-basis analyses. The use of the RICT Program will not affect the licensee's commitments to codes and standards used in the instrumentation design of the plants. Although the licensee will be allowed to have equipment out of service for a longer duration using RICTs, the expected increase in unavailability was evaluated by the NRC staff. The Palo Verde design entails at least one redundant channel or diverse means exist to provide defense-in-depth against a potential single failure during the RICT for the Palo Verde instrumentation systems. Therefore, the staff finds that the licensee-proposed RICT Program applied to TS 3.3.6 Conditions B and D maintains compliance with current regulations at 10 CFR 50.36(c)(2), 10 CFR 50.55a(h), and GDC 22; and consistency with the defense-in-depth philosophy and sufficient safety margins.

3.1.2.4 Key Principle 2 Conclusions The LAR, as supplemented, proposes to modify the TS requirements to permit extending selected CTs using the RICT Program in accordance with NEI 06 09, Revision 0-A (Reference 14). The NRC staff has reviewed the licensee's proposed TS changes and supporting documentation. The staff finds that extending the selected CTs in accordance with the RICT Program, following loss of redundancy but maintaining the capability of the system to perform its safety function, is an acceptable reduction in defense-in-depth provided that the licensee identifies and implements compensatory measures, as appropriate, during the extended CT.

As discussed above in this SE, the NRC staff has further evaluated key safety functions in the proposed CT extensions and concluded that (1) the changes maintain the intent of the design criteria; (2) the specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences preserving system redundancy, independence, and diversity commensurate with the expected frequency, consequences of challenges to the system, and uncertainties; and (3) sufficient capacity and capability is maintained to assure that containment integrity and other vital function's are maintained in the event of postulated accidents preserving the independence of barriers.

Quantitative risk analysis and qualitative considerations including compensatory measures assure a reasonable balance of defense-in-depth is maintained to ensure protection of public health and safety. The NRC staff concludes that the proposed changes are consistent with the defense-in-depth philosophy because the lowest functional capability or performance levels of equipment required for safety is maintained. Therefore, the staff concludes that the proposed changes are acceptable and consistent with the defense-in-depth philosophy as described in RG 1.174.

3.1.3 Key Principle 3: Evaluation of Safety Margins Section 2.2.2 of RG 1.177, Revision 1 states, in part, that sufficient safety margins are maintained when:

Codes and standards... or alternatives approved for use by the NRC are met...

Safety analysis acceptance criteria in the final safety analysis report (FSAR) are met or proposed revisions provide sufficient margin to

account for analysis and data uncertainties...

Part 3 of Section 3.2 of the NRC's SE approval of NEI 06-09, Revision 0-A, found that safety margins are maintained by the NEI 06-09, Revision 0-A, methodology, because risk-informed changes to CTs do not affect the applicable codes and standards used in the design of nuclear plants. Also, risk-informed changes to CTs do not impact the safety analysis acceptance described in the licensing basis for nuclear plants as amended for TSs (see Section 3.1.1 of this SE). The LAR provides additional assurance that safety margins for TSs are maintained because (1) the acceptance criteria for operability of equipment are not changed and use of the RICT is limited to only configurations in which the system(s) retain(s) the capability to perform the applicable safety function(s), and (2) operability of a train is directly formulated from the design basis requirements for that system, therefore the specified safety function still meets the design basis success criteria.

3.1.3.1 Key Principle 3 Conclusions As discussed above, the NRC staff finds that the design-basis analyses for Palo Verde remain applicable. Although the licensee will have design-basis equipment out of service longer than the current TS allows, and the likelihood of successful fulfillment of the function will be decreased when redundant train(s) are not available, the capability to fulfill the function will be retained when the available equipment functions, as designed. Any increase in unavailability because less equipment is available for a longer time, is included in the RICT evaluation.

Therefore, safety margins are not adversely affected by the implementation of the RICT Program. Based on the above, the NRC staff concludes that the proposed change meets the third key safety principle of RG 1.177 and is acceptable.

3. 1.4 Key Principle 4: Change in Risk Consistent with the Safety Goal Policy Statement In Attachment 9 of the LAR supplement dated November 3, 2017 (Reference 3), as revised by the supplement dated October 5, 2018 (Reference 7), the licensee described the guidelines that will be used to determine acceptable changes in risk. NEI 06-09, Revision 0-A, is a methodology for a licensee to evaluate and manage the risk impact of extensions to TS CTs.

Permanent changes to the fixed TS CTs are typically evaluated by using the three-tiered approach described in NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition,, S.ection 16.1, "Risk-informed Decision Making: Technical Specifications," Revision 1, dated March 2007 (Reference 25); RG 1.177, Revision 1; and RG 1.17 4, Revision 3. This approach addresses the calculated change in risk as measured by the change in L1CDF and L'.1LERF, as well as the ICCDP and ICLERP; the use of compensatory measures to reduce risk; and, the implementation of a configuration risk management program (CRMP) to identify risk-significant plant configurations.

The NRC staff evaluated the licensee's proposed changes against the three-tiered approach in RG 1.177, Revision 1, for a licensee's evaluation of the risk associated with a proposed TS CT change.

3.1.4.1 Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed changes on plant operational risk. The Tier 1 review involves two aspects: (1) the technical acceptability of the PRA models and their application to the proposed changes, and (2) review of the PRA results and insights described in the licensee's application.

3. 1.4. 1. 1 PRA Quality RG 1.17 4, Revision 2, states, in part, that "[t]he scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process." The NRC's SE, as described in NEI 06-09, Revision 0-A, states that the PRA models should conform to the guidance in RG 1.200, Revision 1. The current version is RG 1.200, Revision 2, which clarifies the current applicable ASME/ANS PRA standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 (i.e., the ASME PRA standard) (Reference 23).

The NRC staff evaluated the PRA quality information provided by the licensee in Attachment 6 of the LAR supplement dated November 3, 2017 (Reference 3), including industry peer review results and the licensee's self-assessment of the plant PRA models for internal and external events, including fires and seismic against the applicable requirements of RG 1.200, Revision 2.

This evaluation included information supplemented by responses to RAls in letters dated May 18, September 21, and October 5, 2018 (References 4, 6, and 7, respectively). The staff reviewed the licensee's resolutions/dispositions to peer review facts and observations (F&Os) for the internal events PRA (IEPRA), including internal flooding PRA (IFPRA), fire PRA (FPRA),

and seismic PRA (SPRA), as described in Attachment 6. The staff also reviewed other qualitative external hazards information in Attachment 8 of the LAR supplement dated November 3, 2017.

The licensee's evaluation of the technical adequacy of its IEPRA, IFPRA, FPRA, and SPRA models included peer reviews and self-assessments. In PRA RAI 13, in an e-mail dated April 4, 2018 (Reference 12), the NRC staff requested further details regarding the scope of the peer reviews meeting industry guidance, using the ASME PRA standard, as clarified by.

RG 1.200, Revision 2, and meeting the Capability Category II (CC-II} specifications. In response to PRA RAI 13, by letter dated May 18, 2018 (Reference 4), the licensee explained that the IEPRA, IFPRA, FPRA, and SPRA models were peer reviewed or received a self-assessment in accordance with NRG-endorsed guidance.

The licensee performed an independent F&O closure review in June 2017 in accordance with the NRC letter dated May 3, 2017 (Reference 26). The NRC staff requested in PRA RAI 11 (Reference 12), clarification of the closure process with regards to ( 1) meeting CC-II standards, (2) documented justification for closure, and (3) independence of reviewers. In response to PRA RAI 11, by letter dated September 21, 2018 (Reference 6), the licensee performed an augmented F&O closure review in June 2018 in accordance with Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13 (Reference 26) and incorporated the entire scope of the June 2017 F&O closure review findings. The staff finds this response acceptable because the information provided in the licensee's June 2018 augmented F&O closure review meets CC-II standards and demonstrates independence of the reviewers on the F&O closure team. For all F&Os that were not closed by the June 2018 augmented F&O closure review, the licensee has an implementation item to close the open F&Os in a subsequent F&O closure independent assessment prior to implementing the RICT Program.

Internal Events PRA The licensee's evaluation of the technical adequacy of its IEPRA included a combination of peer reviews and self-assessments. The Palo Verde IEPRA full scope peer review was performed in 1999 by the Combusting Engineering Owners Group (CEOG) using guidance that pre-dated the ASME PRA standard (Reference 23) and RG 1.200, Revision 2 (Reference 15). A self-assessment was performed in 2011 on the IEPRA using the ASME PRA standard as clarified as by RG 1.200, Revision 2. The self-assessment identified two findings against the requirements in the ASME PRA standard and RG 1.200, Revision 2 as not fully met at CC-II. The licensee provided the findings from these reviews along with the associated resolutions in Attachment 6 of the LAR supplement dated November 3, 2017. The licensee proposed an implementation item in Attachment 4 of the LAR supplement dated November 3, 2017, to fully meet supporting requirements CC-II by closing out the remaining F&Os by using the NRG-approved Appendix X closure process prior to use of the RICT Program.

In PRA RAI 10 (Reference 12), the NRC staff requested information on significant changes made to the IEPRA since its only peer review in 1999 and to identify which of those changes, if any, are considered PRA upgrades as described in RG 1.200, Revision 2. With regards to any PRA upgrades, the staff requested the licensee to provide the details and results of the required peer review or conduct a peer review if one has not been performed. This request also applied to the IFPRA, FPRA, and SPRA since their last respective peer review. In response to PRA RAI 10, in Attachment 2 of the LAR supplement dated May 18, 2018 (Reference 4 ), the licensee provided an evaluation on the significant changes that were made to the IEPRA, IFPRA, FPRA, and SPRA since their last respective peer review. Attachment 2 to the RAI response identifies the upgrades to the licensee's PRA models, and identifies open F&O findings and any new F&O findings as a result of the evaluation of the changes to the PRA models since the last peer review. As described above, the licensee performed an augmented F&O closure in June 2018 that identified the upgrades to the PRA models that impact implementing the RICT Program.

The staff finds this RAI response acceptable, as new open F&O findings and upgrades that impact implementation of the RICT Program were addressed in the augmented F&O closure of June 2018. The staff agrees that the identified upgrades in Attachment 2 that were not addressed in the augmented F&O closure in June 2018, do not have an impact on implementing the RICT Program. In addition, the licensee proposed an implementation item, in its LAR supplement dated October 5, 2018 (Reference 7), to perform a focused-scope peer review for the open F&Os that were identified as PRA model upgrades from the June 2018 F&O closure prior to implementing the RICT Program.

The NRC staff reviewed the licensee's resolution of the peer review findings for the IEPRA and the licensee's assessed impact of the findings on the RICT Program. The staff requested supplemental information regarding the resolution to the open F&Os, which are discussed below.

IEPRA F&O AS-03, described in Table A6-1, "Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process," in Attachment 6 of the LAR supplement dated November 3, 2017, identified missing rationale for why the plant response to small LOCAs, associated with pipe break and induced small LOCAs, were modeled differently in the transient event trees. The disposition to the F&O stated that the finding has been resolved and closed by an update of the PRA model and documentation. In PRA RAI 01.a regarding IEPRA F&O AS-03 (Reference 12), the NRC staff requested description and justification from the licensee about the differences in modeling plant response for small LOCAs versus induced small LOCAs. The staff also requested a description of the update to the PRA model to resolve the F&O, and confirmation that the success criteria received review and documentation. In response to PRA RAI 01.a (Reference 4), the licensee clarified that the concern in modeling is from the failure of a pressurizer safety valve to reseat, which is an induced small LOCA. The licensee performed an additional Modular Accident Analysis Program sensitivity analysis to demonstrate the plant response to a single pressurizer safety valve that fails to reseat is equivalent to a small-break LOCA. With successful steam generator heat removal, both the single pressurizer safety valve failure and small-break LOCA result in core damage prior to containment failure. The staff finds this response acceptable, as the Modular Accident Analysis Program sensitivity analysis demonstrates the licensee's current modeling of a small-break LOCA is consistent with an induced small LOCA (pressurizer safety valve fails to reseat) and no PRA model update is required. The licensee also provided an implementation item to update documentation to provide clarification of this modeling, as well as close the open F&O prior to implementing the RICT Program.

IEPRA F&O IE-07, described in Table A6-1 in Attachment 6 of the LAR supplement dated November 3, 2017, questioned some of the assumptions regarding Interfacing Systems' LOCAs in the treatment for the shutdown cooling suction line. The disposition to F&O IE-07 stated, in part, that "[l]eakage, spurious operation, and catastrophic failure modes of valves will be considered... " when addressing the recommended resolution path. Upon further review, the NRC staff found that CCF modes of valves were not identified. In PRA RAI 01.b regarding IEPRA F&O IE-07 (Reference 12), the NRC noted that the CCF mode for valves was excluded for the PRA model and requested clarification if the licensee intended to incorporate it or justify its exclusion. In response to PRA RAI 01.b (Reference 4), the licensee responded that the CCF mode for valves will be modeled using the Alpha Factor model as described in NUREG/CR-5485, "Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment" (Reference 27). Implementation Item 3 in Attachment 1, "Palo Verde RICT PRA Implementation Items," of the licensee's RAI response, states the licensee's PRA model will be updated to resolve this F&O, which is modeling the CCF mode of valves using the Alpha Factor Model. The staff finds this resolution acceptable because the licensee will update its PRA model in a manner consistent with NRG-approved guidance in NUREG/CR-5485, prior to implementation of the RICT Program.

Based on the analysis above, the NRC staff finds that the licensee's IEPRA*has been adequately peer reviewed against the current revision of the ASME PRA standard as clarified by RG 1.200, Revision 2. In addition, the staff finds that with the proposed license condition requiring the completion of implementation items described in Section 4.0 of this SE, the licensee will have adequately dispositioned the F&Os to support the technical adequacy of the IEPRA for the Palo Verde RICT Program.

Internal Flooding PRA The licensee evaluated the technical adequacy of the Palo Verde IFPRA by conducting a combination of peer reviews and self-assessments. The Palo Verde IFPRA full scope peer review was conducted in accordance with the ASME PRA standard as clarified by RG 1.200, Revision 2, in November 2010. The F&Os from these reviews are provided along with their resolutions in Attachment 6 of the LAR supplement dated November 3, 2017.

The NRC staff reviewed the licensee's resolution of the peer review findings for the IFPRA and the licensee's assessed impact of the findings on the RICT Program. In the updated response to PRA RAI 11 (Reference 6), the licensee described the use of the NEI 05-04, NEI 07-12, or NEI 12-13 (References 28, 29, and 30, respectively) Appendix X (Reference 26) closure process to close out the internal flooding F&Os. The licensee described, in detail, how it implemented the Appendix X process as accepted by the NRC, thereby obviating the need for an in-depth review of the F&O resolutions.

The licensee provided a list of assumptions and sources of uncertainty, which were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk. The NRC staff's evaluation is discussed below.

The Palo Verde procedures do not contain direction to operators on how to isolate an internal flooding event, therefore, the licensee assumed that the operators would isolate the break after the worst-case impact had already occurred (i.e., loss of one train). The licensee concluded that this assumption has minimal impact on any RICT calculation. The NRC staff was unclear whether the Palo Verde IFPRA adequately addresses this issue. Therefore, in PRA RAI 02.a, (Reference 12), the licensee was requested to provide additional justification for this conclusion or, if decided, details of a new operator action treatment. In response to PRA RAI 02.a (Reference 4), the licensee provided the results of a sensitivity study in which a human error probability value of 1.0 was assigned for operators isolating flooding events associated with safety injection or chemical and volume control system piping. The sensitivity analysis demonstrated that increasing a human error probability to 1.0, increases CDF by 3.0E-9/year and increases LERF to 9.0E-11/year. The staff finds the licensee's assumption to be acceptable because the staff concludes from the results of the sensitivity analysis that the worst-case impact of a flooding scenario has minimal impact on any RICT calculation.

In Attachment 13 of the LAR supplement dated November 3, 2017 (Reference 3), the licensee discussed isolation actions related to certain flooding scenarios but did not provide further details on how these actions are treated in the PRA model. In PRA RAI 02.b, the NRC staff requested further information on how the isolation actions were addressed, either included or excluded from the model, and to confirm that the related analysis was appropriately reviewed and documented. In response to PRA RAI 02.b (Reference 4), the licensee stated the flood isolation actions for dominant cutsets were developed and credited in the IFPRA model, supporting flood analyses have been performed and documented, and that these credited actions have been proceduralized. The staff finds the resolution of this issue is acceptable because the licensee has appropriately modeled and proceduralized isolation actions for the flooding scenarios as described in Attachment 13 of the LAR supplement.

In Attachment 13 of the LAR supplement, the licensee stated that the flood human factors engineering (HFEs) used in the LERF model were not included in the dependency analysis due to the time differential. It was unclear to the NRC staff that there is no dependency between actions solely based on a larger time differential (for example moderate or high stress would result in a dependency level). Therefore, in PRA RAI 02.c, the NRC staff requested further justification regarding this dependency analysis assumption. In response to PRA RAI 02.c (Reference 4), the licensee provided justification with a decision tree for an internal flood event and following the path of the decision tree results in zero dependence for internal flooding events. The licensee stated that the HFE dependency analysis was evaluated in accordance with NUREG/CR-1278, "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Applications" (Reference 31 ). The staff finds the licensee's dependency analysis is acceptable as it was performed against the NRC-endorsed guidance of NUREG/CR-1278.

Based on the analysis above, the NRC staff finds that the licensee's IFPRA was adequately peer reviewed against the current revision of the ASME PRA standard, as clarified by RG 1.200, Revision 2. The licensee has also adequately implemented the F&O closure process to support the technical adequacy of the IFPRA for the Palo Verde RICT Program. Finally, the licensee addressed the assumptions and sources of uncertainty that were significant for the evaluation of configuration-specific changes in risk.

Fire PRA The licensee evaluated the technical adequacy of the Palo Verde FPRA model by conducting a combination of peer reviews and focused-scope peer reviews. The initial peer review was performed in October 2012 in accordance with the ASME PRA standard (Reference 23), as clarified by RG 1.200, Revision 2 (Reference 15). Subsequently, a focused-scope review was conducted using the same guidance as the 2012 review for the supporting requirements that were not reviewed in the October 2012 review, and the supporting requirements that were assessed to be not-met to CC-II in the October 2012 review. The F&Os from these reviews are provided along with their resolutions in Attachment 6 of the LAR supplement dated November 3, 2017.

The NRC staff reviewed the licensee's resolution of the peer review F&Os for the FPRA and the licensee's assessed impact of the findings on the RICT Program. In the updated response to PRA RAI 11 (Reference 6), the licensee described the use of the NEI 05-04, NEI 07-12, and NEI 12-13, Appendix X closure process to close out the FPRA F&Os. The licensee described, in detail, how it implemented the Appendix X process as accepted by the NRC, thereby obviating the need for an in-depth review of the F&O resolutions.

The licensee provided a list of assumptions and sources of uncertainty that were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk. The NRC staff's evaluation is discussed below.

In Attachment 13, Table A13-1, of the LAR supplement dated November 3, 2017, the licensee stated that fire boundaries were adequate based on walkdowns and technical review. It is unclear to the NRC staff what criteria was used to make those assessments. Therefore, in PRA RAI 17.a, (Reference 12), the staff requested a description of the criteria and a justification that these criteria meet NRG-approved guidance. In response to PRA RAI 17.a (Reference 4), the licensee provided three criteria that describe the fire barrier criteria to partition Palo Verde into fire zones. The three criteria are:. (1) fire zone barriers meet the definition of a fire compartment, (2) plant features that cannot be credited for fire zone partitioning, and (3) barriers with penetrations that may meet the definition of a fire compartment after further consideration of potential fire ignition sources. The staff concludes that the three criteria in determining fire boundaries is acceptable because it is consistent with NRG-approved guidance in NUREG/CR-6850, "EPRI [Electric Power Research lnstitute]/NRC-RES [Office of Nuclear Regulatory Research] Fire PRA Methodology for Nuclear Power Facilities," Volume 2: Detailed Methodology (Reference 32).

Regarding breaker fuse coordination, the licensee indicated in Attachment 13, Table A13-1 of the LAR supplement dated November 3, 2017, that the FPRA model will credit recovery procedures to ensure proper coordination, and this assumption has limited impact on any RICT calculation. The statements implied that at least one circuit at the plant has been determined to have inadequate breaker fuse coordination. It was unclear to the NRC staff how this issue is addressed in the FPRA model. The NRC requested, in PRA RAI 17.b, justification for excluding the recovery actions from the model or update the FPRA model, or as another remedy, to correct the breaker coordination issue. In response to PRA RAI 17.b (Reference 4), the licensee stated that if breaker coordination did not exist, the use of cable length was utilized to show adequate coordination. The licensee further stated where sufficient cable length and therefore coordination is not adequate, upstream power supplies are assumed to be failed and secondary fires are not postulated. Secondary fires are not postulated based on plant modifications to incorporate fuses to isolate fire-induced cable faults. Additionally, the licensee stated that recovery of power supplies that are lost is not credited. The NRC staff finds the licensee's response acceptable because the licensee has addressed inadequate breaker fuse coordination consistent with the guidance in NUREG/CR-6850. The licensee's response is consistent with the guidance in NUREG/CR-6850 because cable length is only credited where the analysis shows sufficient cable length to achieve coordination, upstream power supplies are assumed to be lost where coordination cannot be achieved, and the recovery of these power supplies is not credited.

Since the development of FPRA models within the National Fire Protection Association (NFPA) 805 process, the NRC staff has formally accepted fire PRA method refinements during the resolution of complex plant reviews. The NRC also developed a process to communicate with the Industry any outstanding issues with any fire methods in Regulatory Issue Summary 2007-19, "Process for Communicating Clarifications of Staff Position Provided in Regulatory Guide 1.205 Concerning Issues Identified During the Pilot Application of National Fire Protection Association Standard (NFPA) 805," dated August 20, 2007 (Reference 33).

Therefore, the NRC staff requested in PRA RAI 17.c, to identify any unaccepted fire methods and justification for its use with an assessment of the significance of its usage, and to confirm that all methods used in the FPRA are NRC accepted, and if not, to incorporate accepted methods into the model. In response to PRA RAI 17.c (Reference 4 ), in Attachment 5, Table 5-1, "Internal Fire PRA Methods," the licensee provided a comprehensive list of methods that have been or will be incorporated into the Palo Verde FPRA. The licensee explained only the identified fire methods in Table 5-1 that have been accepted by the NRC and have been incorporated into the FPRA will be used in the RICT Program, and no methods will be used that have not been accepted by the NRC. The NRC staff finds this response acceptable as only NRG-approved methods have been or will be incorporated into the FPRA.

The NRC staff reviewed the licensee's incorporation FPRA methods, as well as key assumptions and sources of uncertainty, to determine the technical adequacy of the FPRA for the RITSTF 4b application. The NRC requested in PRA RAI 17.d, the licensee's plans to incorporate the acceptable methods into the FPRA (i.e., NUREG/CR-7150, "Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE FIRE)," Volume 2 (Reference 34) and NUREG-2169, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database: United States fire Event Experience Through 2009" (Reference 35)). In response to PRA RAI 17.d (Reference 4), the licensee provided a list of the NRG-approved fire methods listed in Table 5-1 that have not yet been incorporated into the FPRA. These NRG-accepted methods will be incorporated into the FPRA with Implementation Item 3 of Attachment 1 of the RAI response.

The staff requested further information on certain acceptable methods. A summary of the discussion regarding the use of FPRA methods is provided below.

The NRC staff requested in PRA RAI 17.e, the licensee's method for incorporating the possible increase in fire heat release rates and how suppression is included in the evaluation, and to provide details if its approach differs from the approach accepted by the NRC. In response to PRA RAI 17.e (Reference 4), the licensee explained that the contribution of secondary combustibles is included in the calculation of heat release rates and non-suppression probability. The licensee stated that the consideration of secondary combustibles follows the guidance in NUREG/CR-6850 and NUREG/CR-7010 (References 32 and 36, respectively).

The staff finds this response acceptable because the licensee accounted for the heat release rates contribution of secondary combustibles and non-suppression probability, and the approach is consistent with NRG-approved guidance. In PRA RAI 17.f, the staff requested confirmation that the manual suppression probabilities are consistent with NUREG/CR-6850. In response to PRA RAI 17.f (References 4 and 7), the licensee confirmed that the manual suppression probabilities have been updated with the mean values provided in NUREG-2169, The licensee stated that the CDF and LERF values have also been updated to reflect the updated mean values. The licensee also stated that a floor value of 1.0E-3 is used in the calculations of manual non-suppression probability. The staff finds the licensee's response is acceptable because manual suppression rates and floor values are consistent with the NRG-approved guidance in NUREG/CR-6850.

In Attachment 9, "Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)," of the LAR supplement dated November 3, 2017, the licensee states, in part, that

"[t]here are small differences between the units that have been evaluated and found to have minimal risk significance," with one of the examples being field routed cabling. During the February 2018 audit, there were discussions to ensure the FPRA model would be bounding for all units. Therefore, the NRC staff requested in PRA RAI 19.a (Reference 12), that if new FPRA models are created to detail the expected schedule to perform the required RG 1.200, Revision 2, peer reviews and F&O disposition submittal to the NRC. In response to PRA RAI 19.a (Reference 4 ), the licensee explained that they performed an assessment to identify the differences between the three units and to evaluate the significance of any differences to fire risk. The licensee stated that the FPRA was updated to incprporate the differences between the three units, and that this composite FPRA is representative of the as-built, as-operated condition of all three units. The licensee reported that the difference in fire CDF and LERF between the three units is less than 0.5 percent and less than 0.1 percent, respectively. The licensee also stated that the dominant fire scenarios, total fire compartment risk contributions, and ignition sources do not significantly change between the units. The staff finds this response acceptable because the composite FPRA model is representative of the as-built, as-operated condition of the three units. The difference in fire CDF and LERF between the three units is not significant, the dominant fire scenarios do not significantly change between the three units, and the ignition sources do not significantly change between the three units; therefore, the differences between the three units, regarding FPRA, are of low significance and acceptable for RICT calculations.

In PRA RAI 19.b and 19.c, the NRC staff requested information related to safe shutdown equipment and confirmation that no fire scenarios given the initiating fire occurs leads directly to core damage with no mitigation (e.g. CCDP = 1.0). Since these scenarios can mask the risk contribution of other equipment, the staff requested that the licensee explain how they plan to resolve this issue prior to implementation of the RICT Program. In response to PRA RAI 19.b (Reference 4), the licensee stated that the fire protection systems relied upon for safe shutdown are implicitly considered by the application of scenario specific non-suppression probabilities and barrier failure probabilities. The RICT Program uses adjusted non-suppression probability and barrier failure probability values that reflect the unavailability of these systems, and these adjusted values are applied in the licensee's CRMP tool. Therefore, the staff concludes this response is acceptable because the licensee's RICT Program has the capability to assess the risk contribution of out-of-service safe shutdown equipment. In response to PRA RAI 19.c (Reference 4), the licensee identified the main control room abandonment scenario as the only scenario that would lead to a CCDP of 1.0 with no mitigation. However, the licensee stated that contribution of the main control room abandonment scenario to the total fire CDF is less than 1 percent. Therefore, the NRC staff concludes that this response is acceptable as the contribution to fire CDF from the main control room abandonment scenario and is not significant to the RICT Program.

NUREG-1792, "Good Practices for Implementing Human Reliability Analysis (HRA)"

(Reference 37), provides guidance for assigned floor values to joint human error probabilities.

After review of the LAR, the NRC staff was unclear that the guidance of NUREG-1792 was used by the licensee with the regards of assigning floor values to joint human error probabilities.

Therefore, the staff requested in PRA RAI 28 (Reference 12), that the licensee confirm adhering to this guidance or to provide justification for joint human error probability values below the floor and sensitivity results that reflect the impact of this modeling choice. In response to PRA RAI 28 (Reference 4), the licensee confirmed that the IEPRA and FPRA models use a minimum joint human error probability floor value of 1 E-05 in the dependency analysis with no exceptions.

The staff finds that the licensee's use of floor values of joint human error probabilities in the Palo Verde IEPRA and FPRA models is acceptable because it is in accordance with the

!guidance in NUREG-1792.

As a result of the review of the LAR and its supplements, the NRC staff concludes that the licensee has either demonstrated that the PRA models adequately meet the supporting requirements in the ASME PRA standard as clarified by RG 1.200, Revision 2, or the licensee is planning to implement acceptable methods in accordance with the proposed license condition requiring completion of implementation items, as described in Section 4.0 of this SE, prior to implementation, and that there are no remaining identified issues that could significantly impact the Palo Verde RICT Program. Therefore, the staff finds that FPRA will be technically adequate to support the RICT Program, including RICT calculations.

Seismic PRA The licensee's evaluation of the technical adequacy of its SPRA model included a peer review.

In December 2013, the SPRA was peer reviewed in accordance with RG 1.200, Revision 2 (Reference 15) and exceptions/objections in Appendix A of RG 1.200. The findings from these reviews are provided along with their resolutions, in Attachment 6 of the LAR supplement dated November 3, 2017 (Reference 3). In Attachment 4 of the LAR supplement, the licensee has committed to fully meet supporting requirements at CC-II by closing out the F&Os using the NRG-approved Appendix X closure process (Reference 26) prior to use of the RICT Program.

Given that no details were provided in Attachment 6, the NRC staff could not determine which industry peer review guidance document was used to peer-review Palo Verde's SPRA.

Therefore, the staff requested in PRA RAI 6 (Reference 12), confirmation of which NEI guidance document was used. In response to RAI 6 (Reference 4), the licensee stated that NEI 12-13 (Reference 30) was relied upon to provide the following information. Furthermore, in PRA RAI 6, the staff requested that the licensee provide additional information to justify the use of NEI 12-13, which was not endorsed in RG 1.200, Revision 2, or accepted by the staff at that time, 1 by addressing the NRC's comments issued in 2012 (Reference 38). Specifically, the staff requested that the licensee: (a) describe the qualifications of the SPRA review team and how they complied with Sections 1-6.2 and 5-3.2 of the ASME PRA standard, (b) identify any unreviewed analysis methods (UAMs), and provide a detailed discussion why it is appropriate for this application, ( c) identify if expert judgement was used to meet any supporting requirements, and if so, to provide the related peer review information and disposition of its use as being appropriate to be in conformance with Section 1-4.3 of the ASME PRA standard, (d) provide a list of supporting requirements that only met CC-I requirements, and justify for each that meeting CC-II does not impact this application, and (e) if an "in-process" peer review was performed, confirm the review was independent as described by the ASME PRA standard and NRC letter dated November 16, 2012 (Reference 38).

In response to RAI 6.a (Reference 4 ), the licensee provided a description of the approach used to ensure that the qualifications of the SPRA peer-review team met the corresponding requirements in the ASME PRA standard, as endorsed in RG 1.200, Revision 2. The licensee stated that the peer review team met the experience expectations of the ASME PRA standard, Part 5, Section 5-3, "Peer Review for Seismic Events At-Power," and was fully compliant with the ASME PRA standard, Section 1-6.2, "Peer Review Team Composition and Personnel Qualifications." Because the licensee confirmed that the peer review team met the requirements in the ASME PRA standard, the NRC staff finds that the SPRA peer-review team had the appropriate qualifications to review the SPRA used to support this application.

UAMs are a specific type of F&Os assigned by peer reviewers and are defined in Section 3.2, "Peer Review Process Criteria," of NEI 12-13. One of the NRC staff's comments on NEI 12-13, provided in the letter dated November 16, 2012, stated that "licensees that use UAMs for external hazards, need to identify the UAMs in risk-informed applications to the NRC so that the NRC staff can evaluate the acceptability of these new methods in the context of their applications." In response to RAI 6.b (Reference 4), the licensee stated that the SPRA peer review team did not identify any UAMs in the licensee's SPRA. Therefore, further details regarding any UAM and a corresponding NRC staff review for this application are unnecessary.

The NRC staff finds that the licensee appropriately addresses the issue of UAMs in the SPRA for this application.

1 By letter dated March 7, 2018 (ADAMS Accession No. ML18025C022), the NRC staff accepted the use of NEI 12-13, Revision 0, as modified by the NRC staffs comments, while the review of this LAR was ongoing. The letter states that the NRC staffs comments in the letter supersede NRC staffs comments provided in a letter dated November 16, 2012 (Reference 29). The NRC staffs review of the licensee's responses to the requests for additional information, addresses the comments in the letter dated March 7, 2018. Therefore, the letter dated March 7, 2018, does not change the NRC staffs conclusions in this SE.

In response to RAI 6.c (Reference 4), the licensee stated, in part, that "[t]here was no need for the use of expert judgement outside of the PRA analysis team to meet any [supporting requirements]." Therefore, the NRC staff finds that the licensee addressed the use of expert judgement in its SPRA for this application.

In response to RAI 6.d (Reference 4), the licensee stated that a finding was written for any supporting requirement receiving a CC-I. The licensee further explained that finding-level F&Os SHA-E1-01 and SHA-E2-01 were written against supporting requirements SHA-E1 and SHA-E2 because the SPRA was determined to only meet these supporting requirements at CC-I.

Dispositions of F&Os SHA-E1-01 and SHA-E2-01 for this application are discussed in more detail below. Because the licensee had a peer review for all supporting requirements against CC-II of the ASME PRA standard, the NRC staff finds that the licensee's SPRA was reviewed to the appropriate Capability Category level (i.e., CC-II) for this application.

The NRC staff's comments on NEI 12-13, in the letter dated November 16, 2012, included specific expectations related to an in-process peer review. In response to RAI 6.e (Reference 4), the licensee stated that an "in process" peer review of the SPRA was not performed and a final full scope peer review was performed to judge the technical acceptability of the SPRA model. Because an "in process" review approach was not followed, the staff does not need to review the details and process followed for the "in process" reviews for the licensee's SPRA used to support this application.

The NRC staff reviewed each peer review F&O finding, along with the associated resolutions in the LAR for the Palo Verde RITSTF Initiative 4b application. The staff requested supplemental information regarding the resolution to some of the F&Os, which is discussed below.

Given that the SPRA model incorporates the IEPRA model, the NRC staff requested in PRA RAI 7 (Reference 12), that the licensee identify IEPRA F&Os that were not closed out using an NRG-approved method, identify any IEPRA upgrades that had not been peer reviewed prior to the SPRA development, and describe the resolution of these issues and its impact on the SPRA in relation to this application. In response to PRA RAI 7 (Reference 4), the licensee stated that the four findings identified in the March 2011 self-assessment of the IEPRA associated with supporting requirements not met at CC-II, were included in the June 2017 F&O closure review.

The licensee further explained that three internal events modeling changes that were identified as upgrades after the IEPRA was used as the basis to construct the internal flooding, fire, and SPRA models. The licensee proposed in Implementation Item 2 as part of its license condition, in Attachment 1 of the licensee's RAI response, to conduct a focused-scope peer review on the IEPRA model changes that were identified as PRA upgrades. Because the licensee demonstrated that the internal events findings and its resolutions will be dispositioned in the IEPRA, the staff finds that the licensee has established the technical acceptability of its IEPRA model for use as the foundation for its SPRA in the context of this application.

In relation to F&O SFR-F3-01, it included a recommendation to have the licensee to justify the use of the Best Estimate In-Structure Response Spectra as the median. It further states that the soil-structure-interaction analysis results in an 841h percentile response. To ensure the In-Structure Response Spectra input is appropriate, the NRC staff requested in PRA RAI 8 (Reference 12), for the licensee to discuss how it plans to address and close out this F&O prior to RICT implementation. In response to PRA RAI 8 (Reference 4), the licensee stated that F&O SFR-F3-01 has been addressed per the recommendation provided by the F&O closure panel.

The licensee further stated that the completed resolutions will be evaluated prior to RICT implementation in accordance with Implementation Item 3 in Attachment 1 of the licensee's RAI response, and the proposed license condition, discussed in Section 4.0 of this SE, using the F&O closure and PRA update processes. The licensee also described its technical rationale in response to the recommendations by the closure team. The licensee stated that Palo Verde is built on deep soil columns and the use of Best Estimate In-Structure Response Spectra is an appropriate median input to the fragility analysis because (a) the building response is dominated by low-frequency soil-structure modes for which seismic demand is not sensitive to structural damping; and (b) soil stiffness variability (which was accounted in the soil-structure-interaction analyses) dominates overall variability in response over variability in structure stiffness and structure damping, and the soil-structure-interaction analyses were determined to be stable.

The NRC staff finds the licensee's rationale for addressing aspects of the closure team's recommendations to be acceptable for this application because the seismic response is dominated by variability in soil properties over structure stiffness and damping at the Palo Verde site. Because the licensee will use the F&O closure process to close out F&O SFR-F3-01 prior to implementation of the program (consistent with Implementation Item No. 3 that is required by the proposed license condition), the NRC staff concludes that the implementation of the license condition will address F&O SHA F3-01 for this application.

F&O SHA-E2-01 included a recommendation to confirm that the updated soil peak ground acceleration hazard curves fragilities are bounded by the currently used soil peak ground acceleration hazard curves. The NRC staff requested in PRA RAI 9 (Reference 12), that the licensee discuss its plan to address the recommendation and close out the F&O prior to RICT implementation. In response to PRA RAI 9 (Reference 4), the licensee stated that the F&O would be addressed per the recommendation provided by the F&O closure review team. In addition, the licensee stated that the updated seismic hazard curves will be post-processed to extract the needed uncertainty information. Because the licensee will use the F&O closure process to close out the finding prior to implementation of the program ( consistent with Implementation Item 3 in Attachment 1 of the licensee's RAI response), the NRC staff concludes that the implementation of the license condition will address F&O SHA-E2-01 for this application.

As a result of the review of the LAR, including RAls responses, the NRC staff concludes that the licensee has either demonstrated that the SPRA meets the supporting requirements in the ASME PRA standard (Reference 23) as clarified by RG 1.200, Revision 2 (Reference 15), or stated that there are no significant issues identified for the RICT Program. Therefore, the NRC staff finds that SPRA is technically adequate to support the RICT Program, including RICT calculations.

PRA Acceptability Conclusions Based on the NRC staff's review of the licensee's submittal and assessments, the staff determined that the Palo Verde PRA models for internal and external events, fires, and seismic used to implement the RICT Program satisfy the guidance of RG 1.200, Revision 2, with the completion of the implementation items referenced in the proposed license condition described in Section 4.0 of this SE. The staff based this conclusion on the findings that the PRA models conform sufficiently to the applicable industry PRA standards for internal events, internal flooding, fires, and seismic at the appropriate capability category, considering the applicable disposition of the peer review and staff review findings.

The NRC staff finds the licensee's PRA acceptable to support the RICT Program because the licensee has (1) reviewed the PRA using endorsed guidance and with the completion of the implementation items this will have adequately resolved all identified issues and (2) established a periodic update and review process to update the PRA and associated CRMP tool to incorporate changes made to the plant, PRA methods, and data.

3.1.4.1.2 Scope of the PRA NEI 06-09, Revision 0-A, requires a quantitative assessment of the potential impact on risk due to impacts from internal and external events, including internal fires, floods, and other significant external events. As clarified in the NRC staff's SE on NEI 06-09, Revision 0-A, other sources of risk (i.e., seismic and other external events) must be quantitatively assessed if they contribute significantly to the incremental risk of any RMTS configuration. Sources of risk shown to be insignificant contributors to configuration risk may be excluded for the RICT calculations.

Other External Hazards PRA The licensee provided its assessment of external hazard risk for the RICT Program in of the LAR supplement dated November 3, 2017 (Reference 3). According to the Attachment, the licensee followed the NUREG-1855 (Reference 39), process for identifying and assessing the significance of external hazards that are not evaluated in the PRA model. This assessment evaluated the following external hazards identified in NUREG-1855, Revision 1, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking," Volume 1, dated March 2009, as follows:

Aircraft impacts External flooding Extreme winds and tornadoes (including generated missiles)

External fires Accidents from nearby facilities Pipeline accidents (e.g., natural gas)

Release of chemicals stored at the site Transportation accidents Turbine-generated missiles This evaluation was performed by screening out 34 different kinds of hazards that include or are forms of the hazards cited above (e.g., river diversion or toxic gas) or are beyond the hazards cited above (e.g., lighting or volcanic activity).

The 'licensee's approach for evaluating these hazards was to screen them from further consideration in the RICT Program using the criteria from the ASME PRA standard, (Reference 23) for screening external hazards. The licensee's evaluation concluded that all of these external hazards could be screened and do not need to be further considered in the RICT Program.

In Attachment 6 of the LAR supplement dated November 3, 2017, the licensee states that the other external hazard screening was peer reviewed in accordance with RG 1.200, Revision 2, in December 2011. The supplement did not provide the results for this peer review. Therefore, the NRC staff requested in PRA RAI 14 (Reference 12), the F&Os of the peer review and their dispositions for this application. In response to PRA RAI 14 (Reference 4), the licensee stated that three F&Os were inadvertently excluded from the June 2017 F&O closure review and that findings will be included and verified closed in an augmented F&O closure review. Because the licensee will use the F&O closure process to close out the finding prior to implementation of the program consistent with Implementation Item 1 in Attachment 1 of the licensee's RAI response, the NRC staff concludes that the implementation of the license condition, discussed in Section 4.0 of this. SE, will address the finding related to external hazards screening for this application.

In Attachment 8 of the LAR supplement dated November 3, 2017, it appears the licensee intends to exclude external hazards for every configuration risk evaluation. Because there may be situations where the hazard may be important in a configuration risk calculation even though the baseline risk can be screened out (e.g., SSCs that minimize risk from these hazards (such as flood barriers or SSCs being impacted by the hazard)), the NRC staff requested in PRA RAI 15.a (Reference 12), clarification if external hazards are excluded from the RICT estimates and the basis for the exclusion. Furthermore, the staff requested in PRA RAI 15.b, how the licensee addresses SSCs that are relevant to design basis assumptions for external events in the RICT calculations, and their impact on CDF or LERF values. In response to PRA RAI 15 (Reference 4), the licensee stated that RICT implementing procedures will include steps to determine if any plant barriers or plant features credited in mitigating other external events screening are impaired and will either fail those SSCs protected by the impaired barriers in the RICT calculation or provide a documented engineering evaluation for how to more realistically account for the barrier or plant feature impairment in the CRMP tool. The licensee further stated that it may identify RMAs to mitigate those conditions and those RMAs, which directly impact the CRMP, will be credited in the RICT calculation. Because the licensee will consider the impact of plant features credited in mitigating external events screening by failing SSCs protected by the affected plant features in the RICT calculation performing engineering evaluations or identifying RMAs, the NRC staff finds that the licensee's approach assures that the assumptions supporting the screening of the hazards remain applicable given the plant configuration during the RICT.

The licensee has not proposed to use any conservative or bounding analyses in lieu of quantitative PRA models for external hazards. NEI 06-09, Revision 0-A, Section 3.3.5, "External Events Consideration" (Reference 14) states that a reasonable technical argument that indicates that the external event contribution is not significant or bounded is sufficient to support an RICT Program. The NRC staff finds that the evaluation provided in the LAR, including RAI responses, is reasonable because it summarizes each external hazard and the disposition of the hazard. The staff finds that the approach for excluding external events risk in the RICT calculations to be acceptable because the licensee utilized guidance from NUREG-1855 and the ASME PRA standard.

As discussed in Section 3.1.4.1.1 of this SE, the Palo Verde PRA used for the RICT Program includes PRA models for internal events (including internal flooding), fire events, and seismic events. Since the RICT Program is not applicable in Modes 3, 4, 5, and 6, risk evaluations for these modes are not relevant to the proposed change. The licensee has limited the mode applicability of the RICT Program to Modes 1 and 2 for which its existing PRA models are considered applicable. The RICT Program cannot therefore be applied in Modes 3 and 4.

3. 1.4. 1. 3 PRA Modeling To evaluate an RICT for a given required action, the specific systems or components involved should be modeled in the PRA. For each TS LCO for which the RICT Program is proposed to apply, for any of its required actions, the licensee identified that: (1) the system is included in the PRA models, or is addressed systems not in the PRA either in the LAR or in response to an RAI; (2) the success criteria used in the PRA models are consistent with the Palo Verde licensing basis, or acceptable plant-specific analyses that were used to support the PRA are justified, consistent with the RG 1.200 PRA review process; (3) CCFs and surrogate identification are appropriately addressed; (4) the CRMP provides the capability to select the system and system trains as out of service in order to calculate an RICT; and (5) the CRMP is maintained consistent with the baseline PRA model with modifications to the CRMP model to reflect the current plant versus the average plant.

System Scope and Success Criteria Table AS-1 in Attachment 5 of the LAR supplement dated November 3, 2017, identifies each TS within the RICT Program, and as applicable, identifies how the systems and components are implicitly or explicitly modeled in the PRA. The table further clarifies how a surrogate can be used to bound the impacts of failed systems and components not explicitly modeled in the PRA.

The NRC staff requested additional information about some of the modeling surrogates and assumptions as summarized below.

The NRC staff noted in the LAR supplement dated November 3, 2017, that instrumentation LCOs are included in the RICT Program. In PRA RAI 4 (Reference 12), the staff requested details on how these systems are modeled in the PRA, including components and the treatment of digital equipment. In response to PRA RAI 4 (Reference 4), the licensee stated it will only include LCO Conditions B and D for TS 3.3.6 in the RICT Program. The specific ES FAS signals and l&C components have individual failure rates and have basic events with failure probabilities modeled in the PRA. Similar to other types of components modeled in the Palo Verde PRA, the basic events for these l&C components will be failed when making an RICT calculation. The licensee also confirmed that digital systems are not utilized in any l&C components associated with LCO Conditions Band D for TS 3.3.6. The NRC staff finds that including LCO Conditions B and D for TS 3.3.6 is acceptable because the individual l&C components are modeled in the PRA consistent with NRC-endorsed guidance.

The licensee states in Table A 13-1 in Attachment 13 of the LAR supplement dated November 3, 2017, that reactor coolant pump (RCP) loss-of-coolant is not modeled since the leak is considered to be within the capacity of the charging pumps, and is in accordance with the guidance of WCAP-157 49, Revision 0, "Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling" (Reference 40). The NRC staff noted that the screening criteria in the ASME PRA standard was not stated, and for combustion engineering plants, the current endorsed method for addressing RCP seal leakage is WCAP-16175-NP-A, Revision 0, "Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants" (Reference 41 ). Therefore, the staff requested in PRA RAI 16 (Reference 12), clarification for the screening basis of this accident sequence, and how the licensee meets the limitations and conditions of the NRC-endorsed guidance in WCAP-16175-NP-A. In response to PRA RAI 16 (References 4, 6 and 7), the licensee stated that the RCP loss-of-coolant due to seal leakage model.from the FPRA model has been incorporated into the IEPRA model, and the resulting baseline CDF and LERF values have been updated accordingly. The staff finds this is acceptable since RCP seal leakage is no longer screened from the IEPRA model. The licensee also stated that the Palo Verde RCP seal modeling meets limitations and conditions of the NRC-endorsed guidance in WCAP-16175~NP-A. The seal materials used at Palo Verde are identical to the material in the NRC-endorsed guidance, and no design changes to the seals have been made. Each RCP is modeled to include seal injection and loss of seal cooling. For loss of seal cooling, the assumed leakage from the RCP seals is 17 gallons per minute for each RCP, and operator actions are modeled based on emergency operating procedures and training to trip RCPs upon loss of seal cooling. Additionally, each RCP is modeled in sufficient detail to address all components in the seal cooling path, including power supplies and instrumentation. The NRC staff finds the Palo Verde RCP seal leakage modeling to be acceptable since it is modeled with sufficient detail and meets all the limitations and conditions of the NRC-endorsed guidance in WCAP-16175-NP-A.

Common Cause Failures In relation to whether the licensee appropriately addressed CCFs and surrogate identification, RG 1.177, Revision 1, states that CCF probabilities should be updated when one of the related components is no longer available. It is unclear from the LAR how the licensee plans to update CCF probabilities when one of the related components is no longer available. Therefore, the NRC staff requested clarification in PRA RAI 3 (Reference 12), in how the licensee addresses CCF failure mode in the models and how its approach meets the guidance in RG 1.177. In response to PRA RAI 3 (Reference 4), the licensee stated that with the use of an example fault tree that CCF events are modeled as basic events for all combinations of components in a CCF group. The licensee further explained that CCF will not be revised when a component within the same CCF group is removed from service for planned maintenance. The staff does not agree with this position, as it is contrary to the guidance in RG 1.177. However, the licensee provided examples to demonstrate that not modifying the remaining basic event probabilities of the remaining components in a CCF group results in a very small change in CDF and LERF, and therefore, has a negligible impact on RICT calculations. The staff reviewed the examples provided by the licensee and finds that the licensee's methodology of CCF modeling to have a negligible impact on RICT calculations.

In the supplement to the LAR dated November 3, 2017, the licensee explained that in an emergent condition, if the extent of condition for the inoperable SSC is not complete, then the RICT Program shall account for the increased possibility of CCF with a new administrative TS requirement. The added requirement states that the licensee will either account for the increased CCF in the RICT calculation or implement RMAs not already credited in the RICT calculation that support redundant and/or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if possible, reduce the frequency of the initiating events that challenge the function(s) performed by the inoperable SSCs. The NRC staff finds that the first option is acceptable because it quantitatively incorporates the potential CCF into the estimated RICT consistent with guidance on including CCF s in RG 1.177. The staff finds the second option is acceptable because identifying the redundant and/or diverse SSCs and developing RMAs targeting the function(s) provides adequate additional confidence that the function(s) will be available while investigation into the potential for CCF is completed.

Configuration Risk Management Program Tool In order to perform the RICT calculations necessary to support this application, the licensee will utilize the CRMP tool, Phoenix Risk Monitor, which is based on its model-of-record PRAs. In 2 of the LAR supplement dated November 3, 2017, the licensee described the process of translating the model-of-record to the CRMP software program, and the training and qualification of personnel in the proper use of the CRMP program.

One of the requirements in RG 1.17 4, Revision 3; RG 1.177, Revision 1; and RG 1.200, Revision 2, is that the licensee's PRA model-of-record reflects the as-operated, as-built plant for license applications. In Attachment 11 of the LAR supplement dated November 3, 2017, the licensee described its PRA model update process.

The Palo Verde PRA models are maintained and updated under a Configuration Control Program in accordance with station procedures to ensure the PRA models reflect the as-built, as-operated plant. Plant changes including physical modifications, procedure revisions, and updated plant/industry operational experience, are identified and reviewed prior to implementation to determine if they could impact the PRA models. Discovered conditions are also reviewed for impact on the PRA models.

The NRC staff requested in PRA RAI 5 (Reference 12), clarification of how the current licensee CRMP tool meets the requirements of the RICT Program. In response to PRA RAI 5 (Reference 4), the licensee stated that the RICT Program will be able to address reassessment of CCF quantitatively, as when a component fails, the CCF will be increased for the remaining in-service components to account for the increased conditional probability due to CCF. In addition, the licensee plans to use RMAs, specific to CCFs that are documented in plant procedures to improve the success of the redundant and/or diverse SSCs. The licensee will also have the RICT backstop of 30 days hard-coded into the Phoenix Risk Monitor software. In addition, the 24-hour backstop for LOF conditions will be proceduralized to ensure the 24-hour backstop is adhered to. For short completion times, the calculation of an RICT can be completed within 15 minutes using the licensee's CRMP tool and updated plant configuration information. The licensee also stated PRA functional/non-functional status will be explicitly tracked within the Phoenix Risk Monitor software. Based on the licensee's response, the NRC staff finds the licensee's CRMP tool an acceptable tool to implement the RICT Program.

In Section 3.0 of NEI 06-09, Revision 0-A (Reference 14), it states RMTS applications use the same process consistent with RG 1.182 and industry guidance NUMARC 93-01. In PRA RAI 20 (Reference 12), the NRC staff requested confirmation that the licensee's RICT Program has incorporated the latest version. In response to PRA RAI 20 (Reference 4), the licensee confirmed it has implemented NU MARC 93-01, Revision 4A (Reference 21 ), for on line Maintenance Rule 10 CFR 50.69(a)(4) risk assessments. The licensee also stated the RICT Program will use NUMARC 93-01, Revision 4A, and the references will be updated consistent with the 10 CFR 50.69(a)(4) risk assessment program. 6 of the LAR supplement dated November 3, 2017, provided examples of RMAs if it is anticipated that the RMAT will be exceeded. These RMAs are to be implemented immediately upon the identification that the RMAT will be exceeded. The RMAs are put in place when ICDP of 1 E-6 or ILERP of 1 E-7 is reached. In the case of an emergent event, the RMAs are to be implemented when the instantaneous CDF or instantaneous LERF exceed 1 E-3/year or 1 E-4/year, respectively. The licensee will determine which SSCs are most important from a risk standpoint and use RMAs to protect these SSCs.

Section 2.3.1, "Configuration Risk Management Process & Application of Technical Specifications," of NEI 06-09, Revision 0-A, provides details for the RMAT/RICT process and identifies possible methods to address the development of RMAs. In Attachment 12 of the LAR supplement dated November 3, 2017, the licensee states the use of the EPRI software program to implement the CRMP tool. The NRC staff notes that this program is one of the methods detailed in NEI 06-09, Revision 0-A, for some hazards analysis, but there is no discussion for the development of RMAs associated with the other hazards. Therefore, the staff requested in PRA RAI 27 (Reference 12), details in how the licensee will address these hazards when developing RMAs. In response to PRA RAI 27 (Reference 4), the licensee stated that plant procedures will require specific RMAs for each LCO included in the RICT Program. Plant procedures will also direct implementation of configuration and condition specific RMAs, including LOF conditions. The NRC staff finds the licensee's process for developing and implementing RMAs is acceptable because it is in accordance with the NRC-endorsed guidance in NEI 06-09, Revision 0-A.

PRA Modelling Conclusions The NRC staff reviewed the licensee's information and concluded that the PRA modeling used to support the RICT Program is able to appropriately model alignments of components during periods when the RICT will be calculated. Therefore, the NRC staff finds that the licensee has satisfied the intent of RG 1.177, Revision 1 (Section 2.3.3), and RG 1.17 4, Revision 3 (Section 2.3), and that the PRA modeling is appropriate for this application.

3. 1.4. 1.4 Key Assumptions and Sources of Uncertainty Risk-informed analyses of TS changes can be affected by uncertainties regarding the assumptions made during the PRA model's development and application. Typically, the risk resulting from TS CT changes is relatively insensitive to most uncertainties because the uncertainties tend to affect similarly both the base case and the changed case. The licensee considered PRA modeling uncertainties and their potential impact on the RICT Program. The licensee identified, as necessary, the applicable RMAs to limit the impact of these uncertainties.

In Attachment 13 of the LAR supplement dated November 3, 2017, the licensee discussed sources of key assumptions and uncertainty.

Palo Verde refers to the guidance in NUREG-1855 (Reference 39), which RG 1.174 cites for treatment of uncertainties associated with PRA, industry guidance, and EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," dated December 2008 (Reference 42), as providing a detailed process, but may not include plant-specific analysis. Therefore, the NRC staff requested in PRA RAI 12 (Reference 12), for the licensee to describe the approach in identifying key assumptions and key sources of uncertainty specific to its PRA modeling. In response to PRA RAI 12 (Reference 4), the licensee stated that sources of uncertainty and assumptions were identified using the guidance in NUREG-1855. The licensee also discussed a number of key assumptions and key sources of uncertainty in the SPRA, describing how the ensured consistency of the methods with consensus standards. Further, the licensee pointed to the sources of key assumptions and uncertainty that were provided in Table 13-1 in Attachment 13 of the LAR supplement dated November 3, 2017, to address how each key assumption was dispositioned for the RITSTF Initiative 4b application. The NRC finds the licensee's process of identifying key assumptions and sources of uncertainty to be acceptable because the licensee identified the assumptions related to all aspects of the Palo Verde SPRA model. In addition, the SPRA has been peer reviewed, no open F&Os related to identification and evaluation of uncertainties remain open, and the provided key assumptions and sources of uncertainty have been identified and evaluated based on their potential to impact RICT calculations.

The licensee identified a source of uncertainty that impacted this application. The source of uncertainty is that operator action timings for seismic events were the same as for internal events. Given that a seismic event may result in a longer response time, the licensee performed a sensitivity analysis by raising the relevant internal event HFEs failure probabilities by three times. The results showed an increase in CDF and LERF of 9. 7 percent and 5.3 percent, respectively. Therefore, the seismic model used for RICT calculations will have increased all seismic HFEs by a factor of three (Table A 13-1 on page 13-6 (Reference 3)).

The licensee makes a reference in Table A13-1 in Attachment 13, to "recovery actions." It is the NRC staff's understanding that this term is applicable to NFPA 805 plants, and Palo Verde has not been licensed as an NFPA 805 plant. Therefore, the staff requested in PRA RAI 18 (Reference 12), clarification of this term and how it is implemented in the Palo Verde PRA models. In response to PRA RAI 18, in the letter dated May 18, 2018 (Reference 4), the licensee clarified that the term "recovery action" is used in the context as operator actions analyzed as HFEs and credited in the IEPRA model to recover a failed function, system, or component. The only operator actions that are credited in the FPRA model are derived from the IEPRA model. The licensee also stated all "recovery actions" have been identified, quantified, and evaluated in accordance with NRC guidance and the ASME PRA standard. The licensee identified two operator action HFEs that were necessary to meet RG 1.17 4 risk guidelines at the time this LAR was submitted. One of these actions, to align a FLEX modification to feed a steam generator, is no longer necessary as a plant modification and eliminates the need for this operator action with the installation of cross-tie valves. The second operator action HFE to locally close containment isolation valves will be addressed through procedure revisions to specifically contain steps for the operators to locally close containment isolation valves. The staff finds this response acceptable as "recovery actions" are appropriately analyzed as operator action HFEs in accordance with NRG-approved guidance and the ASME PRA standard. The staff finds the procedure revision to address the operator HFE to locally close containment isolation valves acceptable because procedure revisions will be completed prior to implementation of the RICT Program through a license condition in Table 1-2 of the licensee's RAI responses (Reference 4), to ensure the Palo Verde PRA is representative of the as-built, as-operated plant.

The licensee makes a reference in Table A 13-1 in Attachment 13 to require plant modifications to address certain fire protection issues. The NRC staff did not find some of these modifications listed in Attachment 4 of this LAR supplement. Therefore, the staff requested in PRA RAI 24, details of these modifications, the schedule for implementation, and a sensitivity analysis on the RICT application if not completed before implementation. In response to PRA RAI 24 (Reference 4), the licensee clarified that the plant modifications referenced in the LAR to address fire risk have been physically implemented at all three units. The staff finds this acceptable because the plant modifications have been physically implemented.

One of the assumptions provided in Attachment 13 states that the Palo Verde PRA assumes a 2-hour battery life and it considers it to be conservative based on the current analysis, including load shedding. The NRC staff is unclear that this is a conservative treatment, and therefore, requested in PRA RAI 29 (Reference 12), the availability of the procedures to operators, and if they contain feasible actions to provide a calculation that supports this conclusion. In response to PRA RAI 29 (Reference 4), the licensee states procedures are available for load shedding of the DC batteries and are directed by emergency operating procedures during a station blackout.

The licensee also stated the battery load shedding strategy during an extended loss of AC power scenario results in a safe and stable condition within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and can support a minimum of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months of extended loss of AC power conditions until 480 V FLEX generators are operational within 34 hours3.935185e-4 days 0.00944 hours 5.621693e-5 weeks 1.2937e-5 months . The staff finds that appropriate plant procedures are available to load shed the DC batteries because the load shedding procedures are directed to be used by emergency operating procedures. These procedures are maintained under plant processes, and operators are trained on implementing emergency operating procedures through the licensee's training program. The staff also finds that DC battery life after load shedding will result in conservative RICT calculations as the licensee has validated the DC batteries after load shedding can support a minimum of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months in an extended loss of AC power condition.

The NRC staff finds that the licensee performed an adequate assessment to identify the potential sources of uncertainty, and the identification of the key assumptions and sources of uncertainty was appropriate and consistent with the guidance in NUREG-1855 and the associated EPRI TR-1016737. Therefore, the NRC staff finds that the licensee has satisfied the guidance in RG 1.177, Revision 1 (Section 2.3.5) and RG 1.17 4, Revision 3 (Section 2.2), and that the treatment of model uncertainties for risk evaluation of extended CTs is appropriate for this application and consistent with the guidance in NEI 06-09, Revision 0-A.

3.1.4.1.5 PRA Results and Insights The proposed change implements a process to determine TS RICTs rather than specific changes to individual TS CTs. NEI 06-09, Revision 0-A, requires periodic assessment of the risk incurred due to operation beyond the front-stop CTs due to implementation of an RICT Program and comparison to the guidance of RG 1.17 4, Revision 3, for small increases in risk.

As with other unique risk-informed applications, supplemental risk acceptance guidelines that complement the guidance in RG 1.17 4, Revision 3, are appropriate.

NEI 06-09., Revision 0-A, requires that configuration risk be assessed to determine the RICT, and establishes the criteria for ICDP and ILERP on which to base the RICT. An ICDP of 1 E-5 and an ILERP of 1 E-6 are used as the risk measures for calculating individual RICTs. These limits are consistent with NU MARC 93-01, Revision 4A. The use of these limits in NEI 06-09, Revision 0-A, aligns the TS CTs with the risk management guidance used to support plant programs for the Maintenance Rule, and the NRC staff accepted these supplemental risk acceptance guidelines for RMTS programs in its approval of NEI 06-09, Revision 0-A.

NEI 06-09, Revision 0-A, as modified by the limitations and conditions in the SE, requires that the cumulative impact of implementation of an RMTS be periodically assessed and shown to result in (1) a total risk impact below 1 E-5/year for changes to CDF, (2) a total risk impact below 1 E-6/year for changes to LERF, and (3) the total CDF and total LERF must be reasonably shown to be less than 1 E-4/year and 1 E-5/year, respectively. The licensee indicated in of the supplement dated November 3, 2017, that the estimated total CDF and LERF meet the 1 E-4/year CDF and 1 E-5/year LERF criteria of RG 1.17 4 consistent with the guidance in NEI 06-09, Revision 0-A, and that these guidelines be satisfied whenever a RICT is implemented.

Since the resolutions of the RAls in the letters dated May 18, September 21, and October 5, 2018, may impact the CDF and LERF results (e.g. PRA model updates), the NRC staff requested in PRA RAI 21, the updated values, and how the licensee will ensure those changes will be incorporated prior to implementation of the RICT Program. In response to PRA RAI 21 (Reference 7), the licensee provided a list of all the changes that were made to the Palo Verde PRA models as a result of the responses to the RAI. The licensee also provided an estimate to the change in CDF and LERF for all three units as a result of the responses to the RAI. The total CDF and LERF as a result of RAI responses and upon completion of all implementation items, as provided in Attachment 1 of the first round RAI responses (Reference 4), and the third round of RAI responses (Reference 7), are estimated to be 7.2E-5 and 7.6E-6, respectively.

The staff finds this response acceptable because the total CDF and LERF meet the acceptance guidelines in RG 1.17 4, Revision 3 and RG 1.177, Revision 1. The staff also finds this acceptable because the licensee has addressed all RAls, and the licensee's proposed license condition requires the implementation item for any PRA modeling updates that have not yet been completed to, be done prior to implementation of the RICT Program.

With regard to unit CDF and LERF values, given even small differences between units, can provide different results. The NRC staff notes that Attachment 9 of the LAR supplement dated November 3, 2017, shows the same baseline CDF and LERF values for each of the three units.

The staff was unclear whether the results reflect separate PRA unit results or that a single calculation was performed. The staff requested in PRA RAI 22 (Reference 12), clarification on how many unit calculations were performed, and if only one was performed, to provide justification that this meets the as-built, as-operated requirement. In response to PRA RAI 22 (Reference 4), the licensee stated that the PRAs were developed based on Palo Verde, Unit 1, and modified to capture scenario impacts and system responses from all three units. Therefore, the composite PRA model represents the three units and a separate calculation was not performed for Palo Verde, Units 2 and 3. For the Palo Verde IEPRA model, there are minor differences in electrical configuration that are determined to be insignificant to risk. For the IFPRA model, there are no significant flooding related differences between the three units.

There are several differences between the three units for the as-built configuration of the fire protections systems and the location of PRA credited components relative to ignition sources, but the licensee demonstrated those differences are insignificant to risk. The licensee also stated there are no significant differences between the three units for the SPRA. The NRC staff concludes the licensee's composite PRA model for all four hazards is acceptable for use in RICT calculations because it is an adequate representation of all three units since the differences between the three units are insignificant to the increase in CDF and LERF, and that each unit will use the composite model separately to calculate a RICT.

As mentioned above, Attachment 9 of the LAR supplement dated November 3, 2017, provides the same baseline CDF and LERF values for the three units. The licensee states this is appropriate since each unit is nearly identical with small differences. However, in 3 of this supplement, the licensee provides a discussion of shared SSCs such as the SBOG. Therefore, in PRA RAI 25 (Reference 12), the NRC staff requested the licensee to provide details on how shared systems and resources between the three units will be treated for multiple unit events. In response to PRA RAI 25 (Reference 4), the licensee described SSCs that are shared between the units and how they are treated in the PRA model. The first SSC is the three SUTs that are shared between two units, and the composite PRA model represents the most limiting configuration of the SUTs. The second SSC is the SB0Gs that are shared between the three units but can only be operated from Unit 1, and the HFEs were already modeled in the Unit 1 PRA. The composite PRA model represents the most limiting configuration for the SBOGs. In addition, the probability of two or more units experiencing a concurrent station blackout is screened due to the low probability of the event occurring. The third SSC is the fire water supply that is shared between the three units, however, common mode failure is screened due to a low probability of failure. The auxiliary steam system and tower makeup and blowdown system are shared between the three units but are not modeled in the PRA because these SSCs are not needed for safe shutdown and failure of these SSCs will not result in a transient. The NRC staff finds the composite PRA model to be acceptable because it adequately considers and models the differences between the three units, the composite PRA model is not overly conservative, and the composite model represents the most limiting configurations of the three units for the shared SSCs.

The NRC staff reviewed the licensee's information, including RAI responses, and concluded that the PRA modeling used to support the RICT Program is able to treat alignments of components during periods when the RICT will be calculated. Therefore, the NRC staff finds that the licensee has satisfied the guidance of RG 1.177, Revision 1 (Section 2.3.3) and RG 1.174, Revision 3 (Section 2.2), and that the PRA modeling at Palo Verde is appropriate for the calculation of RICTs.

The licensee has incorporated NEI 06-09, Revision 0-A, in the RICT Program of TS 5.5.20 and therefore, calculates the RICT consistently with its criteria, and assesses the RICT Program to assure any risk increases are small per the guidance of RG 1.17 4. Therefore, the NRC staff finds that the licensee's RICT Program is consistent with NEI 06-09, Revision 0-A, guidance and is, therefore, acceptable.

3.1.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations The second tier provides that a licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is taken out of service in accordance with the proposed TS change.

NEI 06-09, Revision 0-A, does not permit voluntary entry into high-risk configurations that would exceed instantaneous CDF and LERF limits of 1 E-3/year and 1 E-4/year, respectively. It further requires implementation of RMAs when the actual or anticipated risk accumulation during an RICT will exceed one tenth of the ICDP or ILERP limit. Such RMAs may include rescheduling planned activities to lower risk periods or implementing risk-reduction measures. The limits established for entry into an RICT and for RMA implementation are consistent with the guidance of NU MARC 93-01, Revision 4A (Reference 21 ), endorsed by RG 1.160, Revision 3 (Reference 22), as applicable to plant maintenance activities. The RICT Program requirements and criteria are consistent with the principle of Tier 2 to avoid risk-significant configurations.

Based on the licensee's incorporation of NEI 06-09, Revision 0-A, in the TSs as discussed in LAR Section 2.2, as supplemented by letter dated November 3, 2017, and because the proposed changes are consistent with the guidance of RG 1.17 4, Revision 3, and RG 1.177, Revision 1, the NRC staff finds the licensee's Tier 2 program is acceptable and supports the proposed implementation of the RICT Program.

3.1.4.3 Tier 3: Risk-Informed Configuration Risk Management The third tier provides that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity.

NEI 06-09, Revision 0-A, addresses Tier 3 guidance by requiring assessment of the RICT to be based on the plant configuration of all SSCs that might impact the RICT, including safety-related and nonsafety-related SSCs. A plant configuration is considered risk-significant when the ICDP or the ILERP exceeds one-tenth of the risk on which the RICT is based, which is generally 1 E-5 and 1 E-6 ICDP and ILERP, respectively. If a risk-significant plant configuration exists, then NEI 06-09, Revision 0-A, via the RICT Program in the TSs, would require the licensee to implement compensatory measures and RMAs. Therefore, the NRC staff determined that the RICT Program provides a methodology to assess and address risk-significant configurations.

The staff also determined that the proposed changes will require reassessment of any plant configuration changes to be completed in a timely manner, based on the more restrictive limit of any applicable TS action requirement, or a maximum of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the configuration change occurs.

Based on the licensee's incorporation of NEI 06-09, Revision 0-A, in the TSs, as discussed in LAR Section 2.2, as supplemented by letter dated November 3, 2017, and because the proposed changes are consistent with the Tier 3 guidance of RG 1.177, Revision 1, the NRC staff finds that the proposed changes are acceptable.

3.1.4.4 Key Principle 4 Conclusions The licensee has demonstrated the technical adequacy and scope of its PRA models, and that the models can support implementation of the RICT Program for determining CTs. The licensee has made proper consideration of key assumptions and sources of uncertainty. The risk metrics are consistent with the approved methodology of NEI 06-09, Revision 0-A, and the acceptance guidance in RG 1.177, Revision 1, and RG 1.174, Revision 3. The RICT Program is controlled administratively through plant procedures and training. The RICT Program follows the NRG-approved methodology in NEI 06-09, Revision 0-A. The NRC staff concludes that the RICT Program satisfies the fourth key safety principle of RG 1.177, and is, therefore, acceptable.

3.1.5 Key Principle 5: Performance Monitoring Strategies - Implementation and Monitoring Program RG 1.17 4, Revision 3, and RG 1.177, Revision 1, establish the need for an implementation and monitoring program to ensure that extensions to TS CTs do not degrade operational safety over time and that no adverse degradation occurs due to unanticipated degradation or common-cause mechanisms. An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change. RG 1.17 4, Revision 3, states that monitoring performed in conformance with the Maintenance Rule (10 CFR 50.65), can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application. According to 5 of the supplement to the LAR by letter dated November 3, 2017, the SSCs in the scope of the RICT Program are also in the scope of the Maintenance Rule.

Section 3.3.3, "Cumulative Risk Tracking," of NEI 06-09, Revision 0-A (Reference 14), requires that the licensee track the risk associated with all entries beyond the front-stop CT, and Section 2.;3.1, "Configuration Risk Management Process & Application of Technical Specifications," provides a requirement for assessing cumulative risk, including a periodic evaluation of any increase in risk due to the use of the RMTS program to extend the CTs.

According to Attachment 9 of the supplement to the LAR dated November 3, 2017, the licensee calculates cumulative risk at least every refueling cycle, not to exceed 24 months, which is consistent with the NEI 06-09, Revision 0-A. The licensee converts the cumulative ICDP and the I LERP into average annual values, which are then compared to the limits of RG 1.17 4. If any limits are exceeded, corrective actions are taken to ensure future plant operational risk is within the acceptance guidance. This evaluation assures that RMTS program implementation meets RG 1.17 4 guidance for small risk increases. The licensee is implementing NEI 06-09, Revision 0-A, via the RICT Program and, therefore, complies with this RMTS program.

The NRC staff concludes that the RICT Program satisfies the fifth key safety principle of RG 1.177, and is therefore, acceptable.

3.2 New Conditions and Variations from TSTF-505 The licensee's LAR proposed adding the new conditions and associated required actions in the described TSs, and modifying selected CTs to permit extending the CTs in accordance with the proposed RICT Program, which is added to the administrative controls section of the TSs, which incorporates the requirements as described in the NEI 06-09, Revision 0-A. The NRC staff finds the TS changes described in Sections 2.2.2 and 2.2.3 of this SE are acceptable, and comply with regulatory requirements and the requirements of NEI 06-09, Revision 0-A.

4.0 CHANGES TO THE OPERATING LICENSE In the LAR supplement dated May 18, 2018, as revised by letter dated October 5, 2018 (References 4 and 7, respectively), the licensee proposed the following license conditions to be added to Appendix D of the Palo Verde, Units 1, 2, and 3 Renewed Facility Operating Licenses:

Arizona Public Service Company (APS) is approved to implement the risk-informed completion time (RICT) program specified in license amendment 209 dated May 29, 2019.

1.

The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200.

Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval via a license amendment.

2.

APS will complete the implementation items listed in the Enclosure of APS letter 102-07587, dated November 3, 2017, to the NRC and in, Table 1-1 of APS letter 102-07691, dated May 18, 2018, as updated by APS letter 102-07801, dated October 5, 2018, prior to implementation of RICTs. All issues identified will be addressed and any associated changes will be made, focused scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the RICT program.

The NRC staff notes that prior approval would be required for a change to the RICT Program or the implementation of the RICT Program as described in the administrative controls section TS 5.5.20, and the implementation items in APS Letter 102-07587, dated November 3, 2017, to the NRC, and in Attachment 1, Table 1-1 to APS Letter 102-07691, dated May 18, 2018, as updated by APS Letter 102-07801, dated October 5, 2018. Prior NRC approval will also be required for changes to the PRA methods that have not been previously approved by the NRC in this SE or methods approved for generic use. The staff finding on the acceptability of the implementation of the RICT Program for the TS LCOs in this SE is dependent on the completion of the Implementation Items listed below:

1.

Conduct an augmented F&O closure review of the June 2017 F&O Closure Review findings to include:

a.

Documentation of the basis for the maintenance vs upgrade determination for each reviewed F&Ofinding

b.

A review of F&O findings from the other external hazards peer review

c.

Documentation of the review of supporting requirements determined 'not met' to CC-I I from the self-assessment of the IEPRA model against all supporting requirements in ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Revision 2

d.

Complete required documentation of F&O closure review per Appendix X to NEI 05-04

2.

Conduct a focused scope peer review for the following PRA model upgrades:

a.

The common cause methodology change from the MGL method to the Alpha Factor method

b.

The HRA methodology change from the SHARP model to the EPRI HRA Calculator software

c.

PRA Impact 2003-301 that incorporated new modeling for pressure-induced SGTR using CE NPSD-1124, Methodology for Modeling Main Steam Line Breaks, Revision 0

d.

PRA Impact 2013-151 that significantly impacted the results from the IFPRA model

3.

Revise the PRA models to incorporate resolutions to all open F&O findings and internal FPRA guidance more recently endorsed by the NRC as indicated in the license amendment request Supplement for Risk-Informed Completion Times dated November 3, 2017.

Ensure after these changes are incorporated as indicated in the response to RAls 17.c, 17.d, and 21 that the PRA model total CDF and total LERF are below the limits established in RG 1.17 4, which are 1 E-4/year for CDF and 1 E-5/year for LERF.

4.

Conduct an evaluation of the RCP seal leakage as an initiating event and impact on mitigation functions as described in [supporting requirements]

IE-C6, SY-A15, and SY-813. Utilize the implementation guidance of WCAP-15749-P, Revision 1, RCP Seal Failure Models ofWCAP-16175-P-A, and consider the conditions, limitations, and modifications identified in the safety evaluation (ADAMS [Accession] No. ML070240429).

5.

Conduct a focused scope peer review for the following PRA model upgrades:

a.

PRA model impact 2017-2021 : Closure of F&O AS-03, LOCA modeling success criteria justification

b.

PRA model impact 2017-2026: Closure of Internal Flooding F&O 1-2, Human-Induced Flooding (Linked with Impact 2018-2526)

c.

PRA model impact 2017-2028: Closure of F&O SHA-E2-01,

Updated Seismic Hazard Analysis

d.

PRA model impact 2017-2029: Closure of F&O SFR-F3-01, Resolve Seismic Fragility of Unaddressed Relays

e.

PRA model impact 2018-2526: Closure of Internal Flooding F&O IFEV-A7-01, Human-Induced Flooding (Linked with Impact 2017-2026)

f.

PRA model impact 2018-2531: Closure of F&O SPR-B8-01, Post-Seismic Event Ex-Control Room Operator Actions Alternate Paths

g.

Modeling of Fire-Induced A TWS

6.

Implement change to procedure 40EP-9E001, Standard Post Trip Actions, to credit operator action to locally trip NGN-L03C4 and NGN-L 10C4.

The NRC staff finds that the licensee's proposed incorporation of these measures in a license condition, and the implementation of the items referenced above prior to implementation of the RICT Program is acceptable because they adequately implement the RICT Program using models, methods, and approaches consistent with applicable guidance that are acceptable to the NRC. For each implementation item, the licensee and the staff have reached a satisfactory resolution involving the level of detail and main attributes that will be incorporated into the program upon completion. The staff, through an onsite audit or during future inspections, may choose to examine the closure of the implementation items, with the expectation that any issues discovered during this review, or concerns with regard to adequate completion of the implementation item, would be tracked and dispositioned appropriately under the licensee's corrective action program and could be subject to appropriate NRC enforcement action.

5.0

SUMMARY

5.1 NRC Staff Findings and Conclusions The NRC staff finds that the licensee's proposed implementation of the RICT Program for the identified scope of required actions is consistent with the guidance of NEI 06-09, Revision 0-A, subject to the limitations and conditions evaluated in Section 4.0 of this SE. The licensee's methodology for assessing the risk impact of extended CTs, including the individual CT extension impacts in terms of ICDP and ILERP, and the overall program impact in terms of LiCDF and LiLERF, is accomplished using PRA models of sufficient scope and technical adequacy based on consistency with the guidance of RG 1.200, Revision 2 with completion of the implementation items. The RICT calculation uses the PRA model as translated into the CRMP tool, and the licensee has an acceptable process in place to ensure the PRA model continues to use NRG-accepted methods and is appropriately updated to reflect changes to the plant or operating experience. In addition, the staff finds that the proposed implementation of the RICT Program addresses the RG 1.177 defense-in-depth philosophy and safety margins to ensure that they are adequately maintained and includes adequate administrative controls as well as performance monitoring programs.

The NRC staff has evaluated the proposed changes against each of the five key principles in RG 1.177, Revision 1, and RG 1.17 4, Revision 3.

The proposed changes to the LCO conditions and the CTs for remedial actions are acceptable and will continue to meet 10 CFR 50.36(c)(2), 10 CFR 50.46, 10 CFR 50.57(a)(2), and 1 O CFR 50.57(a)(6). Therefore, the NRC staff concludes that the proposed change meets Key Principle 1: change meets current regulations.

For LCO conditions in the existing TS, some reduction in defense-in-depth has already been evaluated and accepted for a limited period of time during the current CT, and the RICT provides solely a risk-informed extension for operating in that plant condition. Therefore, the NRC staff concludes that the proposed change meets Key Principle 2: change is consistent with defense-in-depth philosophy.

Implementation of the methodology as described in the licensee's TS 5.5.20 provides confidence that the licensee can extend the CTs without any unanalyzed reduction in safety margins because the design-basis success criteria parameters will be at the same level and provided by the same equipment as has been currently accepted. Therefore, the NRC staff concludes that the proposed change meets Key Principle 3: maintains sufficient safety margins.

The licensee has demonstrated the technical adequacy and scope of its PRA models after completion of the six implementation items and the license condition, and that the models can support implementation of the RICT Program for determining the identified CTs. The risk metrics will be consistent with the NRG-approved methodology of NEI 06-09, Revision 0-A; RG 1.174, Revision 3; RG 1.177, Revision 1; and the RICT Program is controlled administratively through plant procedures and training. Therefore, the NRC staff concludes that the proposed change meets Key Principle 4: proposed increases in CDF or risk are small and are consistent with the Commission's Safety Goal Policy Statement.

As discussed in Attachment 15 of the LAR supplement dated November 3, 2017, the licensee takes the sum of the contributors to risk associated with each application of the RICT Program, and that change in CDF or LERF above the zero maintenance baseline levels is converted into average annual values, which are then compared to the limits of RG 1.17 4. If any limits are exceeded, corrective actions are taken to ensure future plant operational risk is within the acceptance guidance. The SSCs in the scope of the RICT Program that have their CTs extended by entry into the RICT Program are monitored to ensure their safety performance is not degraded, because the SSCs in the scope of the RICT Program are also in the scope of the Maintenance Rule. RG 1.17 4, Revision 3, states that monitoring performed in conformance with the Maintenance Rule, 10 CFR 50.65, can be used when the monitoring performed is sufficient for the SSCs affected by the risk-informed application. The NRC staff, therefore, concludes that the proposed change meets Key Principle 5: use performance measurement strategies to monitor the change.

The NRC staff concludes that the proposed changes satisfy the key principles of risk-informed decisionmaking identified in RG 1.174, Revision 3, and RG 1.177, Revision 1, and, therefore, the requested adoption of the proposed changes to the TSs, implementation items, and associated guidance is acceptable.

The regulation in 1 O CFR 50.36(a)(1) states, in part: "A summary statement of the bases or reasons for such specifications other than those covering administrative controls, shall also be included in the application, but shall not become part of the technical specifications."

Accordingly, along with the proposed TS changes, the licensee also submitted TS Bases changes that corresponded to the proposed TS changes to provide the reasons for the TSs.

The NRC staff finds that the TS bases changes were consistent with the bases changes in the model application.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendments on December 17, 2018. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to the installation or use of facility component located within the restricted area as defined in 10 CFR Part 20 and changes surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, published in the Federal Register on August 14, 2018 (83 FR 40345), and there has been no public comment on such finding. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22( c)(9). Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The Commission concludes, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

9.0 REFERENCES

1.

Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times,"

dated July 31, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15218A300).

2.

Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, Renewed Operating License Nos. NPF-41, NPF-51, NPF-74, Response to Request for Additional Information Regarding License Amendment Request to Adopt TSTF-505," dated April 11, 2016 (ADAMS Accession No. ML16102A463).

3.

Andrews, G., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, Renewed Operating License Nos. NPF-41, NPF-51, NPF-74, License Amendment Request Supplement for Risk-Informed Completion Times," dated November 3, 2017 (ADAMS Accession No. ML17307A188).

4.

Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, APS Response to Request for Additional Information for Risk-Informed Completion Times," dated May 18, 2018 (ADAMS Accession No. ML18138A480).

5.

Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, Response to Electrical Engineering Operating Reactor Branch (EEOB) Request for Additional Information for Risk-Informed Completion Times,"

dated June 1, 2018 (ADAMS Accession No. ML181528874 ).

6.

Lacal, M. L., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, Response to Request for Additional Information for Risk-Informed Completion Times," dated September 21, 2018 (ADAMS Accession No. ML18264A318).

7.

Lacal, M. L., Arizona Public Service Company letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station Units 1, 2, and 3, Docket Nos.

STN 50-528, 50-529, and 50-530, Response to Request for Additional Information for Risk-Informed Completion Times Supplemental Responses for Items 17.f and 21," dated October 5, 2018 (ADAMS Accession No. ML18278A295).

8.

Technical Specifications Task Force, Transmittal of TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b Errata," dated June 14, 2011, and "Proposed Revision to the Model Application for TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b,"'

dated January 31, 2012 (ADAMS Package Accession No. ML120330410).

9.

U.S. Nuclear Regulatory Commission, "Model Safety Evaluation for Plant-Specific Adoption of Technical Specifications Task Force Traveler TSTF 505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b. Federal Register Notice of Availability (77 FR 15399) (ADAMS Accession No. ML120200380).

10.

McGinty, T. J., and Boland, A. T., U.S. Nuclear Regulatory Commission, letter to Technical Specifications Task Force, "Issues with Technical Specifications Task Force Traveler TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times -

RITSTF Initiative 4B," dated November 15, 2016 (ADAMS Accession No. ML16281A021 ).

. 11.

Boland, A. T., U.S. Nuclear Regulatory Commission, letter to All Operating Reactor Licensees, "Issues with Technical Specification Task Force Traveler TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4B,"

dated November 15, 2016 (ADAMS Accession No. ML16300A245).

12.

Lingam, S., U.S. Nuclear Regulatory Commission, e-mail to Matthew Cox, Arizona Public Service Company, "Palo Verde 1, 2, and 3 - Final RAls for TSTF-505 (Initiative 4b) LAR (CAC Nos. MF6576, MF6577, and MF6578; EPID L-2015-LLA-0001),"

dated April 4, 2018 (ADAMS Accession No. ML180948112).

13.

Golder, J.M., U.S. Nuclear Regulatory Commission, letter to Biff Bradley, Nuclear Energy Institute, "Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specifications (RMTS) Guidelines," May 17, 2007 (ADAMS Accession No. ML071200238).

14.

Nuclear Energy Institute, "NEI 06-09, 'Risk Informed Technical Specifications Initiative 4b: Risk Managed Technical Specifications (RMTS},"' Topical Report NEI 06-09, Revision 0-A, dated October 12, 2012 (ADAMS Package Accession No. ML122860402).

15.

U.S. Nuclear Regulatory Commission, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Regulatory Guide 1.200, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014).

16.

U.S. Nuclear Regulatory Commission, "Standard Technical Specifications, Combustion Engineering Plants, NUREG-1432, Revision 4.0, Volume 1, Specifications, dated April 2012 (ADAMS Accession No. ML12102A165).

17.

Mims, D. C., Arizona Public Service Company, letter to U.S. Nuclear Regulatory Commission, "Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, Docket Nos. 50-528 50-529, and 50-530, License Nos. NPF-41, NPF-51 and NPF-74, License Amendment Request for Adoption of Technical Specifications Task Force (TSTF) Traveler TSTF-439-A, Revision 2, 'Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO,"' dated February 27, 2015 (ADAMS Accession No. ML15065A031 ).

18.

Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Updated Final Safety Analysis Report, Revision 19, dated July 2017 (ADAMS Accession No. ML17234A197).

19.

U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Regulatory Guide 1.174, Revision 2 dated May 2011 and Revision 3 dated January 2018 (ADAMS Accession Nos. ML100910006 and ML17317A256, respectively).

20.

U.S. Nuclear Regulatory Commission, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Regulatory Guide 1.177, Revision 1, May 2011 (ADAMS Accession No. ML100910008).

21.

Nuclear Management and Resources Council, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," NUMARC 93-01, Revision 4A (ADAMS Accession No. ML11116A198).

22.

U.S. Nuclear Regulatory Commission, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Regulatory Guide 1.160, Revision 3, May 2012 (ADAMS Accession No. ML113610098).

23.

American Society of Mechanical Engineers/American Nuclear Society, Addenda to ASME RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME/ANS PRA Standard ASME/ANS RA-Sa-2009, dated February 2, 2009.

24.

U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2005-20: Revision to Guidance Formerly Contained in NRC Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability," dated September 26, 2005 (ADAMS Accession No. ML052020424).

25.

U.S. Nuclear Regulatory Commission, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," NUREG-0800, Section 16.1, "Risk-Informed Decision Making: Technical Specifications," Revision 1, dated March 2007 (ADAMS Accession No. ML070380228).

26.

Giitter, J., and Ross-Lee, M. J., U.S. Nuclear Regulatory Commission letter to Greg Kruegar, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os)," dated May 3, 2017 (ADAMS Accession No. ML17079A427).

27.

Idaho National Engineering and Environmental Laboratory, "Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessments," NUREG/CR-5485, dated November 1998 (not publicly available).

28.

Nuclear Energy Institute, "Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard," NEI 05-04, Revision 2, dated November 2008 (ADAMS Accession No. ML083430462).

29.

Nuclear Energy Institute, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines," NEI 07-12, Revision 1, dated June 2010 (ADAMS Accession No. ML102230070).

30.

Nuclear Energy Institute, "External Hazards PRA Peer Review Process Guidelines,"

NEI 12-13, dated August 2012 (ADAMS Accession No. ML12240A027).

31.

Sandia National Laboratories, "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," Final Report, NUREG/CR-1278, dated August 1983 (ADAMS Accession No. ML071210299).

32.

Electric Power Research lnstitute/U.S. Nuclear Regulatory Commission, "EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities," Volume 2: Detailed Methodology, NUREG/CR-6850, dated September 2005 (ADAMS Accession No. ML052580118).

33.

U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2007-19, "Process for Communicating Clarifications of Staff Positions Provided in Regulatory Guide 1.205 Concerning Issues Identified during the Pilot Application of National Fire Protection Association Standard 805," dated August 20, 2007 (ADAMS Accession No. ML071590227).

34.

U.S. Nuclear Regulatory Commission/Electric Power Research Institute, "Joint 6ssessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE),"

NUREG/CR-7150, Volume 2, Expert Elicitation Exercise for Nuclear Power PlantFire-lnduced Electrical Circuit Failure," Final Report, dated May 2014 (ADAMS Accession No. ML14141A129), which is supported by a letter from the NRC to NEI, "Supplemental Interim Technical Guidance on Fire-Induced Circuit Failure Mode Likelihood Analysis,"

(ADAMS Package Accession No. ML14111A366).

35.

U.S. Nuclear Regulatory Commission/Electric Power Research Institute, "Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database: United States Fire Event Experience Through 2009,"

NUREG-2169, dated January 2015 (ADAMS Accession No. ML15016A069).

36.

U.S. Nuclear Regulatory Commission/National Institute of Standards and Technology, "Cable Heat Release, !gnition, and §pread in Iray Installations During Eire (CHRISTI FIRE}, Phase 1: Horizontal Trays," Volume 1, NUREG/CR-7150, Phase 2:

"Vertical Shafts and Corridors," Volume 2, dated December 2013 (ADAMS Accession No. ML13346A045).

37.

U.S. Nuclear Regulatory Commission, "Good Practices for Implementing Human Reliability Analysis (HRA}," NUREG-1792, dated April 2005 (ADAMS Accession No. ML051160213).

38.

Harrison, D. G., U.S. Nuclear Regulatory Commission, letter to Biff Bradley, Nuclear Energy Institute, "U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, 'External Hazards PRA Peer Review Process Guidelines' dated August 2012," dated November 16, 2012 (ADAMS Accession No. ML12321A280).

39.

U.S. Nuclear Regulatory Commission, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking," NUREG-1855, Revision 1, Final Report, dated March 2017 (ADAMS Accession No. ML17062A466).

40.

Westinghouse Electric Company LLC, WCAP-15749, "Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling," Revision 0, dated December 2008.

41.

Westinghouse Electric Company LLC, WCAP-16175-NP-A, "Model for Failure of RCP Seals Given Loss of Seal Cooling in CE NSSS Plants," Revision 0, March 2007 (ADAMS Accession No. ML071130383).

42.

Electric Power Research Institute, EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008.

Principal Contributors: B. Hartle, NRR Date: May 29, 2019 J. Evans, NRR K. Nguyen, NRR K. West, NRR R. Tjader, NRR

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENT NOS. 209, 209, AND 209 RE: ADOPTION OF RISK-INFORMED COMPLETION TIMES IN TECHNICAL SPECIFICATIONS (CAC NOS. MF6576, MF6577, AND MF6578; EPID L-2015-LLA-0001) DATED MAY 29, 2019 DISTRIBUTION:

PUBLIC RidsACRS MailCTR Resource RidsNrrDeEeob Resource RidsNrrDeEicb Resource RidsNrrDeEmib Resource RidsNrrDeEseb Resource RidsNrrDorlLpl4 Resource RidsNrrDraApla Resource RidsNrrDraAplb Resource RidsNrrDraArcb Resource RidsNrrDssScpb Resource RidsNrrDssSrxb Resource RidsNrrDssStsb Resource RidsNrrLAPBlechman Resource RidsNrrPMPaloVerde Resource RidsRgn4MailCenter Resource ADAMS A ccess1on N ML19085A525 o.:

OFFICE NRR/DORL/LPL4/PM NRR/DORL/LPL4/LA NAME Slingam PBlechman DATE 4/25/19 4/25/19 RBeaton, NRR NCarte, NRR RTjader, NRR GCurran, NRR JEvans, NRR BHartle, NRR KHsu, NRR Mli, NRR KNguyen, NRR MReisi Fard, NRR JRobinson, NRR GThomas, NRR KWest, NRR DWoodyatt, NRR AZoulis, NRR DHeeszel, NRO

b 1v memoran NRR/DRA/APLA/BC*

SRosenberg 11/21/18 d

OFFICE NRR/DE/EEOB/BC (A)* NRR/DE/EICB/BC*

NRR/DSS/SRXB/BC**

NAME EMiller MWaters JWhitman DATE 12/4/18 12/6/18 5/13/19 OFFICE NRR/DSS/STSB/BC**

OGG (NLO)**

NRR/DORL/LPL4/BC NAME VCusumano AGhosh RPascarelli DATE 3/28/19 5/9/19 5/29/19 OFFICIAL RECORD COPY um via ema1 NRR/DRA/APLB/TL

MReisi Fard 11/21/18 NRR/DE/ESEB/BC**

BWittick 5/2/19 NRR/DORL/LPL4/PM Slingam 5/29/19

v t e Letter Sequence Approval
CAC:MF6576, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed) CAC:MF6577, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed) CAC:MF6578, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed) EPID:L-2015-LLA-0001, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed)
Initiation Request, Request, Request, Request, Request, Request, Request, Request, Request Acceptance Supplement, Supplement, Supplement Administration Questions 26 February 2016 7 March 2016 4 April 2018 6 April 2018 3 May 2018 23 August 2018 Answers 9 May 2018 18 May 2018 21 September 2018 Results Approval, Approval, Approval, Approval Other: ML18116A098
MONTHYEAR2018-04-04 [Table View]

ML19085A525

Text

SUBJECT:

Dear Mr. Bement:

Enclosures:

Attachment:

Attachment:

Attachment:

1.0 INTRODUCTION

2.1 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

System Description

SUMMARY

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

9.0 REFERENCES

SUBJECT:

Navigation menu

Search