ML15218A300

Palo Verde, Units 1, 2 & 3 - License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times

ML15218A300
Person / Time
Site:	Palo Verde
Issue date:	07/31/2015
From:	Lacal M L Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-07060- MLL/DCE
Download: ML15218A300 (355)

Text

10 CFR 50.90aps Maria L. LacalVice President, NuclearPalo VerdeNuclear Generating StationP.O. Box 52034Phoenix, AZ 85072102-07060- MLL/DCE Mail Station 7605Tel 623 393 6491July 31, 2015ATTN: Document Control DeskU.S. Nuclear Regulatory CommissionWashington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)Units 1, 2, and 3Docket Nos. STN 50-528,59-529, and 50-530License Amendment Request to Revise Technical Specificationsto Adopt TSTF-505-A, Revision 1, Risk-Informed CompletionTimesIn accordance with the provisions of Section 50.90 of Title 10 of the Code of FederalRegulations (10 CFR), Arizona Public Service Company (APS) is submitting a requestfor a license amendment to revise the Technical Specifications (TSs) for Palo VerdeNuclear Generating Station Units 1, 2, and 3.The proposed amendment would modify TS requirements to permit the use of Risk-Informed Completion Times (RICTs) in accordance with Technical Specifications TaskForce (TSTF) traveler TSTF-505-A, Revision 1, Provide Risk-Informed ExtendedCompletion Times -RITSTF Initiative 4b. The availability of this TS improvement wasannounced in the Federal Register on March 15, 2012 (77 FR 15399).The Enclosure to this letter provides a description and assessment of the proposedchange, the requested confirmation of applicability, and plant-specific verifications.Attachment 1 provides the existing TS pages marked up to show the proposedchanges. Attachment 2 provides revised (clean) TS pages. Attachment 3 providesexisting TS Bases pages marked up to show the proposed changes.This submittal contains new regulatory commitments (as defined by NEI 99-04,Guidelines for Managing NRC Commitment Changes, Revision 0) to be implemented,which are identified in Attachment 4 of the Enclosure. Attachments 5 through 16 ofthe Enclosure provide probabilistic risk assessment information to support NRCreview of this license amendment request. APS requests approval of the proposedlicense amendment within one year of the date of this letter, with the amendmentbeing implemented within 180 days of issuance.In accordance with the PVNGS Quality Assurance Program, the Plant Review Boardand the Offsite Safety Review Committee have reviewed and approved the proposedA member of the STARS (Sfrategic Teaming and Resource Sharing) Alliance O ATT'N: Document Control DeskU.S. Nuclear Regulatory CommissionLicense Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A,Revision 1, Risk-Informed Completion TimesPage 2amendment. By copy of this letter, this license amendment request is beingforwarded to the Arizona Radiation Regulatory Agency pursuant to10 CFR 50.9 1(b)(1).Should you have any questions concerning the content of this letter, please contactThomas Weber, Department Leader, Nuclear Regulatory Affairs, at (623) 393-5764.I declare under penalty of perjury that the foregoing is true and correct.Executed on "7/3, 4/sl(Date)Sincerely,MLL/DCE/akf

Enclosure:

Description and Assessment of Proposed Amendment for Risk-Informed Completion Timescc: N. L. DapasM. M. WatfordC. A. PeabodyA. V. GodwinT. MoralesNRC Region IV Regional AdministratorNRC NRR Project ManagerNRC Senior Resident Inspector for PVNGSArizona Radiation Regulatory AgencyArizona Radiation Regulatory Agency EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable of Contents1.0 DESCRIPTION2.0 ASSESSMENT3.0 REGULATORY SAFETY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

ATTACHMENTS:1. Proposed Technical Specification Changes2. Revised Technical Specification Pages (Clean Copy)3. Technical Specification Bases Changes4. List of Regulatory Commitments5. List of Revised Required Actions to Corresponding Probabilistic Risk AssessmentFunctions6. Information Supporting Consistency with Regulatory Guide 1.200, Revision 27. Information Supporting Technical Adequacy of PRA Models without PRA StandardsEndorsed by Regulatory Guide 1.200, Revision 28. Information Supporting Justification of Excluding Sources of Risk Not Addressed by thePVNGS PRA Models9. Baseline Core Damage Frequency and Large Early Release Frequency10. Justification of Application of At-Power PRA Models to Shutdown Modes11. Probabilistic Risk Assessment Model Update Process12. Attributes of the Configuration Risk Management Program Model13. Key Assumptions and Sources of Uncertainty14. Program Implementation15. Monitoring Program16. Risk Management Action Examples EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times1.0 DESCRIPTIONIn accordance with the provisions of Section 50.90 of Title 10 of the Code of FederalRegulations (10 CFR), Arizona Public Service Company (APS) is submitting a request for alicense amendment to revise the Technical Specifications (TSs) for Palo Verde NuclearGenerating Station (PVNGS) Units 1, 2, and 3.The proposed amendment would modify TS requirements to permit the use of Risk-InformedCompletion Times (RICTs) in accordance with Technical Specifications Task Force (TSTF)traveler TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times -RITSTFInitiative 4b. The availability of the NRC model safety evaluation for TSTF-505-A wasannounced in the Federal Register on March 15, 2012 (77 FR 15399).The proposed amendment involves TS Completion Times (CTs) for Required Actions (RAs) toprovide the option to calculate a risk-informed CT (RICT). A new program, the Risk-InformedCompletion Time Program, is added to TS Section 5, Administrative Controls.The methodology for using the RICT Program is described in Nuclear Energy Institute (NEI) 06-09, Revision 0 -A, Risk-Informed Technical Specifications Initiative 4b, Risk-ManagedTechnical/Specifications (RMTS) Guidelines (NEI 06-09-A), which was found acceptable by theNRC on May 17, 2007, for use by licensees in license amendment proposals. Adherence to NEI06-09-A is required by the RICT Program and APS is not proposing any deviations from the NEIguidance.The proposed amendment is consistent with TSTF-505-A. However, only those RAs describedin Attachment 5 to this Enclosure are proposed to be changed. Attachment 5 does not includethe modified RAs in TSTF-505-A that were not applicable to PVNGS. The proposed amendmentalso incorporates two additional limiting conditions of operations (LCOs) that were not includedin TSTF-505-A. These are discussed in Section 2.3 of this Enclosure.This Enclosure provides a description and assessment of the proposed changes, the requestedconfirmation of applicability, and plant-specific verifications. Attachment 1 to this Enclosureprovides the existing TS pages marked up to show the proposed changes. Attachment 2provides revised (clean) TS pages. Attachment 3 provides existing TS Bases pages marked upto show the proposed changes. Attachments 4 through 16 provide descriptions of new regulatorycommitments, probabilistic risk assessment (PRA) information, and program information tosupport NRC review of this license amendment request (LAR). They are discussed further in theassessment below.2.0 ASSESSMENT2.1 Applicability of Published Safety EvaluationAPS reviewed the NRC model safety evaluation in TSTF-505-A, as well as the informationprovided to support TSTF-505-A and the safety evaluation for NEI 06-09-A. APS has concludedthat the technical basis presented in TSTF-505-A and the associated model safety evaluationprepared by the NRC staff are applicable to PVNGS Units 1, 2, and 3, and support incorporationof this amendment in the TS.1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times2.2 Verifications and Regulatory CommitmentsThe following is provided in accordance with Section 4.0 Limitations and Conditions of thesafety evaluation for NEI 06-09-A:Attachment 4 to this Enclosure lists the new APS regulatory commitments regardingplant-specific changes necessary to support implementation of TSTF-505-A.Attachment 5 to this Enclosure identifies each of the TS RAs to which the RIOT Programwill apply, with a comparison of the TS functions to the functions modeled in the PRA ofthe structures, systems and components (SS~s) subject to those actions.Attachment 6 to this Enclosure provides a discussion of the results of peer reviews andself-assessments conducted for the plant-specific PRA models which support the RIOTProgram, as required by Regulatory Guide (RG) 1.200, An Approach for Determining theTechnical Adequacy of Probabilistic Risk Assessment Results for Risk-InformedActivities, Revision 2, dated March 2009, Section 4.2.Attachment 7 to this Enclosure is a placeholder to retain the TSTF-505-A format sinceeach APS PRA model used for the RIOT Program is addressed using a standardendorsed by the NRC.Attachment 8 to this Enclosure provides appropriate justification for excluding sources ofrisk not addressed by the PRA models.Attachment 9 to this Enclosure provides the plant-specific baseline core damagefrequency (ODE) and large early release frequency (LERF) to confirm that the potentialrisk increases allowed under the RIOT Program are acceptable.Attachment 10 to this Enclosure is a placeholder to retain the TSTF-505-A format sinceeach APS PRA model used for the RIOT Program is addressed using a standardendorsed by the NRC.Attachment 11 to this Enclosure provides a discussion of the programs and proceduresthat assure the PRA models that support the RIOT Program are maintained consistentwith the as-built, as-operated plant.Attachment 12 to this Enclosure provides a description of how the baseline PRA model,which calculates average annual risk, is evaluated and modified for use in theConfiguration Risk Management Program (CRMP) to assess real-time configuration risk,and describes the scope of and quality controls applied to the CRMP.Attachment 13 to this Enclosure provides a discussion of how the key assumptions andsources of uncertainty in the PRA models were identified for this LAR, and how theirimpact on the RIOT Program was assessed and evaluated.Attachment 14 to this Enclosure provides a description of the implementing programsand procedures regarding the plant staff responsibilities for the RIOT Program, includingrisk management action (RMA) implementation.2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesAttachment 15 to this Enclosure provides a description of the monitoring program asdescribed in NEI 06-09-A, Section 2.3.2.Finally, Attachment 16 to this Enclosure provides a description of the process to identifyRMAs and includes specific examples of RMAs.2.3 Editorial Changes and VariationsAPS is proposing certain editorial changes and variations from the TSs described in TSTF-505-A, Revision 1, and applicable parts of the NRC model safety evaluation dated March 15, 2012.Differences between the PVNGS proposed LAR and TSTF-505-A and related justifications areprovided in Table 1, TSTF-505-A Reconciliation. In some instances, the PVNGS TSs usedifferent numbering (including RAs and programs) and titles than NUREG 1432, StandardTechnical Specifications, Combustion Engineering Plants, on which TSTF-505-A was based.These differences are administrative and do not affect the applicability of TSTF-505-A to thePVNGS TS. Due to plant-specific design differences, the PVNGS TSs do not contain all of theLCOs and conditions that are contained in TSTF-505-A. This LAR includes the LCOs fromTSTF 505-A which are applicable to PVNGS.TSTF-505-A states:"It is necessary to adopt TSTF-439, Eliminate Second Completion Times Limiting TimeFrom Discovery of Failure To Meet an LCO, in order to adopt TSTF 505 for thoseRequired Actions that are affected by both Travelers."APS previously submitted letter number 102-07002, License Amendment Request (LAR) forAdoption of Technical Specifications Task Force (TSTF) Traveler TSTF-439-A, Revision 2,Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO,dated February 27, 2015, to adopt TSTF-439-A, Revision 2 (Agencywide Document Access andManagement System [ADAMS] Accession Number ML15065A031).The LAR proposed removal of the second completion times from the following TS sections, asdescribed in TSTF-439-A:* TS 1.3, Completion Times* TS 3.7.5, Auxiliary Feedwater (AFW) System* TS 3.8.1, AC Sources -Operating* TS 3.8.9, Distribution Systems -OperatingAPS anticipates NRC approval of the TSTF-439-A LAR before NRC completion of the review ofthis TSTF-505-A LAR. The expected TSTF-439-A changes have been clearly marked andannotated on the marked-up TS and TS Bases pages in Attachments 1 and 3 of this Enclosure.The revised (clean) TS pages included in Attachment 2 of this Enclosure reflect the removal ofthe second completion times from the affected TSs.There are two plant-specific LCOs for which APS is proposing to apply the RICT Program thatare not within the scope of TSTF 505-A. These LCOs are variations as identified in Table 1 withadditional justification provided:3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times*TS 3.4.12, Pressurizer Vents. There is no pressurizer vent TS in NUREG 1432 or inTSTF 505-A. The PVNGS TS address the pressurizer vent lines and valves that can beused to depressurize and degas the reactor coolant system. The pressurizer vent valvesare remotely operated solenoid valves administratively controlled in the key-lockedclosed position to prevent inadvertent opening. There are two separate vent paths out ofthe pressurizer; one path has two solenoid isolation valves and the other has a singlesolenoid isolation valve and an orifice. Each of these two paths can be directed throughan additional solenoid operated valve to either the reactor drain tank or to containmentatmosphere directly, for a total of four vent paths. The pressurizer vent paths aremodeled in the PRA and credited in the PVNGS safety analysis for the steam generatortube rupture event as described in Updated Final Safety Analysis Report (UFSAR)Section 15.6.3. The pressurizer vent TS at PVNGS has similarities to the pressurizerpower-operated relief valves (PORVs) TS 3.4.11 addressed by TSTF-505-A. Althoughthe PVNGS design does not include PORVs, APS proposes to apply the RIOT Programto PVNGS TS LCO 3.4.12 for the pressurizer vents using TSTF-505-A RA 3.4.11 .B.3 asa guide.*TS 3.7.3, Main Feedwater Isolation Valves (MFIVs). The MFIV TS was not included inTSTF-505-A because the TS LCO conditions do not include restoration actions for aninoperable MFIV. APS proposes adding restoration actions to RA 3.7.3.A.1 (one or moreMFlIVs inoperable) and RA 3.7.3.B.1 (two valves in the same flow path inoperable) andincluding both in the RIOT Program. A description of the MFlIVs is included in UFSAR10.4.7. The MFlIVs are modeled in the PRA and credited in the safety analysis to closeduring a steam line break and a feedwater line break.4 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationiTEM #* TSTF LCO PVNGS LCO DESCRIPTION11.3 1.3 The changes described in the TSTF are incorporated.Completion Com pletionTimes Times2 3.3.4 3.3.4 The changes described in the TSTF are incorporated.Reactor ReactorProtective ProtectiveSystem (RPS) System (RPS)Logic and Trip Logic and TripInitiation (Digital) Initiation33.3.6 3.3.6 The changes described in the TSTF are incorporated with the following differences:Engineered Engineered ° EDITORIAL: TSTF 3.3.6.E states 'Two Actuation Logic channels inoperable." The PVNGSSafety Features Safety Features Condition statement states "One or more functions with two Actuation Logic channels inoperable."Actuation Actuation This is consistent with the NRC-approved PVNGS wording in Conditions A, B, and C.System System

• EDITORIAL: APS proposes to revise Required Action (RA) E.1 to read "Restore channel(s) to(ESFAS) Logic (ESFAS) Logic OPERABLE status" to clarify that at least one Actuation Logic channel must be restored toand Manual Trip and Manual Trip OPERABLE status.(Digital)43.4.9 3.4.9 The changes described in the TSTF are incorporated with the following difference:Pressurizer Pressurizer ° EDITORIAL: TSTF RA C.1 states "Restore [required group] of pressurizer heaters to OPERABLEstatus." PVNGS RA C.1 states "Restore at least one required group of pressurizer heaters toOPERABLE status." PVNGS added the phrase "at least one" to be precise in the action necessaryto exit the Condition.53.4.10 3.4.10 The changes described in the TSTF are incorporated.Pressurizer PressurizerSafety Valves Safety Valves -Modes 1, 2, and35 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION6 Not in TSTF 3.4.12 VARIATION: PVNGS has pressurizer vent valves to depressurize the reactor coolant system orPressurizer remove accumulated gases in the pressurizer. The pressurizer vent TS at PVNGS has similarities toVents the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed by TSTF-505-A. Althoughthe PVNGS design does not include PORVs, APS proposes to apply the RICT Program to PVNGS TSLCO 3.4.12 for the pressurizer vents using TSTF-505-A RA 3.4.11 .B.3 as a guide. APS proposes toapply the RICT Program to PVNGS restoration items RA 3.4.12.A.1 and 3.4.12.B.1 for the pressurizervents. The vent paths are modeled in the site-specific PRA and credited in the PVNGS safetyanalysis. APS also proposes to include a NOTE that states the Risk Informed Completion Time is not_____________applicable when the last vent path is intentionally made inoperable.3.5.1 3.5.1 The changes described in the TSTF are incorporated with the following differences:Safety Injection Safety InjectionTank (SIs) Tnks SI~s -* EDITORIAL: TSTF 3.5.1 .C.1 states "Restore SITs to OPERABLE status." PVNGS 3.5.1 .0.1 statesTanspSIe)ratnks (S~)"Restore all but one SIT to OPERABLE status." PVNGS added the phrase to be precise in theOpertingaction necessary to exit the Condition.* EDITORIAL: TSTF 3.5.1.0 states "Required Action and associated completion time [of Condition Aor B] not met." PVNGS 3.5.1 .0 states "Required Action and associated completion time ofCondition A, B, or C not met." The TSTF added Condition C so PVNGS TS Condition D is wordedsuch that Conditions A, B, and C are addressed in the restoration condition.*EDITORIAL: The TSTF Bases state that Condition E regarding entry into LCO 3.0.3 is onlyapplicable to plants that have not adopted a RICT Program. Therefore, APS proposes to delete theexisting corresponding PVNGS Condition D.*EDITORIAL: The logical connector "OR" in PVNGS TS Condition A was adjusted to be properly_____________aligned.83.5.2 3.5.3 The changes described in the TSTF are incorporated with the following difference:OeCCtin EOpeatn

• VARIATION: PVNGS proposes to delete the following words from TS Condition B "AND At leastOpertingOperting100% of the ECCS flow equivalent to a single OPERABLE ECCS train available." The deletion ofthese words from Condition B is being done in order to adopt both the TSTF 505 text and to beconsistent with NUREG 1432. TSTF 505 Condition 3.5.2.C and proposed PVNGS Condition3.5.3.C will address the condition for "less than 100% of the ECCS flow equivalent to a singleOPERABLE ECCS train" so it is not required to have the wording in PVNGS TS Condition 3.5.3Condition B to require at least 100% of the flow equivalent to a single OPERABLE ECCS train.6 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION9 3.5.4 3.5.5 The changes described in the TSTF are incorporated.Refueling Water Refueling WaterTank (RWT) Tank (RWT)10 3.6.2 3.6.2 The changes described in the TSTF are incorporated.Containment Air Containment AirLocks Locks(Atmosphericand Dual)____________________________________________11 3.6.3 3.6.3 The changes described in the TSTF are incorporated.Containment ContainmentIsolation Valves Isolation Valves(Atmosphericand Dual)______________________________________________12 3.6.6A 3.6.6 The changes described in the TSTF are incorporated with the following differences:Containment Containment

• EDITORIAL: PVNGS TS do not have TSTF Conditions C, D, or E because there is no containmentSpray and Spray System cooling system that operates in conjunction with the containment spray system at PVNGS. PVNGSCooling proposes adopting TSTF Condition F as PVNGS Condition C modified to properly reflect theSystems PVNGS design.(Atmospheric

• EDITORIAL: PVNGS proposes deleting existing TS Condition C regarding entry into LCO 3.0.3 andand Dual) adopting TSTF/NUREG-1432 Condition G as new PVNGS Condition D.*EDITORIAL: TSTF RA F.1 states containment spray trains are to be restored to OPERABLEstatus. PVNGS RA C.1 is revised to read "Restore at least one containment spray train toOPERABLE status." APS used the phrase "at least one" to be precise in the action necessary toexit the Condition.13 3.7.2 3.7.2 The changes described in the TSTF are incorporated with the following differences, primarily inMain Steam Main Steam numbering sequence resulting from changes approved in TS Amendment 163:Isolation Valves Isolation Valves

• EDITORIAL: PVNGS proposes adopting TSTF Condition A as PVNGS Condition F.(MSIVs) (MSIVs)

• EDITORIAL: PVNGS proposes adopting TSTF Condition C as new PVNGS Condition G.* EDITORIAL: TSTF RA C.1 states "Restore MSIVs to OPERABLE status." PVNGS TS 3.7.2 RA G.1is revised to read "Restore all but one MSIV to OPERABLE status." APS used the phrase "all butone" to be precise in the action necessary to exit the condition.7 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION14 Not in TSTF 3.7.3 VARIATION: TSTF 505 has a comment stating that Conditions A and B do not specify a restorationMain Feedwater action and Condition C is a default Condition, thus the LCO conditions were excluded. APS proposesIsolation Valves to add restoration actions to plant-specific PVNGS TS 3.7.3 RA A.1 for one or more MFIVs inoperable(MFIVs) and RA B.1 for two valves in the same flow path inoperable, with a RICT applied to each. Each RA willhave an alternative (using the logical connector OR) action of isolating AND verifying the MFIV(s)closed or isolated. APS believes this is acceptable because the TSTF states that there may also beplant-specific TS to which changes of the type presented in the TSTF may be applied.15 3.7.4 3.7.4 The changes described in the TSTF are incorporated with the following difference:Atmospheric Atmospheric = VARIATION: PVNGS proposes adding a NOTE in Condition B that states "Risk-InformedDump Valves Dump Valves Completion Time not applicable when all ADVs intentionally made inoperable." This reflects the(ADVs) (ADVs) intent of the TSTF to ensure the RICT is not used for situations that represent a loss of safetyfunction due to planned maintenance and reflects the existing NOTE in PVNGS TS Bases3.7.4.B.1. The PVNGS design retains the ADV safety function with one ADV OPERABLE.16 3.7.5 3.7.5 The changes described in the TSTF are incorporated with the following difference:Auxiliary Auxiliary

• EDITORIAL: PVNGS proposes to delete the second part of revised PVNGS TS Condition DFeedwater Feedwater (existing PVNGS TS Condition C) after the OR clause that reads "Two AFW trains inoperable in(AFW) System (AFW) System MODES 1, 2, or 3." TSTF 505 adds the same condition as new PVNGS TS Condition C. Thischange makes the PVNGS TS consistent with NUREG 1432 and facilitates the incorporation ofTSTF 505.17 3.7.6 3.7.6 The changes described in the TSTF are incorporated with the following differences:Condensate Condensate

• VARIATION: PVNGS proposes to change the PVNGS LCO from "The CST level shall be > 29.5 ft"Storage Tank Storage Tank to read "The CST shall be OPERABLE." This change is consistent with TSTF-505 and NUREG(CST) (CST) 1432. The change revises the LCO wording to directly address the requirement for the CST to beOPERABLE rather than a limited requirement for CST level. CST level is governed by the samelimit described in TS surveillance requirement 3.7.6.1 which states "Verify CST level is > 29.5 ft."* VARIATION: PVNGS proposes to change Condition A from "CST level not within limit" to read"CST inoperable." This change is needed so that the condition matches the LCO requirement.* VARIATION: PVNGS proposes to change RA A.2 from "Restore CST levelto within limit" to read"Restore CST to OPERABLE status." This change is needed for the RA to match the condition.8 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION18 3.7.7 3.7.7 The changes described in the TSTF are incorporated with the following differences:Component Essential

• EDITORIAL: For this TS, PVNGS uses the terminology "EW" rather than "CCW" as in the TSTF.Coolng Wter oolig Waer

• VARIATION: PVNGS proposes adding a NOTE to TSTF Condition B that reads "Not applicable(CCW) System (EW) System when second EW train intentionally made inoperable." This reflects the intent of the TSTF to ensurethe RiCT is not used for situations that represent a loss of safety function due to plannedmaintenance.19 Water8Esentia Spa DT ORIcaL:e Fosribdi this TSTPVN reusesrthe aterm winoog the" ratherothng diWff asinehcSTFervceWter E3.7.ia They chIORAnge desribdi thes TSTFPNG ares incoportedrwithog the" followin difernce:"sinteSFSytm(SWS) Pond System(ES PS)20 3.7.9 3.7.9 The changes described in the TSTF are incorporated with the following difference:Ultimate Heat Ultimate Heat

• VARIATION: The design for PVNGS uses spray ponds as the UHS with spray nozzles for theSink (UHS) Sink (UHS) method to dissipate heat as opposed to natural bodies of water with cooling towers or otherdesigns. PVNGS existing TS 3.7.9 has only one condition (UHS inoperable) for which the RA is toshut down without a required action to restore the UHS. APS proposes adding a Conditionrequiring restoration of the UHS to an OPERABLE status within one hour or in accordance with theRICT Program in order to be consistent with TSTF 505-A. The wording of the TSTF Condition Cwas revised to delete "for reasons other than Conditions A or B" since TSTF Condition A and B arenot applicable to PVNGS. The revised PVNGS Condition A reads "UHS INOPERABLE." The NOTEabove Condition A reads "Risk informed Completion Time not applicable when UHS intentionallymade inoperable." The RA and Completion time for Condition A are consistent with TSTF 505-A.21 3.7.10 3.7.10 The changes described in the TSTF are incorporated with the following difference:Essential Chilled Essential Chilled

• EDITORIAL: For this TS, PVNGS uses the terminology "EC" rather than "ECW" as in the TSTF.Water (ECW) Water (EC)System22 3.7.12 3.7.12 The changes described in the TSTF are incorporated with the following difference:Control Room Control Room

• EDITORIAL: The TSTF Bases state that TSTF Condition F regarding entry into LCO 3.0.3 is onlyEmergency Air Emergency Air applicable to plants that have not adopted a RICT Program. Therefore, APS proposes to deleteTemperature Temperature existing PVNGS Condition F, which is the same as TSTF Condition F, and add the condition for twoControl System Control System CREATCS trains inoperable into PVNGS TS as Condition B.(CREATCS) (CREATCS)9 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION23 3.8.1 3.8.1 The changes described in the TSTF are incorporated with the following differences:AC Sources -AC Sources -.EDITORIAL: APS proposes to revise RA G.1 to read "Restore required AC source(s) toOperating Operating OPERABLE status" to clarify that at least one required AC source must be restored to OPERABLEstatus.*EDITORIAL: The TSTF Bases state that Condition I regarding entry into LCO 3.0.3 is onlyapplicable to plants that have not adopted a RICT Program. Therefore, APS proposes to deleteexisting PVNGS Condition I, which is the same as TSTF Condition I, and add the condition forthree or more required AC sources inoperable into PVNGS TS as Condition G.24 3.8.4 3.8.4 The changes described in the TSTF are incorporated with the following difference:DC Sources -DC Sources -* EDITORIAL: PVNGS TS do not include TSTF Condition B, as approved in PVNGS LicenseOperating Operating Amendment number 193 that adopted TSTF-500.25 3.8.7 3.8.7 The changes described in the TSTF are incorporated with the following differences:Inverters -Inverters -* VARIATION: TSTF Condition B includes a NOTE that states "Not applicable when two or moreOperating Operating [required] inverters intentionally made inoperable." PVNGS proposes rewording the NOTE to read"Not applicable when two or more required inverters intentionally made inoperable resulting in lossof safety function." This reflects the PVNGS design which differs from the TSTF. PVNGS has twoinverters per train, thus two inverters inoperable in the same train do not represent a loss of safetyfunction because the other train remains operable.* EDITORIAL: TSTF RA B.1 states "Restore inverters to OPERABLE status." PVNGS RA B.1 isproposed to state "Restore all but one inverter to OPERABLE status." PVNGS added the phrase"all but one" to be precise in the action necessary to exit the Condition.10 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable 1 -TSTF-505-A ReconciliationITEM # TSTF LCO PVNGS LCO DESCRIPTION26 3.8.9 3.8.9 The changes described in the TSTF are incorporated with the following differences:Distribution Distribution

• VARIATION: The TSTF Conditions A, B and C state "one or more" while the PVNGS ConditionsSystems -Systems -state only "one" with respect to the number of electrical power distribution system being inoperableOperating Operating for the respective conditions. These differences are reflected in the RAs as well. This is acceptabledue to the PVNGS specific licensing bases that approved this wording in TS Amendment number117.* VARIATION: APS proposes to not adopt the clause in new TSTF Condition D ". ..that results in aloss of safety function" because the new action applies when more than one electrical powerdistribution subsystem is inoperable without linking the condition to the loss of safety function. Thisis consistent with the wording of Conditions A, B and C.* EDITORIAL: APS proposes to revise RA D.1 to read "Restore electrical power distributionsubsystem(s) to OPERABLE status" to clarify that at least one electrical power distributionsubsystem must be restored to OPERABLE status.* EDITORIAL: The TSTF Bases state that Condition F regarding entry into LCO 3.0.3 is onlyapplicable to plants that have not adopted a RICT Program. Therefore, APS proposes to deleteexisting PVNGS Condition E, which is the same as TSTF Condition F and add the condition for twoor more electrical power distribution subsystems inoperable into PVNGS TS as Condition D.* EDITORIAL: The NOTE for PVNGS new Condition D adds the phrase "resulting in loss of safetyfunction." This is needed since PVNGS Conditions A, B and C are only applicable to one electricalpower distribution subsystem, respectively. There could be instances where two electrical powerdistribution subsystems are made inoperable without having a loss of safety function.27 5.5.18 5.5.20 The changes described in the TSTF are incorporated with the following difference:Risk-Informed Risk-Informed

• EDITORIAL: NEI 06-09 (Revision 0)-A is applicable rather than NEI 06-09, Revision 0.Comnpletion ComnpletionTime Program Time Program11 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times3.0 REGULATORY SAFETY ANALYSISArizona Public Service Company (APS) has evaluated the proposed change to the TechnicalSpecifications (TSs) using the criteria in 10 CFR 50.92 and has determined that the proposedchange does not involve a significant hazards consideration.APS requests adoption of an NRC accepted change to the Standard TSs and plant specific TS,to modify the TS requirements related to Completion Times (CTs) for Required Actions (RAs) toprovide the option to calculate risk-informed CTs based on risk levels associated withequipment determined to be inoperable that are within the scope of the Risk-InformedCompletion Time (RICT) Program. The allowance is described in a new program in Chapter 5,Administrative Controls, entitled the Risk-Informed Completion Time Program. The proposedRICT program conforms to the NRC model safety evaluation, Final Safety Evaluation forNuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(Agencywide Documents Access and Management System (ADAMS) Accession No.,ML071 200238), dated May 17, 2007.The proposed license amendment includes regulatory commitments to achieve the baselinePRA risk metrics specified in the NRC model evaluation by design changes or compensatorymeasures. The design changes proposed by regulatory commitments will be implementedunder the requirements of 10 CFR 50.59 and will not require prior NRC approval.As required by 10 CFR 50.91 (a), Notice for Public Comment, an analysis of the issue of nosignificant hazards consideration is presented below:1. Does the proposed change involve a significant increase in the probability or consequencesof an accident previously evaluated?Response: No.The proposed change permits the use of RICTs provided the associated risk is assessedand managed in accordance with the NRC-accepted RICT Program. The proposed useof RICTs does not involve a significant increase in the probability of an accidentpreviously evaluated because the change only affects TS Conditions, Required Actionsand CTs associated with risk informed technical specifications and does not involvechanges to the plant, its modes of operation, or TS mode applicability. The proposedlicense amendment references regulatory commitments to achieve the baseline PRArisk metrics specified in the NRC model evaluation. The changes proposed by regulatorycommitments will be implemented under the requirements of 10 CFR 50.59 without theneed for prior NRC approval. The proposed change does not increase theconsequences of an accident because the accident mitigation functions of the affectedsystems, structures, or components (SSCs) are not changed.Therefore, the proposed change does not involve a significant increase in the probabilityor consequences of an accident previously evaluated.2. Does the proposed change create the possibility or different kind of accident from anyaccident previously evaluated?12 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesResponse: No.The proposed change permits the use of RICTs provided the associated risk is assessedand managed in accordance with the NRC-accepted RIOT Program. The proposed useof RIOTs does not create the possibility of a new or different kind of accident from anyaccident previously evaluated because the change only affects TS Conditions, RequiredActions and OTs associated with risk informed technical specifications. The proposedchange does not involve a physical alteration of the plant and does not involveinstallation of new or different kind of equipment. The proposed license amendmentreferences regulatory commitments to achieve the baseline PRA risk metrics specified inthe NRC model evaluation. The changes proposed by regulatory commitments will beimplemented under the requirements of 10 CER 50.59 without the need for prior NRCapproval. The proposed change does not alter the accident mitigation functions of theaffected SSCs and does not introduce new or different SSC failure modes than alreadyevaluated.Therefore, the proposed change does not create the possibility of a new or different kindof accident from any accident previously evaluated.3. Does the proposed change involve a significant reduction in a margin of safety?Response: No.The proposed change permits the use of RIOTs provided the risk levels associated withinoperable equipment within the scope of the RIOT program are assessed and managedin accordance with the NRC approved RIOT Program. The proposed change implementsa risk-informed Configuration Risk Management Program (CRMP) to assure thatadequate margins of safety are maintained. Application of these new specifications andthe CRMP considers cumulative effects of multiple systems or components being out ofservice and does so more effectively than the current TS. In this regard, theimplementation of the CRMP is considered an improvement in safety.Therefore, the proposed change does not involve a significant reduction in a margin ofsafety.Based on the above, APS concludes that the proposed change presents no significant hazardsconsiderations under the standards set forth in 10 CER 50.92(c), Issuance of amendment, and,accordingly, a finding of "no significant hazards consideration" is justified.

4.0 ENVIRONMENTAL CONSIDERATION

APS has reviewed the environmental evaluation included in the model safety evaluationpublished on March 15, 2012, as part of the Notice of Availability (77 FR 15399). APS hasconcluded that the NRC staff findings presented in that evaluation are applicable to PVNGSUnits 1, 2, and 3.The proposed change would change a requirement with respect to installation or use of a facilitycomponent located within the restricted area, as defined in 10 CER 20, Standards for Protection13 EnclosureDescription and Assessment of Proposed Amendment for Risk-informed Completion TimesAgainst Radiation, or would change an inspection or surveillance requirement. However, theproposed change does not involve (i) a significant hazards consideration, (ii) a significantchange in the types or significant increase in the amounts of any effluents that may be releasedoffsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.Accordingly, the proposed change meets the eligibility criterion for categorical exclusion setforth in 10 CFR 51.22, Criterion for categorical exclusion; identification of licensing andregulatory actions eligible for categorical exclusion or otherwise not requiring environmentalreview. Therefore, pursuant to 10 CFR 51.22, no environmental impact statement orenvironmental assessment need be prepared in connection with the proposed change.14 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHM ENT 1Proposed Technical Specification ChangesTS Mark-up Pages1.3-133.3.4-13.3.6-13.3.6-23.3.6-33.4.9-13.4.9-23.4.10-13.4.12-13.5.1-13.5.3-13.5.5-13.6.2-33.6.3-13.6.3-23.6.3-33.6.3-43.6.6-13.7.2-23.7.3-13.7.4-13.7.5-13.7.5-23.7.6-13.7.7-13.7.8-13.7.9-13.7.10-13.7.12-13.7.12-23.8.1-23.8.1-33.8.1-43.8.1-53.8.4-13.8.7-13.8.7-23.8.9-13.8.9-25.5-19 Compl eti onTimes1.31.3 Completion TimesEXAMPLESEXAMPLE 1.3-7(continued)The Completion Time clock for Condition A does not stopafter Condition B is entered, but continues from the timeCondition A was initially entered. If Required Action A.1is met after Condition B is entered, Condition B is exitedand operation may continue in accordance with Condition A,provided the Completion Time for Required Action A.2 has notInsert red.IMMEDIATECOMPLETION TIMEWhen "Immediately" is used as a Completion Time, theRequired Action should be pursued without delay and in acontrol led manner.PALO VERDE UNITS 1,2,3 131 MNMN O 41.3-13AMENDMENT NO.

INSERT for page 1.3-13EXAMPLE 1.3-8ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One subsystem A.1 Restore subsystem 7 daysinoperable, to OPERABLEstatus. ORIn accordance with theRisk Informed CompletionTime ProgramB. ---- NOTE ...B.1 Restore subsystems 1 hourNot applicable to OPERABLEwhen second status. ORsubsystemintentionally made In accordance with theinoperable. Risk Informed CompletionTime ProgramTwo subsystemsinoperable.C. Required Action C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sand associatedCompletion Time ANDnot met._____________C.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sWhen a subsystem is declared inoperable, Condition A is entered. The 7 dayCompletion Time may be applied as discussed in Example 1.3-2. However, thelicensee may elect to apply the Risk Informed Completion Time Program whichpermits calculation of a Risk Informed Completion Time (RICT) that may be usedto complete the Required Action beyond the 7 day Completion Time. The RICTcannot exceed 30 days. After the 7 day Completion Time has expired, thePage 1of 2 Insert for page 1.3-13 (continued)subsystem must be restored to OPERABLE status within the RICT or ConditionC must also be entered.If a second subsystem is declared inoperable, Condition B may also be entered.The Condition is modified by a Note stating it is not applicable if the secondsubsystem is intentionally made inoperable. The Required Actions of ConditionB are not intended for voluntary removal of redundant subsystems from service.The Required Action is only applicable if one subsystem is inoperable for anyreason and the second subsystem is found to be inoperable, or if bothsubsystems are found to be inoperable at the same time. If Condition B isapplicable, at least one subsystem must be restored to OPERABLE status within1 hour or Condition C must also be entered. The licensee may be able to apply aRICT to extend the Completion Time beyond 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> if the requirements of theRisk Informed Completion Time Program are met. If two subsystems areinoperable and Condition B is not applicable (i.e., the second subsystem wasintentionally made inoperable), LCO 3.0.3 is entered as there is no applicableCondition.The Risk Informed Completion Time Program requires recalculation of the RICTto reflect changing plant conditions. For planned changes, the revised RICTmust be determined prior to implementation of the change in configuration. Foremergent conditions, the revised RICT must be determined within the time limitsof the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after theplant configuration change, whichever is less.If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Timeclock of Condition B have expired and subsequent changes in plant conditionresult in exiting the applicability of the Risk Informed Completion Time Programwithout restoring the inoperable subsystem to OPERABLE status, Condition C isalso entered and the Completion Time clocks for Required Actions C.1 and C.2start.If the RICT expires or is recalculated to be less than the elapsed time since theCondition was entered and the inoperable subsystem has not been restored toOPERABLE status, Condition C is also entered and the Completion Time clocksfor Required Actions C.1 and C.2 start. If the inoperable subsystems arerestored to OPERABLE status after Condition C is entered, Conditions A, B, andC are exited, and therefore, the Required Actions of Condition C may beterminated.Page 2of 2 RPS Logic and TripIni ti ati on3.3.43.3 INSTRUMENTATION3.3.4 Reactor Protective System (RPS) Logic and Trip InitiationLCO 3.3.4Six channels of RPS Matrix Logic, four channels of RPSInitiation Logic, four channels of reactor trip circuitbreakers (RTCBs), and four channels of Manual Trip shall beOPERABLE.APPLICABILITY:MODES 1 and 2,MODES 3, 4, and 5, with any RTCBs closedelement assemblies capable of beingand any controlwithdrawn.ACTIONSCONDITION ] REQUIRED ACTION] COMPLETION TIMEA. One Matrix Logicchannel inoperable.ORThree Matrix Logicchannel s i noperabl edue to a common powersource failurede-energi zi ng threematrix power suppl ies.A.1 Restore channel toOPERABLE status.48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />s< RICT Insert(conti nued)Reviewers Note:The "RIOT Insert" is used repeatedlythroughout this package. The insert willnot be provided as a separate page everytime it is used. This will be the only timethe insert page will follow the marked-upTS page.PALO VERDE UNITS 1,2,3334-AMNETNO -73.3.4-1AMENDMENT NO.

RICT InsertO__RIn accordance withthe Risk InformedCompletion TimeProgram

[SFAS Logic and Manual Trip3.3.63.3 INSTRUMENTATION3.3.6 Engineered Safety Features Actuation System (ESFAS) Logic andManual TripLCO 3.3.6APPLICABILITY:Six channels of ESFAS Matrix Logic, four channels of ESFASInitiation Logic, two channels of Actuation Logic, and fourchannels of Manual Trip shall be OPERABLE for each Functionin Table 3.3.6-1.According to Table 3.3.6-1.ACTIONS----------------~~NOTE-------------Separate Condition entry is allowed for each Function.CONDITION JREQUIRED ACTION COMPLETION TIMEA. One or more Functionswith one Matrix Logicchannel inoperable.ORThree Matrix Logicchannels areinoperable due to acommon power sourcefailure de-energizingthree matrix powersupplies.A.1Restore channel toOPERABLE status.48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />sB. One or more Functions B.1 Restore channel to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />swith one Manual Trip OPERABLE status.or Ini ti ati on Logi c -RC netchannel inoperable.(continued)PALO VERDE UNITS 1,2,3 3361AEDETN.4.3.3.6-1AMENDMENT NO.

ESFAS Logic and Manual Trip3.3.6ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. One or more Functions C.1 Open at least one Immediatelywith two Initiation contact in theLogic channels or affected trip leg ofManual Trip channels both ESFAS Actuationaffecting the same Logics.trip leg inoperable. ANDC.2 Restore channels to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />sOPERABLE status. <- RC netD. One or more Functions D.1------NOTE----with one Actuation One channel ofLogic channel Actuation Logic mayinoperable, be bypassed for up to1 hour forSurvei 11 Iances,provided the otherchannel is OPERABLE.Restore ino~perab.e 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />sInsertchannel to OPERABLEj~ nsr I[ status. <- RIOT InsertIRequi red Action andassoci ated Compl eti onTime of Conditions forContainment SprayActuation Signal, MainSteam Isol ati on Signalor Auxi li ary FeedwaterActuation Signal notmet.4.1ANDBe in MODE 3.Be in MODE 4.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s12 hours(conti nued)PALO VERDE UNITS 1,2,33..- MNMN O 43.3.6-2AMENDMENT NO.

Insert for page 3.3.6-2E.-----NOTE- --Not applicable whensecond Actuation Logicchannel intentionallymade inoperable.E.1Restore channel(s) toOPERABLE status.1 hourO._RIn accordance withthe Risk InformedCompletion TimeProgramOne or more functionswith two Actuation Logicchannels inoperable.

ESFAS Logic and Manual Trip3.3.6ACTIONS (continued)CONDITION _ZREQUIRED ACTION] COMPLETION TIME.Required Action and Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sf associ ated Compl eti on ANDTime of Conditions forSafety InjectionActuation Signal, .2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sContainment Isol ati onActuation Signal, or0Reci rcul ati onActuation Signal notmet.SURVEILLANCE REQUIREMENTSSURVE ILLANCE FREQUENCYSR 3.3.6.1----------NOTE-- ------Testing of Actuation Logic shallI includethe verification of the proper operation ofeach i ni tiati on relay.Perform a CHANNEL FUNCTIONAL TEST on each In accordanceESFAS logic channel and Manual Trip with thechannel. Surveill anceFrequencyControl ProgramSR 3.3.6.2----------NOTE-- ------Relays exempt from testing during operationshall be tested in accordance with theSurveilIlance Frequency Control Program.Perform a subgroup relay test of each In accordanceActuation Logic channel, which includes the with thede-energization of each subgroup relay and Surveillanceverification of the OPERABILITY of each Frequencysubgroup relay. Control ProgramPALO VERDE UNITS 1,2,33.3.6-3PALO ERDEUNIT 1,23 3..6-3AMENDMENT NO. 94 Pressurizer3.4.93.4 REACTOR COOLANT SYSTEM (RCS)3.4.9 PressurizerLCO 3.4.9The pressurizer shall be OPERABLE with:a. Pressurizer water level 27% and 56%; andb. Two groups of pressurizer heaters OPERABLE with thecapacity of each group 125 kW.APPLICABILITY:MODES 1, 2, and 3.-~~~~~NOTE----------The pressurizer water level limit does not apply during:a°b.THERMAL POWER ramp > 5% RTP per minute; orTHERMAL POWER step > 10% RTP.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. Pressurizer water A.1 Be in MODE 3 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />slevel not within with reactorlimit. trip breakersopen.ANDA.2 Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sB. One required group ofpressurizer heatersinoperable.B.1Restore requiredgroup of pressurizerheaters to OPERABLEstatus.72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />(conti nued)InsertPALO VERDE UNITS 1,2,3 3491AEDETN.4.-63.4.9-1AMENDMENT NO. !17, !6<

Insert for page 3.4.9-1C.----NOTE- --Not applicable whensecond group ofrequired pressurizerheaters intentionallymade inoperable.Two required groups ofpressurizer heatersinoperable.0. 1 Restore at least onerequired group ofpressurizer heaters toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgram Pressurizer3.4.9ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMERquired Action and .1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion ANDTime of Condition BA not met. ;.2 Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />soDSURVEILLANCEREQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.4.9.1 Verify pressurizer water level is 27% and In accordance<56% with theSurveillanceFrequencyControl ProgramSR 3.4.9.2 Verify capacity of each required group of In accordancepressurizer heaters 125 kW. with theSurveil11anceFrequencyControl ProgramPALO VERDE UNITS 1,2,33492AMNETNO --4g3.4.9-2AMENDMENT NO. !!7, 188 Pressurizer Safety Valves-MODES 1, 2, and 33.4.103.4 REACTOR COOLANT SYSTEM (RCS)3.4.10 Pressurizer Safety Valves -Modes 1, 2 and 3LCO 3.4.10APPLICABILITY:Four pressurizer safety valves shall be OPERABLE with liftsettings 2450.25 psia and 2549.25 psia.MODES 1, 2, and 3,~~~~~~~-NOTE------------The lift settings are not required to be within LCO limitsduring MODES 3 and 4 for the purpose of setting thepressurizer safety valves under ambient (hot) conditions.This exception is allowed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following entry intoMODE 3 provided a preliminary cold setting was made prior toheatup.ACTIONSCONDITION JREQUIRED ACTION COMPLETION TIMEA. One pressurizer safetyvalve inoperable.A. 1Restore valve toOPERABLE status.15 minutesB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDOR B.2 Be in MODE 4 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sTwo or morepressurizer safetyvalves inoperable.PALO VERDE UNITS 1,2,3 3..1- MNMN O 43.4.10-1AMENDMENT NO.

Pressurizer Vents3.4.123.4 REACTOR COOLANT SYSTEM (RCS)3.4.12 Pressurizer VentsLCO 3.4.12APPLICABILITY:Four pressurizer vent paths shall be OPERABLE.MODES 1, 2, and 3.MODE 4 with RCS pressure 385 psia.ACTIONSCONDITION [REQUIRED ACTION! COMPLETION TIMEA. Two or three requiredpressurizer vent pathsinoperable.A.1Restore requiredpressurizer ventpaths to OPERABLEstatus.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sB. Al pres izer vent B.1 Restore one6horpaths io rable. pressurizer vent pathto OPERABLE status.<C. Required and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Comp etion ANTime of A, ANor B not met. \ C.2 Be in MODE 4 with RCS 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />spressure < 385 psia.\-..NOTE-----.Risk InformedCompletion Time notapplicable when lastvent path intentionallymade inoperable.PALO VERDE UNITS 1,2,334.21AEDNT O. ----83.4.12-1AMENDMENT NO. 117, 189 SITs -Operating3.5.13.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.1 Safety Injection Tanks (SITs) -OperatingLCO 3.5.1Four SITs shall be OPERABLE.APPLICABILITY:MODES 1 and 2,MODES 3 and 4 withpressurizer pressure 1831 psia.ACTIONSCONDITION ] REQUIRED ACTION COMPLETION TIMEA. One SIT inoperable dueto boron concentrationnot within limits.m- OOne SIT inoperable dueto inability to verifylevel or pressure.A.1Restore SIT toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sSRICT InsertB. One SIT inoperable for B.1 Restore SIT to 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sreasons other than OPERABLE status.ConditionA DRequired Action andassoci ated Compileti onTime of Condition A0Fgnot met.g. iAND2Be in MODE 3.Reduce pressurizerpressure to<1837 psia.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s12 hoursI, B, or Q. T,,o or marc STTz -4 EncTC ... PALO VERDE UNITS 1,2,33511AMNETNO3.5.1-1AMENDMENT NO. 117, 118 Insert for page 3.5.1-1C. -- --NOTE---..Not applicablewhen two or moreSITs intentionallymade inoperable.Two or more SITsinoperable.0.1 Restore all but oneSIT to OPERABLEstatus.1 hourO._RIn accordance withthe Risk InformedCompletion TimeProgram EGGS -Operating3.5.33.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.3 ECCS -OperatingLCO 3.5.3APPLICABILITY:Two ECCS trains shall be OPERABLE.MODES 1 and 2,MODE 3 with pressurizer pressure 1831 psia or withRCS Tc > 485°F.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One LPSI subsysteminoperable.A.1Restore subsystem toOPERABLE status.7 daysB. One or more trainsinoperable for reasonsother than ConditionA.AND-At lcast 100% of thcB.1Restore train(s) toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sto a zing OPEPRBLEJ~tC. red ActNion andassoci ated Compl eti onTime not met.N1ANDAND3Be in MODE 3.Reduce pressurizerpressure to< 1837 psia.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s12 hours12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sReduce RCS<485° F.Tc toPALO VERDE UNITS 1,2,33.5.3-1PAL VRDEUNTS ,23 35.-1AMENDMENT NO. 117,--!24 Insert for page 3.5.3-1Not applicablewhen second ECCStrain intentionallymade inoperable.Less than 100% ofthe ECCS flowequivalent to asingle OPERABLEtrain available.C.1 Restore ECCS flowequivalent to 100% ofa single OPERABLEtrain.1 hourORIn accordance withthe Risk InformedCompletion TimeProgram RWT3.5.53.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.5 Refueling Water Tank (RWT)LCO 3.5.5APPLICABILITY:The RWT shall be OPERABLE.MODES 1, 2, 3, and 4.ACTI ONSCONDITION REQUIRED ACTION JCOMPLETION TIMEA. RWT boronconcentrati on notwithin limits.ORA.1Restore RWT toOPERABLE status.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sRICT InsertIRWFT boratedtemperaturelimits.waternot withinB. RWT inoperable for B.1 Restore RWT to 1 hourreasons other than OPERABLE status.Condition A.C. Required Action and C.I Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion ANTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,3355-AMNETNO413.5.5-1AMENDMENT NO.

Containment AirLocks3.6.2ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEB. (continued) B.1 Verify an OPERABLE 1 hourdoor is closed in theaffected air lock.ANDB.2 Lock an OPERABLE door 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sclosed in theaffected air lock.ANDB.3------NOTE----Air lock doors inhigh radiation areasmay be verifiedlocked closed byadministrative means.Verify an OPERABLE Once per 31 daysdoor is locked closedin the affected airlock.C. One or morecontainment air locksinoperable for reasonsother than Condition Aor B.C.1ANDC.2Initiate action toevaluate overallcontainment leakagerate per LCO 3.6.1.Verify a door isclosed in theaffected air lock.Restore air lock toOPERABLE status.Immedi ately1 hourANDC.324 hours0.00375 days <br />0.09 hours <br />5.357143e-4 weeks <br />1.23282e-4 months <br />(conti nued)PALO VERDE UNITS 1,2,3 3623AEDETN.h-3.6.2-3AMENDMENT NO.

Containment Isol ati onValves3.6.33.6 CONTAINMENT SYSTEMS3.6.3 Containment Isolation ValvesLCO 3.6.3APPLICABILITY:Each required containment isolation valve shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS----------------~~-NOTES--------------1. Penetration flow paths except for 42 inch purge valve penetration flowpaths may be unisolated intermittently under administrative controls.2. Separate Condition entry is allowed for each penetration flow path.3. Enter applicable Conditions and Required Actions for system(s) madeinoperable by containment isolation valves.4. Enter applicable Conditions and Required Actions of LCO 3.6.1,"Containment," when leakage results in exceeding the overall containmentleakage rate acceptance criteria.5. A 42 inch refueling purge valve is not a required containment isolationvalve when its flow path is isolated with a blind flange tested inaccordance with SR 3.6.1.1.CONDITION REQUIRED ACTION ] COMPLETION TIMEA.------NOTE- --Only appl icable topenetration flow pathswith two requiredcontai nment i sol ati onvalves.One or morepenetration flow pathswith one requi redcontainment i sol ati onvalve i noperabl eexcept for purge valveleakage not withinlimit.A.1Isolate the affectedpenetration flow pathby use of at leastone closed andde- acti vatedautomatic val ve,closed manual valve,bl ind flange, orcheck valve with flowthrough the valvesecured.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />(conti nued)ANDPALO VERDE UNITS 1,2,3 3631AEDETN.4.-63.6.3-1AMENDMENT NO.

Containment Isol ati onValves3.6.3ACTIONSCONDITION [REQUIRED ACTION ]COMPLETION TIMEA. (continued)A.2-NOTE----Isolation devices inhigh radiation areasmay be verified byuse of administrativemeans.Verify the affected.penetration flow pathis isolated.Ifollowing isolationOnce per 31 for i sol ati ondevices outsidecontai nmentANDPri or toentering MODE 4from MODE 5 ifnot performedwi thin theprevious 92 daysfor i sol ati ondevices i nsi decontai nmentB.------NOTE-----Only applicable topenetration flow pathswith two requi redcontai nment i sol ati onval ves.One or morepenetration flow pathswith two requiredcontai nment i sol ati onvalves i noperabl eexcept for purge valveleakage not withinlimit.B.1Isolate the affectedpenetration flow pathby use of at leastone closed andde- acti vatedautomatic valve,closed manual valve,or blind flange.1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />(continued)PALO VERDE UNITS 1,2,3363-AMNETNO 1-463.6.3-2AMENDMENT NO. 117, Containment Isolation Valves3.6.3ACTIONS (continued)CONDITION ] REQUIRED ACTION JCOMPLETION TIMEC. ---NOTE----Only applicable topenetration flow pathswith only one requiredcontainment isolationvalve and a closedsystem.One or morepenetration flow pathswith one requi redcontainment i sol ati onvalve inoperable.C.1ANDC.2Isolate the affectedpenetration flow pathby use of at leastone closed andde- acti vatedautomatic valve,closed manual valve,or blind flange.-NOTE- --Isolation devices inhi gh radi ati on areasmay be verified byuse of admi ni strati vemeans.Verify the affectedpenetration flow pathis isolated.4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />s<I RICT Insert ISfollowing isolationOnce per 31 days24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />(conti nued)D. One or morepenetration flow pathswith one or morerequi red containmentpurge valves notwi thin purge valveleakage limits.D.1Isolate the affectedpenetration flow pathby use of at leastone closed andde- acti vatedautomatic valve withresilient seals, orblind flange.ANDPALO VERDE UNITS 1,2,3 3633AEDETN.4---63.6.3-3AMENDMENT NO. 117, 155 Contai nment Isol ati onVal yes3.6.3ACTIONSCONDITION jREQUIRED ACTION ]COMPLETION TIMED. (continued)D.2------------NOTE- --Isolation devices inhigh radiation areasmay be verified byuse of administrativemeans.Verify the affectedpenetration flow pathis isolated.Once per 31 days lfor isolationdevices outsidecontai nmentAND following isolationPrior to/entering MODE 4from MODE 5 ifnot performedwithin theprevious 92 daysfor isolationdevices insidecontai nment ,Once per 92 ANDD.3Perform SR 3.6.3.6for the resilientseal purge valvesclosed to comply withRequired Action D.I.E. Required Action and E.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDE.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,3 3634AEDETN...3.6.3-4AMENDMENT NO.

Containment SpraySystem3.6.63.6 CONTAINMENT SYSTEMS3.6.6 Containment Spray SystemLCO 3.6.6Two containment spray trains shall be OPERABLE.APPLICABILITY:MODES 1, 2, and 3.MODE 4 when RCS pr"essure is 385 psiaACTIONSCONDITION REQUIRED ACTION jCOMPLETION TIMEA.1A. One containment spraytrain inoperable.Restore containmentspray train toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s< -RICT InsertB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compi eti onTime of Condi ti on A ANDnot met.B.2 Be in MODE 4 with RCS 84 hour9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />sInetpressure < 385 psi a.PALO VERDE UNITS 1,2,33661AMNETNO 43.6.6-1AMENDMENT NO.

Insert for page 3.6.6-1C. -...NOTE-...Not applicablewhen secondcontainment spraytrain intentionallymade inoperable.Two containmentspray trainsinoperable.C.1 Restore at least onecontainment spraytrain to OPERABLEstatus.1 hourOuRIn accordance withthe Risk InformedCompletion TimeProgramD. Required Action D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sand associatedCompletion Time of ANDCondition C notmet. D.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> MSIVs3.7.2ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEE. Three or more MSIV E.1 Declare each affected Immediatelyactuator trains MSIV inoperable.inoperable.ORRequi red Action andassoci ated Compl eti onTime of Condition A,/F. One MSI i~noperable in F.1 Restore MSIV to 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />s~OPERABLE status. _ IRC lne2IiRequi red Action andlAssociated Compl eti nTime of Condition FNnot met.ki1Be in MODE 2.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s--- -NOTE- --Sepa rate Condi tionentry is allowed foreach MSIV.One or more MSIVsinoperable in MODE 2,3, or 4.1 Close MSIV.AND4 hoursOnce per 7 days2 Verify MSIV isclosed.Required Action andassoci ated Compl eti onTime of not met.Ii MODE 3.Be in MODE 5.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s36 hoursPALO VERDE UNITS 1,2,3372-AMNETNO .-443.7.2-2AMENDMENT NO. 117, !23 Insert for page 3.7.2-2G. --- -NOTE----.Not applicablewhen two or moreMSIVs intentionallymade inoperable.Two or more MSIVsinoperable inMODE 1.G.1 Restore all but oneMSIV to OPERABLEstatus.1 hourO._RIn accordance withthe Risk InformedCompletion TimeProgram MF IVs3.7.33.7 PLANT SYSTEMS3.7.3 Main Feedwater Isolation Valves (MFIVs)LCO 3.7.3APPLICABILITY:Four economizer MFIVs and four downcomner MFIVs shall beOPERABLE.MODES 1, 2, 3, and 4 except when MFIV is closed anddeactivated or isolated by a closed and deactivated poweroperated valve.ACTI ONS----------------~~-NOTE---- ----------Separate Condition entry is allowed for each penetration flow path.CONDITIONCOMPLETION TIMEA. One or more MFIVsinoperable.72) hoursinA--2. Verify inoperabicMFIV is closed orisolated.B-. Two va!'-cs in the B. Isolate affected flow £ o'r.... i ... MFTIVi 4c losed orislaed.1 (conti nued)PALO VERDE UNITS 1,2,3 3731AEDETN.17~3.7.3-iAMENDMENT NO.

Insert for page 3.7.3-1OPERABLE status.ORA.2.1 Close or isolateinoperable MFlIV(s).ANDA.2.2 Verify inoperableMFIV(s) is closed orisolated.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sORIn accordance with the RiskInformed Completion TimeProgram72 hoursOnce perisolation7 days followingB. Two valves in the sameflow path inoperable.OPERABLE status.ORB.2.1 Isolate affected flowpath.ANDB.2.2 Verify inoperableMFI V(s) is closed orisolated.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sORIn accordance with the RiskInformed Completion TimeProgram8 houi-sOnce per 7 days followingisolation ADVs3.7.43.7 PLANT SYSTEMS3.7.4 Atmospheric Dump Valves (ADVs)LCO 3.7.4APPLICABILITY:Four ADV lines shall be OPERABLE.MODES 1, 2, and 3,MODE 4 when steam generator is being relied upon for heatremoval.ACTI ONSCONDITION REQUIRED ACTION COMPLETION TIMEA.-----NOTE- --Separate Condition A.1 Restore ADV line to 7 daysentry is allowed for OPERABLE status.each SG. ITIsROne required ADV lineinoperable.B. Two or ADV lines B.1 Restore one ADV line 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sinoperable with both to OPERABLE status onADV lin~s inoperable each SG. RC Ineon one fr more SGs.C. Requil ed Action andassoc~ ated Compl eti onTime ot met.C.1 Be in MODE 3.AND6 hours24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sC.2 Be in MODE 4 withoutreliance on steamgenerator for heatremoval.-NOTE----Risk InformedCompletion Time notapplicable when allADVs intentionallymade inoperable.PALO VERDE UNITS 1,2,33.7.4-1AMENDMENT NO. 16,11(COFnICTED AFW System3.7.53.7 PLANT SYSTEMS3.7.5 Auxiliary Feedwater (AFW) SystemLCO 3.7..5Three AFW trains shall be OPERABLE.-~~~~~~NOTE-----------Only one AFW train, which includes a motor driven pump, isrequired to be OPERABLE in MODE 4.MODES 1, 2, and 3,MODE 4 when steam generator is relied upon for heat removal.APPLICABILITY:ACTIONS-------------NOTELCO 3.0.4.b is not applicable.CONDITION [R EQUIRED ACTION COMPLETION TIMEA. One steam supply toturbine driven AFWpump inoperable.OR-~~NOTE----Only applicable ifMODE 2 has not beenentered followingrefueling.One turbine driven AFWpump inoperable inMODE 3 followingrefueling.A.1Restore affectedequipment to OPERABLEstatus.7 days< RIOTAND InsertDeleted by adoption ofTSTF-439da4 e-, fie,.e.,.-v he 4 .QB. One AFW train B.1 Restore AFW train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sinoperable for reasons OPERABLE status.other than Condition AANin MODE 1, 2, or 3.Deletedb adopton of...,....TSTF-439 1 ... ÷,(conti nued)PALO VERDE UNITS 1,2,3 3751AEDETN.44-63.7.5-1AMENDMENT NO. 134, 155 ACTIONS (cninudAFW System3.7.5f "CONDITION D REQUIRED ACTION COMPLETION TIME0. ReurdAction and .1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime of Condition A, ANDI t otmt.-G.2 Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sQ. hree AFW trains BI. 1------NOTE- --inoperable in MODE 1, LCO 3.0.3 and all2, or 3.other LCO RequiredActions requi ringMODE changes aresuspended until oneAFW train is restoredto OPERABLE status.Initiate action to Immediatelyrestore one AFW train~to OPERABLE status.E. ReurdAWtrain ~ .1------NOTE- --inoperable in MODE 4. LCO 3.0.3 and allother LCO RequiredActions requi ringMODE changes aresuspended until oneAFW train is restoredto OPERABLE status.Ini ti ate acti on to Immediatelyrestore one AFW trainto OPERABLE ,status.PALO VERDE UNITS 1,2,3 3752AEDETN.43.7.5-2AMENDMENT NO.

Insert for page 3.7.5-2C. -- -- NOTE----.Not applicablewhen second AFWtrain intentionallymade inoperable.C.1Restore at least oneAFW train toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo AFW trainsinoperable inMODEl 12, or 3.

CST3.7.63.7 PLANT SYSTEMS3.7.6 CondensateLCO 3.7.6APPLICABILITY:Storage Tank (CST) _OPERABLE.The CST shall be 95tMODES 1, 2, and 3,MODE 4 when steam generator is relied upon for heat removal.ACTI ONSCONDITION ] REQUIRED ACTION COMPLETION TIMEA.A.1VerifybackupOPERABILITY ofwater supply.4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sANDOnce per12 hoursthereafter7 days<ICANDA.2 Restore CST tolimitOPABLE tatus. -B. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDB.2 Be in MODE 4 without 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sreliance on steamgenerator for heatremoval.SURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.7.6.1 Verify CST level is 29.5 ft. In accordancewith theSurveil11anceFrequencyControl ProgramLIPALO VERDE UNITS 1,2,3 3761AEDETN.4---3.7.6-1AMENDMENT NO. !!7, 188 EW System3.7.73.7 PLANT SYSTEMS3.7.7 Essential Cooling Water (EW) SystemLCO 3.7.7APPLICABILITY:Two LW trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION JREQUIRED ACTION COMPLETION TIMEA. One LW traininoperable.A.1-NOTE- --Enter applicableConditions andRequired Actions ofLCO 3.4.6, "RCSLoops -MODE 4" forshutdown cooling madeinoperable by LW.Restore LW train toOPERABLE status.Insertl72 hours< RIOTInsertIJ.m -- m n4.LB. ReurdActi on andassoci ated Compl eti onTime of Condition Anot met.B.1ANDB.2Be in MODE 3.Be in MODE 5.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s36 hoursPALO VERDE UNITS 1,2,3377-AMNETNO 43.7.7-1AMENDMENT NO.

Insert for page 3.7.7-1B. ---- NOTE----.Not applicablewhen second EWtrain intentionallymade inoperable.B.1 Restore at least oneEW train toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo EW trainsinoperable.

ES PS3.7.83.7 PLANT SYSTEMS3.7.8 Essential Spray Pond System (ESPS)LCO 3.7.8APPLICABILITY:Two ESPS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION ] REQUIRED ACTION COMPLETION TIMEA. One ESPS traini noperabl e.A.1-Notes- --1. Enter applicableConditions andRequi red Actionsof LCO 3.8.1."AC Sources -Operating," foremergency dieselgenerator madei noperabl e byES PS.2. Enter applicableCondi tions andRequi red Actionsof LCO 3.4.6."RCS Loops -MODE 4," forshutdown cool ingmade i noperabl eby ESPS.Restore ESPS train toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s< RIOTInsert4 4B. eqied Action andassoci ated Compl eti onTime of Condition Anot met.B.1ANDB.2Be in MODE 3.Be in MODE 5.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s36 hoursPALO VERDE UNITS 1,2,3378-AMNETNO3.7.8-1AMENDMENT NO.

Insert for page 3.7.8-1Not applicablewhen second ESPStrain intentionallymade inoperable.B.1 Restore at least oneESPS train toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo ESPS trainsinoperable.

UHS3.7.93.7 PLANT SYSTEMS3.7.9 Ultimate Heat Sink (UHS)LCO 3.7.9APPLICABILITY:The UHS shall be OPERABLE.MODES 1, 2, 3, and 4.SURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.1.9.1 Verify the usable water depth of each In accordanceessential spray pond is 12 feet. with theSurveil11anceFrequencyControl ProgramSR 3.7.9.2 Verify water temperature of each essential In accordancespray pond is 89°F. with theSurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,33.7.9-1PAL VRD UIT 12, 37.-1AMENDMENT NO. !17, !88 Insert for page 3.7.9-1A.-...NOTE-....Risk InformedCompletion Timenot applicablewhen UHSintentionally madeinoperable.UHS inoperable.A.1Restore UHS toOPERABLE status.1 hourO._RIn accordance with theRisk Informed CompletionTime ProgramB. Required Actionand associatedCompletion Timenot met.

EC3.7.103.7 PLANT SYSTEMS3.7.10 Essential Chilled Water (EC) SystemLCO 3.7.10APPLICABILITY:Two EC trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION JREQUIRED ACTION COMPLETION TIME72 hoursA. One EC traininoperable.A.1Restore EC train toOPERABLE status.p~IJ-J< I RIOTB. Rqie Acti on andassoci ated Compl eti onTime not met.B.1ANDNB.2Be in MODE 3.Be in MODE 5.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s36 hoursSURVEILLANCEREQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.10.1 Verify each EC System manual, power In accordanceoperated, and automatic valve in the flow with thepath, that is not locked, sealed, or Surveillanceotherwise secured in position, is in the Frequencycorrect position. Control ProgramSR 3.7.10.2 Verify the proper actuation of each EC In accordanceSystem component on an actual or simulated with theactuation signal. SurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3 371- MNMN O 4--83.7.10-1AMENDMENT NO. 117, 188 Insert for page 3.7.10-1B. ----NOTE----.Not applicablewhen second ECtrain intentionallymade inoperable.B.1 Restore at least oneEC train toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo EC trainsinoperable.

CREATCS3.7.123.7 PLANT SYSTEMS3.7.12 Control Room Emergency Air Temperature Control System (CREATCS)LCO 3.7.12APPLICABILITY:Two CREATCS trains shall be OPERABLE.MODES 1, 2, 3, 4, 5, and 6,During movement of irradiated fuel assemblies,ACTIONSCONDITION REQUIRED ACTION ] COMPLETION TIMEA. One CREATCS trainllner inoperableA.IRestore CREATCS trainto OPERABLE status.30 daysB. ReurdAction and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime of Condition ANDnot met in MODE 1,2,3, or 4. D or B.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sG. Requi'-" red Acti on and -G. 1 Pl ace OPERABLE Immediatelyassociated Completion CREATCS train inTime of Condi ti on A operati on.D. Reure ction and lQ.l Place OPERABLE Immediatelyassociated Compl eti on ICREATCS train i nTime of Condition A Ioperationnot met during l ORmovement of i rradi atedk-fuel assembl ies. 2 Suspend movement of Immediatelyi rradi ated fuelassembl ies.(conti nued)PALO VERDE UNITS 1,2,337121AEDNT O.4.3.7.12-1AMENDMENT NO.

Insert for page 3.7.12-18.1B. ----NOTE----.Not applicablewhen secondCREATCS trainintentionally madeinoperable.Two CREATCStrains inoperable inMODE 1,2, 3, or 4.Restore at least oneCREATCS train toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgram CREATCS3.7.12ACTIONS (continued)CONDITIONUIRED ACTIONCOMPLETION TIMETwo CREATCS trainsinoperable in MODE 5or 6, or duringmovement of irradiatedfuel assemblies.Suspend COREALTERATIONS.Immedi atelyImmedi atelyANDSuspend movement ofirradiated fuelassemblies.Tw:o CREATCS trains Enter LCO 3.0.3. in MODE 1,SURVEILLANCEREQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.12.1 Verify each CREATCS train has the In accordancecapability to remove the assumed heat load, with theSurveil11anceFrequencyControl ProgramPALO VERDE UNITS 1,2,33.7.12-2PAL VRD UIT 1,,33..1-2AMENDMENT NO. 117,-188 AC Sources -Operating3.8.1ACTIONSCONDITION [RE QUIRED ACTION COMPLETION TIMEA. (continued)A.3Restore requi redoffsite circuit toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sfailurc to meetL-CDDeleted by adoption of ,,TSTF-439I I+ 4B. One DG inoperable.B.1ANDB.2ANDB.3.1ORB.3.2Perform SR 3.8.1.1for the OPERABLErequi red offsitecircuit(s).Decl are requi redfeature(s) supportedby the inoperable DGinoperable when itsredundant requi redfeature(s) isinoperable.Determine OPERABLEDG is notinoperable due tocommon cause failure.Perform SR 3.8.1.2for OPERABLE DG.1 hourANDOnce per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sthereafter4 hours fromdiscovery ofCondition Bconcurrent withinoperability ofredundantrequi redfeature(s)24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s24 hours(conti nued)ANDPALO VERDE UNITS 1,2,33.12AMN ETNO 443.8.1-2AMENDMENT NO. 117, 154 AC Sources -Operating3.8.1IRICT insertACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEB. (continued) B.4 Restore DG daysto OPERABLE status.failure to mootC. Two required offsite C.1 Declare required 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> fromcircuits inoperable, feature(s) inoperable discovery ofwhen its redundant Condition Crequired feature(s) concurrent withis inoperable. inoperability ofredundantrequi redfeature(s)ANDC.2 Restore one required 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />soffsite circuit toOPERABLE status.]RICT insertj(conti nued)PALO VERDE UNITS 1,2,3 3813AEDETN.1~~~63.8.1-3AMENDMENT NO. 117, !54 AC Sources -Operati ng3.8.1ACTIONS (continued)CONDITION j REQUIRED ACTION {COMPLETION TIMED. One required offsitecircuit inoperable.ANDOne DG inoperable.-~~NOTE-----Enter applicable Conditionsand Required Actions ofLCO 3.8.9, "DistributionSystems -Operating," whenCondition D i s entered wi thno AC power source to atrain.D.1ORD.2Restore requiredoffsite circuits toOPERABLE status.Restore DGto OPERABLE status.12hourshours< RICTInsertfours12E. Two DGs inoperable.E.1Restore one DG toOPERABLE status.2h4F. One automatic loadsequencer inoperable.F.1ANDF.2Restore automaticload sequencer toOPERABLE status.Declare requiredfeature(s) supportedby the inoperablesequencer inoperablewhen its redundantrequi red feature(s)is inoperable.24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s4 hours fromdiscovery ofCondition Fconcurrent withinoperability ofredundantrequi redfeature(s)~(conti nued)PALO VERDE UNITS 1,2,3381-AMNETNO3.8.1-4AMENDMENT NO.

Insert for page 3.8.1-4G. ---- NOTE-....Not applicablewhen three or morerequired ACSOUroesintentionally madeinoperable.Three or morerequired ACsources inoperable.G.1 Restore required ACsource(s) toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgram AC Sources -Operating3.8.1ACTIONS (conti nued)COI REQUIRED ACTION COMPLETION TIMEG. On rmre required G.i Restore required 1 houroffsite circuit(s) do capability of thenot meet requi red offsite ci rcuit(s).capabilIi ty. OR------------------- ----NOTE-----Enter LCO 3.8.1 Condition Aor C for required offsiteci rcuit(s) inoperable.Transfer the ESF 1 hourbus(es) from the, offsite circuit(s) tothe EDG(s).H. Requi red Action andAssoci ated Compl eti onTime of Condition A,B,_C, D, E, F,e~Gnot met. 'G, rHI4.1AND2Be in MODE 3.Be in MODE 5.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> -36 hoursI. Thrcc^ or rnor 4-- Enter IC 3".0.3. mi ....uircd AC ........r1 I .. .. ......PALO VERDE UNITS 1,2,338.5AMNETNO -23.8.1-5AMENDMENT NO. 117, 123 DC Sources -Operating3.8.43.8 ELECTRICAL POWER SYSTEMS3.8.4 DC Sources -OperatingLCO 3.8.4APPLICABILITY:The Train A and Train B DC electrical power subsystems shallbe OPERABLE.MODES 1, 2, 3, and 4.ACTIONS _______________CONDITION REQUIRED ACTION COMPLETION TIMEA. One battery charger on A.1 Restore battery 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sone subsystem terminal voltage toinoperable, greater than or equal RCto the minimumestablished float Isrvoltage.ANDA.2 Verify battery float Once per 12current s 2 amps. hoursANDA.3 Restore battery 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />scharger to OPERABLEstatus.B.cticlB.1 Restore DC electrical 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sSpower subsystem OpoerAL staubsytm oSinoperable for reasonsOPRBEsauSother than lserICondition A. _Required Action and J.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTienot met. AND0.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,33.8.4-1PAL VEDE NIT 1,,3 .8.-1AMENDMENT NO. iie Insert for page 3.8.4-1C. -- -- NOTE----.Not applicablewhen second DCelectrical powersubsystemintentionally madeinoperable.Two DC electricalpower subsystemsinoperable.C.1 Restore at least oneDC electrical powersubsystem toOPERABLE status.1 hourO._RIn accordance withthe Risk InformedCompletion TimeProgram Inverters -Operati ng3.8.73.8 ELECTRICAL POWER SYSTEMS3.8.7 Inverters -OperatingLCO 3.8.7The required Train A and Train B inverters shall beOPERABLE.-~~~~~~NOTE-----------One inverter may be disconnected from its associated DC busfor 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on itsassociated battery, provided:a. The associated AC vital instrument bus is energized fromits Class 1E constant voltage source regulator; andb. All other AC vital instrument buses are energized fromtheir associated OPERABLE inverters.APPLICABILITY:MODES 1, 2, 3, and 4.ACTI ONS _________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. One required inverter A.1------NOTE- --i noperabl e. Enter appl icabl eConditions andRequi red Actions ofLCO 3.8.9,'DistributionSystems -Operating"with any vitalinstrument busde-energi zed.Restore inverter to 7 daysOPERABLE status.InsertIRICT insert/(continued)PALO VERDE UNITS 1,2,3387-AMNETNO 4-4Q3.8.7-iAMENDMENT NO.

Insert for page 3.8.7-1B. ----NOTE---..Not applicablewhen two or morerequired invertersintentionally madeinoperable resultingin loss of safetyfunction.B.1 Restore all but oneinverter to OPERABLEstatus.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo or morerequired invertersinoperable.

Inverters -Operati ng3.8.7ACTIONS (continued)CODI _ REQUIRED ACTION COMPLETION TIMEB. eqied Action B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sBe in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.8.1.1 Verify correct inverter voltage, frequency, In accordanceand alignment to required AC vital with theinstrument buses. SurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,33.8.7-2PAL VEDE NIT 1,,3 .8.-2AMENDMENT NO. 4117, 148B-Di stri buti on Systems -Operating3.8.93.8 ELECTRICAL POWER SYSTEMS3.8.9 Distribution Systems -OperatingLCO 3.8.9APPLICABILITY:electrical power distribution subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION] REQUIRED ACTION~ COMPLETION TIMEA. One AC electricalpower di stri buti onsubsystem i noperabl e.A.1Restore AC el ectricalpower di stri buti onsubsystem to OPERABLEstatus.Deleted by adoption ofTSTF-4398 hours< RICTADInsert16 nour fromv .e eanB. One AC vita]instrument buselectrical powerdi stri buti on subsystemi noperabl e.8.1Restore AC vitalinstrument buselectrical powerdi stri buti onsubsystem to OPERABLEstatus./2 hoursAND16 ho,,z fro,-m4*semlt y-uv ~uc to mcct,-1 ,-,g (conti nued)Deleted by adoptionof TSTF-439PALO VERDE UNITS 1,2,3 3891AEDETN.4.3.8.9-iAMENDMENT NO.

Di stri buti on Systems -Operating3.8.9ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. One DC electricalpower di stri buti onsubsystems i noperabl e.C.1Restore DC electricalpower distributionsubsystem to OPERABLEstatus.2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />s4-a-< RICT InsertTSTF-439LCO+D.- Required Action andassoci ated Compl eti onTime not met..iNiDBe in MODE 3.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sBe in MODE 5.36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sTw bo or more inoperable Enter LCO 3.0.3. ime-aeyin a lo of. safetySURVEILLANCE FREQUENCYSR 3.8.9.1 Verify correct breaker alignments and In accordancevoltage to required AC, DC, and AC vital with theinstrument bus electrical power Surveillancedistribution subsystems. FrequencyControl ProgramPALO VERDE UNITS 1,2,3 3892AEDETN.~--83.8.9-2AMENDMENT NO. 117, 188 Insert for page 3.8.9-2D. ----NOTE----.Not applicablewhen two or moreelectrical powerdistributionsubsystemsintentionally madeinoperableresulting in loss ofsafety function.D.1I Restore electricalpower distributionsubsystem(s) toOPERABLE status.1 hourORIn accordance withthe Risk InformedCompletion TimeProgramTwo or moreelectrical powerdistributionsubsystemsinoperable.

Programs and Manuals5.55.5 Programs and Manuals (continued)5.5.19 Battery Monitoring and Maintenance Program (continued)4. In Regulatory Guide 1.129, Regulatory Position 3,Subsection 5.4.1, "State of Charge Indicator," thefollowing statements in paragraph (d) may be omitted:"When it has been recorded that the charging current hasstabilized at the charging voltage for three consecutivehourly measurements, the battery is near full charge.These measurements shall be made after the initially highcharging current decreases sharply and the battery voltagerises to approach the charger output voltage."5. In lieu of RG 1.129, Regulatory Position 7, Subsection7.6, "Restoration," the following may be used: "Followingthe test, record the float voltage of each cell of thestring."b. The program shall include the following provisions:1. Actions to restore battery cells with float voltage< 2.13V;2. Actions to determine whether the float voltage of theremaining battery cells is 2.13 V when the floatvoltage of a battery cell has been found to be<2.13V;3. Actions to equalize and test battery cells that hadbeen discovered with electrolyte level below the topof the plates;4. Limits on average electrolyte temperature, batteryconnection resistance, and battery terminal voltage;and5. A requirement to obtain specific gravity readings ofall cells at each discharge test, consistent withmanufacturer recommendations.PALO VERDE UNITS 1,2,3 551 MNMN O D5.5-19AMENDMENT NO.

Insert for page 5.5-195.5.20 Risk Informed Completion Time ProgramThis program provides controls to calculate a Risk Informed Completion Time(RIOT) and must be implemented in accordance with NEI 06-09 Revision 0 -A,"Risk-Managed Technical Specifications (RMTS) Guidelines." The program shallinclude the following:a. The RIOT may not exceed 30 days;b. A RIOT may only be utilized in MODE 1, 2;c. When a RIOT is being used, any plant configuration change within thescope of the Risk Informed Completion Time Program must be consideredfor the effect on the RIOT.1. For planned changes, the revised RIOT must be determined prior toimplementation of the change in configuration.2. For emergent conditions, the revised RIOT must be determinedwithin the time limits of the Required Action Completion Time (i.e.,not the RIOT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change,whichever is less.3. Revising the RIOT is not required if the plant configuration changewould lower plant risk and would result in a longer RIOT.d. Use of a RIOT is not permitted for voluntary entry into a configurationwhich represents a loss of a specified safety function or inoperability of allrequired trains of a system required to be OPERABLE.e. Use of a RIOT is permitted for emergent conditions which represent a lossof a specified safety function or inoperability of all required trains of asystem required to be OPERABLE if one or more of the trains areconsidered "PRA functional" as defined in Section 2.3.1 of NEI 06-09Revision 0 -A.

EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTAC H MENT 2Revised Technical Specification Pages (Clean copy)1.3-131.3-141.3-153.3.4-13.3.6-13.3.6-23.3.6-33.3.6-43.3.6-53.4.9-13.4.9-23.4.10-13.4.12-13.5.1-13.5.1-23.5.3-13.5.3-23.5.3-33.5.3-43.5.5-13.6.2-33.6.3-13.6.3-23.6.3-33.6.3-43.6.6-13.6.6-23.6.6-33.7.2-23.7.2-33.7.2-43.7.3-13.7.3-23.7.4-13.7.5-13.7.5-23.7.6-13.7.6-23.7.7-13.7.7-23.7.8-13.7.8-23.7.9-13.7.9-23.7.10-13.7.10-23.7.12-13.7.12-23.8.1-23.8.1-33.8.1-43.8.1-53.8.1-63.8.1-73.8.1-83.8.1-93.8.1-103.8.1-113.8.1-123.8.1-133.8.1-143.8.1-153.8.1-163.8.1-173.8.1-183.8.4-13.8.4-23.8.4-33.8.4-43.8.7-13.8.7-23.8.9-13.8,9-25.5.20Note:The following TS clean pages in this attachment reflect the deletion of second completionsadopted by the pending licensing amendment request to adopt TSTF-439-A (ML1 5065A031)oTS 1.3, Completion Times* TS 3.7.5, Auxiliary Feedwater (AFW) Systemo TS 3.8.1, AC Sources -OperatingoTS 3.8.9, Distribution Systems -Operating Completi on Tines1.31.3 Completion TimesEXAMPLESEXAMPLE 1.3-7(conti nued)The Completion Time clock for Condition A does not stop afterCondition B is entered, but continues from the time Condition Awas initially entered. If Required Action A.1 is met afterCondition B is entered, Condition B is exited and operation maycontinue in accordance with Condition A, provided theCompletion Time for Required Action A.2 has not expired.EXAMPLE 1.3-8ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One A.1 Restore subsystem 7 dayssubsystem to OPERABLEinoperable, status. ORIn accordancewith the RiskInformedCompletion TimeProgramB.-...NOTE ... B.1 Restore 1 hourNot applicable subsystems towhen second OPERABLE status. ORsubsystemintentionally In accordancemade inoperable, with the Risk* InformedCompletion TimeTwo subsystems Programinoperable.C. Required Action C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sand associatedCompletion Time ANDnot met.C.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sWhen a subsystem is declared inoperable, Condition A isentered. The 7 day Completion Time may be applied as discussedin Example 1.3-2. However, the licensee may elect to apply thePALO VERDE UNITS 1,2,313-3AEDNT O.-7,1.3-13AMENDMENT NO.

Compl eti on Times1.31.3 Completion TimesACTION Risk Informed Completion Time Program which permits calculation(continued) of a Risk Informed Completion Time (RICT) that may be used tocomplete the Required Action beyond the 7 day Completion Time.The RICT cannot exceed 30 days. After the 1 day CompletionTime has expired, the subsystem must be restored to OPERABLEstatus within the RICT or Condition C must also be entered.If a second subsystem is declared inoperable, Condition B mayalso be entered. The Condition is modified by a NOTE statingit is not applicable if the second subsystem is intentionallymade inoperable. The Required Actions of Condition B are notintended for voluntary removal of redundant subsystems fromservice. The Required Action is only applicable if onesubsystem is inoperable for any reason and the second subsystemis found to be inoperable, or if both subsystems are found tobe inoperable at the same time. If Condition B is applicable,at least one subsystem must be restored to OPERABLE statuswithin 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or Condition C must also be entered. Thelicensee may be able to apply a RICT to extend the CompletionTime beyond 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> if the requirements of the Risk InformedCompletion Time Program are met. If two subsystems areinoperable and Condition B is not applicable (i.e., the secondsubsystem was intentionally made inoperable), LCO 3.0.3 isentered as there i s no appl icable Condi ti on.The Risk Informed Completion Time Program requiresrecalculation of the RICT to reflect changing plant conditions.For planned changes, the revised RICT must be determined priorto implementation of the change in configuration. For emergentconditions, the revised RICT must be determined within the timelimits of the Required Action Completion Time (i.e., not theRICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change,whichever is less.If the 7 day Completion Time clock of Condition A or the 1 hourCompletion Time clock Condition B have expired and subsequentchanges in the plant condition result in exiting theapplicability of the Risk Informed Completion Time Programwithout restoring the inoperable subsystem to OPERABLE status,Condition C is also entered and the Completion Time clocks forRequired Actions C.1 and C.2 start.If the RICT expires or is recalculated to be less than theelapsed time since the Condition was entered and the inoperablesubsystem has not been restored to OPERABLE status, Condition Cis also entered and the Completion Time clocks for RequiredActions C.1 and C.2 start. If the inoperable subsystems arerestored to OPERABLE status after Condition C is entered,Conditions A, B, and C are exited, and therefore, the RequiredActions of Condition C may be terminated.PALO VERDE UNITS 1,2,31.3-14AMENDMENT NO.

Compl eti on Times1.31.3 Completion TimesIMMEDIATECOMPLETION TIMEWhen "Immediately" is used as a Completion Time, theRequired Action should be pursued without delay and in acontrol led manner.PALO VERDE UNITS 1,2,3 131 MNMN O 1I .3-15AMENDMENT NO.

RPS Logic and TripInitiation3.3.43.3 INSTRUMENTATION3.3.4 Reactor Protective System (RPS) Logic and Trip InitiationLCO 3.3.4Six channels of RPS Matrix Logic, four channels of RPSInitiation Logic, four channels of reactor trip circuitbreakers (RTCBs), and four channels of Manual Trip shall beOPERABLE.APPLICABILITY:MODES 1 and 2,MODES 3, 4, and 5, with any RTCBs closedelement assemblies capable of beingand any controlwithdrawn.ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIMEA. One Matrix Logic A.1 Restore channel to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />schannel inoperable. OPERABLE status.OR ORThree Matrix Logic In accordancechannels inoperable with the Riskdue to a common power Informedsource failure Completion Timede-energizing three Programmatrix power supplies.(continued)PALO VERDE UNITS 1,2,33341AMNETNO 1,3.3.4-1AMENDMENT NO. -t--1-7, ESFAS Logic and Manua1 Trip3.3.63.3 INSTRUMENTATION3.3.6 Engineered Safety Features Actuation System (ESFAS) Logic andManual TripLCO 3.3.6APPLICABILITY:Six channels of ESFAS Matrix Logic, four channels of ESFASInitiation Logic, two channels of Actuation Logic, and fourchannels of Manual Trip shall be OPERABLE for each Functionin Table 3.3.6-1.According to Table 3.3.6-1.ACTIONS----------------NOTE-- ----Separate Condition entry is allowed for each Function.CONDITION REQUIRED ACTION COMPLETION TIMEA. One or more Functions A.1 Restore channel to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />swith one Matrix Logic OPERABLE status.channel inoperable. ORORThree Matrix Logic In accordancechannels are with the Riskinoperable due to a Informedcommon power source Completion Timefailure de-energizing Programthree matrix powersupplies.B. One or more Functions B.1 Restore channel to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />swith one Manual Trip OPERABLE status.or Initiation Logic ORchannel inoperable.In accordancewith the RiskInformedCompletion TimeProgram(conti nued)PALO VERDE UNITS 1,2,3 3361AEDETN.4-.3.3.6-1AMENDMENT NO.

ESFAS Logic and Manual Trip3.3.6ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. One or more Functions C.1i Open at least one Tmmedi atelywith two Initiation contact in theLogic channels or affected trip leg ofManual Trip channels both ESFAS Actuationaffecting the same Logics.trip leg inoperable. ANDC.2 Restore channels to 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />sOPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramD. One or more Functions D.1------NOTE------48 hourswith one Actuation One channel ofLogi c channel Actuati on Logi c may ORinoperable, be bypassed for up to1 hour for In accordanceSurveillances, with the Riskprovided the other Informedchannel is OPERABLE. Completion TimeProgramRestore channel toOPERABLE status.E. --NOTE-----E.1 Restore channel(s) to 1 hourNot appl icable when OPERABLE status.second Actuati on ORLogic channeli ntenti onal ly made In accordanceinoperable, with the RiskInformedCompl eti on TimeOne or more Programfunctions with twoActuation Logicchannels inoperable.PALO VERDE UNITS 1,2,3336-AMN ETNO 1-f3.3.6-2AMENDMENT NO. -I-i-%,

ESFAS Logic and Manual Trip3.3.6ACTIONS (continued)F. Required Action and F.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti on ANDTime of Conditions forContainment Spray F2 B nMD .1 orActuation Signal , Main F2 B nMD .1 orSteam Isolation Signalor AuxiIi ary FeedwaterActuation Signal notmet.G. Required Action and G.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onANTime of Conditions for -NSafety Injecti onActuation Signal, G.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sContai nment Isol ati onActuation Signal, orReci rcul ati onActuation Signal notmet.SURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.3.6.1----------NOTE- -------Testi ng of Actuati on Logi c shallI i ncl udethe yenifi cati on of the proper operati on ofeach i ni tiati on relay.Perform a CHANNEL FUNCTIONAL TEST on each In accordanceESFAS logic channel and Manual Trip with thechannel. Surveill IanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3336-AMN ETNO -43.3.6-3AMENDMENT NO.

ESFAS Logic andManual Trip3.3.6SURVEILLANCE REQUIREMENTS (conti nued)SR 3.3.6.2-~~~~~NOTE--------Relays exempt from testing during operationshall be tested in accordance with theSurveillance Frequency Control Program.Perform a subgroup relay test of eachActuation Logic channel, which includes thede-energization of each subgroup relay andverification of the OPERABILITY of eachsubgroup relay.In accordancewith theSurveil11anceFrequencyControl ProgramPALO VERDE UNITS 1,2,33364AMNETNO 19,3.3.6-4AMENDMENT NO.

Pressuri zer3.4.93.4 REACTOR COOLANT SYSTEM (RCS)3.4.9 PressurizerLCO 3.4.9The pressurizer shall be OPERABLE with:a. Pressurizer water level 27% and 56%; andb. Two groups of pressurizer heaters OPERABLE with thecapacity of each group 125 kW.APPLICABILITY:MODES 1, 2, and 3.~~~~~~-NOTE--------- --The pressurizer water level limit does not apply during:a.b.THERMAL POWER ramp > 5% RTP per minute; orTHERMAL POWER step > 10% RTP.ACTI ONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. Pressurizer water A.1 Be in MODE 3 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />slevel not within with reactorlimit. trip breakersopen.ANDA.? Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sB. One required group of B.1 Restore required 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />spressurizer heaters group of pressurizerinoperable, heaters to OPERABLE ORstatus.In accordancewith the RiskInformedCompletion TimeProgram(conti nued)PALO VERDE UNITS 1,2,3 3491AEDETN.143.4.9-1AMENDMENT NO.

Pressuri zer3.4.9ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC.-----NOTE-----C.1 Restore at least one 1 hourNot applicable when requi red group ofsecond group of pressurizer heaters to ORrequied pessuizerOPERABLE status.heatied rs suie In accordanceheaterswith the Riskintentionally made Informedi noperabl e. Compl eti on Ti meProgramTwo required groups ofpressurizer heatersinoperable.D. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Compl eti on ANDTime of Condition B orC o e.D.2 Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sSURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.4.9.1 Verify pressurizer water level is 27% and In accordance<56% with theSurveil11anceFrequencyControl ProgramSR 3.4.9.2 Verify capacity of each required group of In accordancepressurizer heaters 125 kW. with theSurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3 3492AEDETN.I~3.4.9-2AMENDMENT NO.

ESFAS Logic and Manual Trip3.3.6Table 3.3.6-1 (page 1 of 1)Engineered Safety Features Actuation System Logic and Manual Trip ApplicabilityFUNCTION APPLICABLE MODES1. Safety Injection Actuation Signala. Matrix LOgiC 1,2,3b. Initiation Logic 1,2,3,4c. Actuation Logic 1,2,3,4d. Manual Trip 1,2,3,42. Containment Isolation Actuation Signala. Matrix Logic 1,2.3b. Initiation Logic 1,2,3,4c. Actuation Logic 1,2,3,4d. Manual Trip 1,2,3.43. Recirculation Actuation Signala. Matrix Logic 1,2,3b. Initiation Logic 1,2,3,4c. Actuation Logic 1,2.3.4d. Manual Trip 1,2,3,44. Containment Spray Actuation Signala. Matrix Logic 1,2,3b. Initiation Logic 1,2,3c. Actuation Logic 1,2,3d. Manual Trip 1,2,35. Main Steam Isolation Signal(a)a. Matrix Logic 1,2,3b. Initiation Logic 1,2,3c. Actuation Logic 1,2,3d. Manual Trip 1,2,36. Auxiliary Feedwater Actuation Signal SG #1 (AFAS-1)a. Matrix Logic 1,2,3b. Initiation Logic 1,2,3c. Actuation Logic 1,2,3d. Manual Trip 1,2,37. Auxiliary Feedwater Actuation Signal SG #2 (AFAS-2)a. Matrix Logic 1,2,3b. Initiation Logic 1,2,3c. Actuation Logic 1,2,3d. Manual Trip 1,2,3(a) The MSlS Function is not required to be OPERABLE when all associated valves isolated by the MSISFunction are closed.PALO VERDE UNITS 1,2,3 3365AEDETN.13.3.6-5AMENDMENT NO.

Pressurizer Safety Valves-MODES 1, 2, and 33.4.103.4 REACTOR COOLANT SYSTEM (RCS)3.4.10 Pressurizer Safety Valves -Modes 1, 2 and 3LCO 3.4.10APPLICABILITY:Four pressurizer safety valves shall be OPERABLE with liftsettings 2450.25 psia and 2549.25 psia.MODES 1, 2, and 3,~~~~~~-NOTE-----------The lift settings are not required to be within LCO limitsduring MODES 3 and 4 for the purpose of setting thepressurizer safety valves under ambient (hot) conditions.This exception is allowed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following entry intoMODE 3 provided a preliminary cold setting was made prior toheatup.ACTI ONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. One pressurizer safety A.1 Restore valve to 15 minutesvalve inoperable. OPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion ANDTime not met.OR B.2 Be in MODE 4 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sTwo or morepressurizer safetyvalves inoperable.PALO VERDE UNITS 1,2,33 4101AED NT O.17,3.4.10-IAMENDMENT NO. -i-i-7-,

Pressurizer Vents3.4.123.4 REACTOR COOLANT SYSTEM (RCS)3.4.12 Pressurizer VentsLCO 3.4.12APPLICABILITY:Four pressurizer vent paths shall be OPERABLE.MODES 1, 2, and 3.MODE 4 with RCS pressure 385 psia.ACTI ONSCONDITION REQUIRED ACTION COMPLETION TIMEA. Two or three required A.1 Restore required 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />spressurizer vent paths pressurizer ventinoperable, paths to OPERABLE ORstatus.In accordancewith the RiskInformedCompletion TimeProgramB. --NOTE-----B.1 Restore one 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sRisk Informed pressurizer vent pathCompletion Time not to OPERABLE status. ORapplicable when lastvent path In accordanceintentionally made with the Riskinoperable. InformedCompletion TimeProgramAll pressurizer ventpaths inoperable.C. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion ANTime of Condition A, AN-orB otme.C.2 Be in MODE 4 with RCS 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />spressure < 385 psia.PALO VERDE UNITS 1,2,3 341- MNMN O ~3.4.12-IAMENDMENT NO.

SITs-Operating3.5.13.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.1 Safety Injection Tanks (SITs) -OperatingLCO 3.5.1Four SITs shall be OPERABLE.APPLICABILITY:MODES 1 and 2,MODES 3 and 4 withpressurizer pressure 1837 psia.ACTI ONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. One SIT inoperable due A.1 Restore SIT to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sto boron concentration OPERABLE status.not within limits. OROR In accordancewith the RiskOne SIT inoperable due Informedto inability to verify Completion Timelevel or pressure. ProgramB. One SIT inoperable for B.1 Restore SIT to 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sreasons other than OPERABLE status.Condition A. ORIn accordancewith the RiskInformedCompletion TimeProgramC. --NOTE-----C.1 Restore all but one 1 hourNot applicable when SIT to OPERABLEtwo or more SITs status. ORi ntenti onal ly madei noperabl e. In accordancewith the RiskInformedTwo or more SITs Completion Timeinoperable. ProgramPALO VERDE UNITS 1,2,33511AMN ETNO -,3.5.1-1AMENDMENT NO.

SITs-Operating3.5.1ACTI ONSD. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Compl eti on ANDTime of Condition A,B, or C not met.D.2 Reduce pressurizer 12'hourspressure to<1837 psia.SURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.5.1.1 Verify each SIT isolation valve is fully In accordanceopen. with theSurveil11anceFrequencyControl ProgramSR 3.5.1.2 Verify.borated water volume in each SIT is In accordance>28% narrow range and 72% narrow range. with theSurveil11anceFrequencyControl ProgramIn accordanceR3.5.1.3 Verify nitrogen cover pressure in each SIT with theis 600 psig and 625 psig. SurveillanceFrequencyControl Program(continued)PALO VERDE UNITS 1,2,3 3512AEDETN.133.5.1-2AMENDMENT NO. -!-88, EGGS -Operating3.5.33.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.3 ECCS -OperatingLCO 3.5.3 Two ECCS trains shall be OPERABLE.APPLICABILITY: MODES 1 and 2,MODE 3 with pressurizer pressure 1837 psia or withRCS Tc 485°F.ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIMEA. One LPSI subsystem A.1 Restore subsystem to 7 daysinoperable. OPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramB. One or more trains B.1 Restore train(s) to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sinoperable for reasons OPERABLE status.other than Condition ORA.In accordancewith the RiskInformedCompl eti on Ti meProgramC. --NOTE------C.1 Restore ECCS flow 1 hourNot applicable when equivalent to 100% ofsecond ECCS train a single OPERABLE ORintentionally made train.inoperable. In accordancewith the RiskLess than 100% of the InformedECCS flow equivalent Completion Timeto a single OPERABLE Programtrain available.PALO VERDE UNITS 1,2,3 353iAEDETN.1243.5.3-iAMENDMENT NO. J2-4, EGGS -Operating3.5.3ACTIONS0. Required Action andassoci ated Camp]leti onTime not met.0.1ANDD.2ANDD.3Be in MODE 3.Reduce pressurizerpressure to<1837 psi a.Reduce RCS Tc to<485° F.6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />s12 hours12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sPALO VERDE UNITS 1,2,3 3532AEDETN.143.5.3-2AMENDMENT NO. I-2-4, ECCS -Operating3.5.3SURVEILLANCE REQUIREMENTS__________SURVEILLANCE FREQUENCYSR 3.5.3.1 Verify each ECCS manual , power operated, In accordanceand automatic valve in the flow path, that with theis not locked, sealed, or otherwise secured Surveillancein position, is in the correct position. FrequencyControl ProgramSR 3.5.3.2 Verify ECCS piping is full of water. In accordancewith theSurveillanceFrequencyControl ProgramSR 3.5.3.3 Verify each ECCS pump develops the required In accordancedifferential pressure at the flow test with thepoint. Inservi ceTesting ProgramSR 3.5.3.4 Verify each ECCS automatic valve that is In accordancenot locked, sealed, or otherwise secured in with theposition, in the flow path actuates to the Surveillancecorrect position on an actual or simulated Frequencyactuation signal. Control ProgramSR 3.5.3.5 Verify each ECCS pump starts automatically In accordanceon an actual or simulated actuation signal,. with theSurveillanceFrequencyControl ProgramSR 3.5.3.6 Verify each LPSI pump stops on an actual or In accordancesimulated actuation signal. with theSurveil11anceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,33533AMNETN. 8,3.5.3-3AMENDMENT NO.

EGGS -Operating3.5.3SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCEFREQUENCYSR 3.5.3.7Verify, for each ECCS throttle valve i stedbelow, each position stop is in the correctposi ti on.In accordancewith theSurveillanceFrequencyControl ProgramLPSI SystemValve NumberHot Leg InjectionValve NumbersSIB-UVSIB -UVS IA- UVS IA- UVS IA- HVSIB-HV615625635645306307SIC-HV 321SID-HV 331SR 3.5.3.8 Verify, by visual inspection, each ECCS In accordancetrain containment sump suction inlet is not with therestricted by debris and the suction inlet Surveillancestrainers show no evidence of structural Frequencydistress or abnormal corrosion. Control ProgramPALO VERDE UNITS 1,2,3 3534AEDETN.I~3.5.3-4.AMENDMENT NO.

RWT3.5.53.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.5 Refueling Water Tank (RWT)LCO 3.5.5APPLICABILITY:The RWT shall be OPERABLE.MODES 1, 2, 3, and 4.ACTI ONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. RWT boron A.1 Restore RWT to 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sconcentration not OPERABLE status.within limits. OROR In accordancewith the RiskRWT borated water Informedtemperature not within Completion Timelimits. ProgramB. RWT inoperable for B.1 Restore RWT to 1 hourreasons other than OPERABLE status.Condition A. ORIn accordancewith the RiskInformedCompletion TimeProgramC. Required Action and C.l Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. AND36 hoursC.2 Be in MODE 5.PALO VERDE UNITS 1,2,3355-AMNETNO 473.5.5-1AMENDMENT NO. I-7, Containment AirLocks3.6.2ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIMEB. (continued) B.1 Verify an OPERABLE 1 hourdoor is closed in theaffected air lock.ANDB.2 Lock an OPERABLE door 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sclosed in theaffected air lock.ANDB.3------NOTE----Air lock doors inhigh radiation areasmay be verifiedlocked closed byadministrative means.Verify an OPERABLE Once per 31 daysdoor is locked closedin the affected airlock.C. One or more C.1 Initiate action to Immediatelycontainment air locks evaluate overal linoperable for reasons containment leakageother than Condition A rate per LCO 3.6.1.or B. ANDC.2 Verify a door is 1 hourclosed in theaffected air lock.ANDC.3 Restore air lock to 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sOPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgram(conti nued)AMENDMENT NO. 1-4-7,PALO VERDE UNITS 1,2,3362-3.6.2-3 Containment Isol ati onValves3.6.33.6 CONTAINMENT SYSTEMS3.6.3 Containment Isolation ValvesLCO 3.6.3APPLICABILITY:Each required containment isolation valve shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS----------------~~-NOTES--------------1. Penetration flow paths except for 42 inch purge valve penetration flowpaths may be unisolated intermittently under administrative controls.2. Separate Condition entry is allowed for each penetration flow path.3. Enter applicable Conditions and Required Actions for system(s) madeinoperable by containment isolation valves.4. Enter applicable Conditions and Required Actions of LCO 3.6.1,"Containment," when leakage results in exceeding the overall containmentleakage rate acceptance criteria.5. A 42 inch refueling purge valve is not a required containment isolationvalve when its flow path is isolated with a blind flange tested inaccordance with SR 3.6.1.1.CONDITION REQUIRED ACTION COMPLETION TIMEA. NOTE-----A.1 Isolate the affected 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sOnly applicable to penetration flow pathpenetration flow paths by use of at least ORwith two required one closed and -containment isolation de-activated In accordancevalves, automatic valve, with the Riskclosed manual valve, InformedOne or more blind flange, or Completion Timepeneratin fow pthscheck valve with flow Programwith one requi red throughted vlvcontainment isolation scrdvalve inoperable ANDexcept for purge valveleakage not withinlimit.______________________ _______________________(conti~nued)PALO VERDE UNITS 1,2,3 3631AEDETN.163.6.3-1AMENDMENT NO. 1-66, Containment Isol ati on Valves3.6.3ACTI ONS _________CONDITION REQUIRED ACTION COMPLETION TIMEA. (continued) A.2------NOTE- --Isolation devices inhigh radiation areasmay be verified byuse of admi ni strati vemeans.Verify the affected Once per 31 dayspenetration flow path followingi s i sol ated. i sol ati on fori sol ati ondevices outsidecontai nmentANDPri or toentering MODE 4from MODE 5 ifnot performedwi thin theprevious 92 daysfor i sol ati ondevices insidecontai nmentB. ---NOTE-----B.1 Isolate the affected 1 hourOnly applicable to penetration flow pathpenetration flow paths by use of at least ORwith two requi red one closed and -contai nment i sol ati on de-acti vated In accordancevalves, automatic valve, with the Riskclosed manual valve, Informedor blind flange. Completion TimeOne or more Programpenetration flow pathswith two requi redcontainment i sol ati onvalves inoperableexcept for purge valveleakage not withinlimit.(conti nued)PALO VERDE UNITS 1,2,33.6.3-2AMENDMENT NO. ize6, Containment Isolation Valves3.6.3ACTIONS (continued)_______________ _________CONDITION REQUIRED ACTION COMPLETION TIMEC.-----NOTE------C.l Isolate the affected 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sOnly applicable to penetration flow path ORpenetration flow paths by use of at least -with only one required one closed and In accordancecontainment isolation de-activated with the Riskvalve and a closed automatic valve, Ifresystem. closed manual valve, Ifreor bindflage.Compl eti on Ti meor blnd flnge.ProgramOne or more ANDpenetration flow pathswi th one requi red C.2------NOTE----containment i sol ati on Isol ati on devices i nvalve inoperable, high radiation areasmay be verified byuse of administrativemeans.Verify the affected Once per 31 dayspenetration flow path followingis isolated, isolationD. One or more D.1 Isolate the affected 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />spenetration flow paths penetration flow pathwith one or more by use of at least ORrequi red containment one closed and -purge valves not de-activated In accordancewi thin purge val ve automatic valve with wi th the Riskleakage limits, resilient seals, or Informedbl ind flange. Compl eti on Ti meAND Program(conti nued)PALO VERDE UNITS 1,2,3 3633AEDETN.1~3.6.3-3AMENDMENT NO.

Containment Isol ati on Valves3.6.3ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMED.2D. (continued)------------NOTE----Isolation devices inhigh radiation areasmay be verified byuse of admi ni strati vemeans.Verify the affectedpenetration flow pathis isolated.Once per 31 daysfol lowi ngi sol ati on fori sol ati ondevices outsidecontai nmentANDPri or toentering MODE 4from MODE 5 ifnot performedwi thin theprevious 92 daysfor i sol ati ondevices insidecontai nmentOnce per 92 daysfol lowingi sol ati onANDD.3Perform SR 3.6.3.6for the resilientseal purge valvesclosed to comply withRequired Action D.1.E. Required Action and E.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated CompletionTime not met. ANDE.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,336.4AMNETNO 173.6.3-4AMENDMENT NO.

Containment SpraySystem3.6.63.6 CONTAINMENT SYSTEMS3.6.6 Containment Spray SystemLCO 3.6.6Two containment spray trains shall be OPERABLE.APPLICABILITY:MODES 1, 2, and 3.MODE 4 when RCS pressure is385 psiaACTI ONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One containment spray A.1 Restore containment 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />strain inoperable, spray train toOPERABLE status. ORIn accordancewith the RiskInformedCompl eti on TimeProgramB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime of Condition A ANDnot met.B.2 Be in MODE 4 with RCS 84 hour9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />spressure < 385 psia.C.----NOTE------C.1 Restore at least one 1 hourNot applicable when containment spraysecond containment train to OPERABLE ORspray train status.intentionally made In accordanceinoperable, with the RiskInformedCompletion TimeTwo containment spray Programtrains inoperable.PALO VERDE UNITS 1,2,3366-AMNETNO 1,3.6.6-1AMENDMENT NO. *--A-7-,

Containment Spray System3.6.6ACTIONS (continued) _______________ ________CONDITION REQUIRED ACTION COMPLETION TIMED. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Comp] eti onTime of Condition C ANDnot met.D.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTS_________SURVEILLANCE FREQUENCYSR 3.6.6.1 Verify each containment spray manual , power In accordanceoperated, and automatic valve in the flow with thepath that is not locked, sealed, or Surveillanceotherwise secured in position is in the Frequencycorrect position. Control ProgramSR 3.6.6.2 Verify the containment spray piping is In accordancefull of water to the 113 ft level in the with thecontainment spray header. SurveillanceFrequencyControl ProgramSR 3.6.6.3 Verify each containment spray pump's In accordancedeveloped head at the flow test point is with thegreater than or equal to the required Inservicedeveloped head. Testing ProgramSR 3.6.6.4 Verify each automatic containment spray In accordancevalve in the flow path that is not locked, with thesealed, or otherwise secured in position, Surveillanceactuates to the correct position on an Frequencyactual or simulated actuation signal. Control ProgramPALO VERDE UNITS 1,2,3 3662AEDETN.1&3.6.6-2AMENDMENT NO.

Containment Spray System3.6.6SURVEILLANCE REQUIREMENTS (continued)_________SR 3.6.6.5 Verify each containment spray pump starts In accordanceautomatically on an actual or simulated with theactuation signal. SurveillanceFrequencyControl ProgramSR 3.6.6.6 Verify each spray nozzle is unobstructed. In accordancewith theSurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,336.3AMNETNO3.6.6-3AMENDMENT NO. :!-88, MSIVs3.7.2ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEE. Three or more MSIV E.i Declare each affected Immediatelyactuator trains MSIV inoperable.inoperable.ORRequired Action andassoci ated Compl eti onTime of Condition A,B, or C not met.F. One MSIV inoperable in F.1 Restore MSIV to 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sMODE 1. OPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramG.----NOTE-----G.1 Restore all but one 1 hourNot applicable when MSIV to OPERABLEtwo or more MSIVs status. ORintentionally madeinoperable. In accordancewith the RiskTwo or more MSIVs Informedinoprabe inMOD 1.Completion Timeinoprabe inMOD 1.ProgramH. Required Action and H.1 Be in MODE 2. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sAssoci ated Compl eti onTime of Condition F orG not met.PALO VERDE UNITS 1,2,3 3722AEDETN.133.7.2-2AMENDMENT NO. $68, MS IVs3.7.2ACTIONS (continued)_________I. --NOTE-----1.1 Close MSIV. 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sSeparate Condition ANentry is allowed for ANeach MSIV. 1.2 Verify MSIV is Once per 7 daysclosed.One or more MSIVsinoperable in MODE 2,3, or 4.J. Required Action and J.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime of Condition I ANDnot met.J.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,3 3723AEDETN.T33.7.2-3AMENDMENT NO.

MSIVs3.7.2SURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.7.2.1----------NOTE- -------Not required to be performed prior to entryinto MODE 3.Verify closure time of each MSIV is In accordancewithin limits with each actuator train on with thean actual or simulated actuation signal .InserviceTesting ProgramPALO VERDE UNITS 1,2,33.24AMNETNO ,3.7.2-4AMENDMENT NO.

NPFIVs3.7.33.7 PLANT SYSTEMS3.7.3 Main Feedwater Isolation Valves (MFIVs)LCO 3.7.3APPLICABILITY:Four economizer MFIVs and four downcomer MFIVs shall beOPERABLE.MODES 1, 2, 3, and 4 except when MFIV is closed anddeactivated or isolated by a closed and deactivated poweroperated valve.ACTIONS-----------------~NOTE---- ----------Separate Condition entry is allowed for each penetration flow path.CONDITION REQUIRED ACTION COMPLETION TIMEA. One or more MFIVs A.1 Restore MFIV(s) to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sinoperable. OPERABLE status.ORIn accordanceOR with the RiskOR InformedCompletion TimeProgramA.2.1 Close or isolate 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sinoperable MFIV(s).ANDA.2.2 Verify inoperable Once per 7 daysMFIV(s) is closed or followingisolated. isolationPALO VERDE UNITS 1,2,3 3731AEDETN.153.7.3-1AMENDMENT NO.

MF IVs3.7.3ACTIONS (continued)B. Two valves in thesame flow pathi noperabl e.B.1Restore one valve toOPERABLE status.ORB.2.1 Isolated affectedflow path.ANDB.2.2. Verify inoperableMFIV(s) is closed orisolated.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sORIn accordance withthe Risk InformedCompletion TimeProgram8 hoursOnce per 7 daysfol lowingi sol ati onC. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3,7.3.1 Verify the closure time of each MFIV is In accordance withwithin limits on an actual or simulated the Inserviceactuation signal .Testing ProgramPALO VE~RDE UNITS 1,2,3 3732AEDETN.4-3.7.3-2AMENDMENT NO.

ADVs3.7.43.7 PLANT SYSTEMS3.7.4 Atmospheric Dump Valves (ADVs)LCO 3.7.4APPLICABILITY:Four ADV lines shall be OPERABLE.MODES 1, 2, and 3,MODE 4 when steam generator is being relied upon for heatremoval.ACTIONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. --NOTE-----A.1 Restore ADV line to 7 daysSeparate Condition OPERABLE status.entry is allowed for OReach SG.One equred DV ineIn accordanceinoerabeurdAVln with the Riskinopeable.InformedCompletion TimeProgramB. --NOTE-----B.1 Restore one ADV line 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sRisk Informed to OPERABLE status onCompletion Time not each SG. ORapplicable when allADVs intentionallymade inoperable. In accordancewith the RiskInformedTwo or more ADV lines Completion Timeinoperable with both ProgramADV lines inoperableon one or more SGs.C. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated CompletionTime not met. ANDC.2 Be in MODE 4 without 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sreliance on steamgenerator for heatremioval,PALO VERDE UNITS 1,2,3374-AMN ETNO 11,3.7.4-iAMENDMENT NO. -i-%,

AFW System3.7.53.7 PLANT SYSTEMS3.7.5 Auxiliary Feedwater (AFW) SystemLCO 3.7.5Three AFW trains shall be OPERABLE.~~~~~~-NOTE-----------Only one AEW train, which includes a motor driven pump, isrequired to be OPERABLE in MODE 4.MODES 1, 2, and 3,MODE 4 when steam generator is relied upon for heat removal.APPLICABILITY:ACTIONS---------------~~-NOTE---------------LCO 3.0.4.b is not applicable.CONDITION REQUIRED ACTION COMPLETION TIMEA. One steam supply to A.1 Restore affected 7 daysturbine driven AFW equipment to OPERABLEpump inoperable, status. OROR-NOTE- In accordancewith the RiskOnly applicable if InformedMODE 2 has not beenentered following Completion Timerefueling. ProgramOne turbine driven AFWpump inoperable inMODE 3 followingrefueling.B. One AFW train B.1 Restore AFW train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sinoperable for reasons OPERABLE status.other than Condition A ORin MODE 1, 2, or 3. _In accordancewith the RiskInformedCompletion TimeProgram(conti nued)PALO VERDE UNITS 1,2,33.7.5-1AMENDMENT NO. -!-6-5, AFW System3.7.5ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC.-----NOTE------C.1 Restore at least one 1 hourNot applicable when AFW train to OPERABLEsecond AFW train status.Ointentionally made

• __Rinoperable.In accordancewith the RiskTwo AFW trains Informedinoperable in MODE 1, Completion Time2, or 3. ProgramD. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated CompletionTime of Condition A, ANDB, or C not met.D.2 Be in MODE 4. 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sE. Three AFW trains E.1------NOTE- --inoperable in MODE 1, LCD 3.0.3 and all2, or 3. other LCD RequiredActions requiringMODE changes aresuspended until oneAFW train is restoredto OPERABLE status.Initiate action to Immediatelyrestore one AFW trainto OPERABLE status.F. Required AFW train F.1------NOTE- --inoperable in MODE 4. LCD 3.0.3 and allother LCD RequiredActions requiringMODE changes aresuspended until oneAFW train is restoredto OPERABLE status.Initiate action to Immediatelyrestore one AFW trainto OPERABLE status.PALO VERDE UNITS 1,2,3 3752AEDETN.11~3.7.5-2AMENDMENT NO.

CST3.7.63.7 PLANT SYSTEMS3.7.6 Condensate Storage Tank (CST)LCO 3.7.6APPLICABILITY:The CST shall be OPERABLE.MODES 1, 2, and 3,MODE 4 when steam generator is relied upon for heat removal.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. CST inoperable. A.1 Verify OPERABILITY of 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />sbackup water supply.ANDOnce per12 hoursthereafterANDA.2 Restore CST to 7 daysOPERABLE statusORIn accordancewith the RiskInformedCompletion TimeProgramB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDB.2 Be in MODE 4 without 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sreliance on steamgenerator for heatremoval.PALO VERDE UNITS 1,2,3376-AMNETNO 8,3.7.6-iAMENDMENT NO. IL88, CST3.7.6SURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.6.1 Verify CST level is 29.5 ft. In accordancewith theSurveil1lanceFrequencyControl ProgramiPALO VERDE UNITS 1,2,3 3762AEDETN.--k3.7.6-2AMENDMENT NO.-I-88, EW System3.7.73.7 PLANT SYSTEMS3.7.7 Essential Cooling Water (EW) SystemLCO 3.7.7APPLICABILITY:Two EW trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One EW train A.1------NOTE- --inoperable. Enter applicableConditions andRequired Actions ofLCO 3.4.6, "RCSLoops -MODE 4" forshutdown cooling madeinoperable by EW.Restore EW train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sOPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramB.-----NOTE-----B.1 Restore at least one 1 hourNot applicable when EW train to OPERABLEsecond EW train status. ORintentionally madeinoperable.In accordancewith the RiskTwo EW trains Informedinoperable Completion TimeProgramPALO VERDE UNITS 1,2,3 3771AEDETN.443.7.7-1AMENDMENT NO. %-i-7-.

LW System3.7.7ACTIONS (conti nued)C. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Camp]leti onTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.7.7.1----------NOTE--------Isolation of LW flow to individualcomponents does not render the LW Systeminoperable.Verify each LW manual, power operated, and In accordanceautomatic valve in the flow path servicing with thesafety related equipment, that is not Surveillancelocked, sealed, or otherwise secured in Frequencyposition, is in the correct position. Control ProgramSR 3.1.7.2 Verify each LW automatic valve in the flow In accordancepath that is not locked, sealed, or with theotherwise secured in position, actuates to Surveillancethe correct position on an actual or Frequencysimulated actuation signal. Control ProgramSR 3.7.7.3 Verify each LW pump starts automatically on In accordancean actual or simulated actuation signal,. with theSurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,33772AMNETNO ,3.7.7-2AMENDMENT NO.

3.7 PLANT SYSTEMS3.7.8 Essential Spray Pond System (ESPS)LCO 3.7.8APPLICABILITY:Two ESPS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION ] COMPLETION TIMEA. One ESPS traininoperable.A.1-Notes- --1. Enter applicableConditions andRequi red Actionsof LCO 3.8.1I."AC Sources -Operating," foremergency dieselgenerator madeinoperable byESPS.2. Enter applicableConditions andRequi red Actionsof LCO 3.4.6."RCS Loops -MODE 4," forshutdown coolingmade inoperableby ESPS.Restore ESPS train toOPERABLE status.72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />sORIn accordancewith the RiskInformedCompletion TimeProgramPALO VERDE UNITS 1,2,337.1AMNETNO ,3.7.8-].AMENDMENT NO. !-I-7-,

ACTIONS (continued)B.-----NOTE---Not applicable whensecond ESPS trainintentionally madei noperabl e.Two ESPS trainsi noperabl e.B.1Restore at least oneESPS train toOPERABLE status.1 hourORIn accordancewith the RiskInformedCompletion TimeProgramC. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.8.1----------Notes- ------Isolation of ESPS flow to individualcomponents does not render ESPS inoperable.Verify each ESPS manual and power operated In accordancevalve in the flow path servicing safety with therelated equipment, that is not locked, Surveillancesealed, or otherwise secured in position, Frequencyis in the correct position. Control ProgramSR 3.7.8.2 Verify each ESPS pump starts automatically In accordanceon an actual or simulated actuation signal, with theSurveil11anceFrequencyControl ProgramPALO VERDE UNITS 1,2,33.8-AMN ETNO 8,3.7.8-2AMENDMENT NO. 88, UHS3.7.93.7 PLANT SYSTEMS3.7.9 Ultimate Heat Sink (UHS)LCO 3.7.9APPLICABILITY:The UHS shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA.-----NOTE------A.1 Restore UHS to 1 hourRisk Informed OPERABLE status.Completion Time not ORapplicable when UHS _intentionally madeinoperable. In accordancewith the RiskInformedUHS inoperable. Completion TimeProgramB. Required Action and B.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDB.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,3 3191AEDETN.T83.7.9-1AMENDMENT NO. -I-88, UHS3.7.9SURVE IL LANCE REQU IREMENTS_________SURVEILLANCE FREQUENCYSR 3.7.9.1 Verify the usable water depth of each In accordanceessential spray pond is _> 12 feet. with theSurveill anceFrequencyControl ProgramSR 3.7.9.2 Verify water temperature of each essential In accordancespray pond is _< 89°F. with theSurvei 11 IanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3 3792AEDETN.4~3.7.9-2AMENDMENT NO. -!-88, EC3.7.103.7 PLANT SYSTEMS3.7.10 Essential Chilled Water (EC) SystenmLCD 3.7.10APPLICABILITY:Two EC trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One EC train A.1 Restore EC train to 72 Hoursinoperable. OPERABLE status.ORIn accordancewith the RiskInformedCompl eti on Ti meProgramB.-----NOTE-----B.1 Restore at least one 1 hourNot applicable when EC train to OPERABLEsecond EC train status. ORintentionally madeinoperable.In accordancewith the RiskTwo EC trains Informedinoerale.Compl eti on Ti meinopeable.ProgramC. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated CompletionTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,337.11AMN ETNO -,3.7.10-1AMENDMENT NO. -!-88, EC3.7.10SURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.10.1 Verify each EC System manual, power In accordanceoperated, and automatic valve in the flow with thepath, that is not locked, sealed, or Surveillanceotherwise secured in position, is in the Frequencycorrect position. Control ProgramSR 3.7.10.2 Verify the proper actuation of each [C In accordanceSystem component on an actual or simulated with theactuation signal. SurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3 37.02AEDETN.ig3.7.10-2AMENDMENT NO. JZ-88, C REATCS3.7.123.7 PLANT SYSTEMS3.7.12 Control Room Emergency Air Temperature Control System (CREATCS)LCO 3.7.12APPLICABILITY:Two CREATCS trains shall be OPERABLE.MODES 1, 2, 3, 4, 5, and 6,During movement of irradiated fuel assemblies,ACTIONS _______________CONDITION REQUIRED ACTION COMPLETION TIMEA. One CREATCS train A.1 Restore CREATCS train 30 daysinoperable, to OPERABLE status.B. --NOTE-----B.1 Restore at least one 1 hourNot applicable when CREATCS train tosecond CREATCS train OPERABLE status. ORintentionally made _i noperabl e.In accordancewith the RiskTwo CREATCS trains Informedinoperable in MODE 1, Completion Time2, 3, or 4. ProgramC. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated CompletionTime of Condition A or ANDB not met in MODE 1,2, 3, or 4. C.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sD. Required Action and D.1 Place OPERABLE Immediatelyassociated Comple CREATCS train intion Time of Condition operation.A not met in MODE 5or 6.(conti nued)PALO VERDE UNITS 1,2,3 371- MNMN O 1..3.7.12-1AMENDMENT NO. &&

CREATCS3.7.12ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEE. Required Action and E.1 Place OPERABLE Immediatelyassociated Completion CREATCS train inTime of Condition A operationnot met during Omovement of irradiated ORfuel assemblies. E.2 Suspend movement of Immediatelyirradiated fuelassemblies.F. Two CREATCS trains F.l Suspend CORE Immediatelyinoperable in MODE 5 ALTERATIONS.or 6, or duringmovement of irradiated ANDfuel assemblies.F.? Suspend movement of Immediatelyirradiated fuelassemblies.SURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.7.12.1 Verify each CREATCS train has the In accordancecapability to remove the assumed heat load, with theSurveil11anceFrequencyControl ProgramPALO VERDE UNITS 1,2,33..22AMNETNO g,3.7.12-2AMENDMENT NO.

AC Sources -Operating3.8.1ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEA. (continued) A.3 Restore required 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />soffsite circuit toOPERABLE status. ORIn accordancewith the RiskInformedCompletion TimeProgramB. One DG inoperable.B.1ANDB.2ANDB.3.1ORB.3.2Perform SR 3.8.1.1for the OPERABLErequired offsitecircuit(s).Declare requiredfeature(s) supportedby the inoperable DOinoperable when itsredundant requi redfeature(s) isinoperable.Determine OPERABLEDG is notinoperable due tocommon cause failure.Perform SR 3.8.1.2for OPERABLE DG.1 hourANDOnce per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />sthereafter4 hours fromdiscovery ofCondition Bconcurrent withinoperability ofredundantrequi redfeature(s)24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s24 hours(conti nued)ANDPALO VERDE UNITS 1,2,338.2AMNETNO -43.8.1-2AMENDMENT NO.

AC Sources -Operating3.8.1ACTIONSCONDITION REQUIRED ACTION COMPLETION TIMEB. (continued) B.4 Restore DG 10 daysto OPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramC. Two required offsite C.1 Declare required 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> fromcircuits inoperable, feature(s) inoperable discovery ofwhen its redundant Condition Crequired feature(s) concurrent withis inoperable. inoperability ofredundantrequi redfeature(s)ANDC.2 Restore one required 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />soffsite circuit toOPERABLE status. ORIn accordancewith the RiskInformedCompletion TimeProgram(conti nued)PALO VERDE UNITS 1,2,3 3B13AEDETN.143.8.1-3AMENDMENT NO. A-64, AC Sources -Operating3.8.1ACTIONS (continued)CONDITION I REQUIRED ACTION COMPLETION TIMED. One required offsitecircuit inoperable.ANDOne DO inoperable.-------------NOTE-----Enter applicable Conditionsand Requi red Actions ofLCD 3.8.9, "DistributionSystems -Operating," whenCondi ti on D i s entered withno AC power source to atrain.D.1ORRestore requi redoffsite circuitsOPERABLE status.to12 hoursORIn accordancewith the RiskInformedCompl eti on Ti meProgram12 hoursORIn accordancewith the RiskInformedCompl eti on Ti meProgramD.2Restore DGto OPERABLE status.E. Two D~s inoperable. E.1 Restore one DG to 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sOPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgramPALO VERDE UNITS 1,2,3 3814AEDETN.143.8.1-4AMENDMENT NO. -i-I-7-,

AC Sources -Operating3.8.1ACTIONS (continued)_________CONDITION REQUIRED ACTION COMPLETION TIMEF. One automatic load V.1 Restore automatic 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />sequencer inoperable, load sequencer toOPERABLE status. ORAN D In accordancewith the RiskInformedCompletion TimeProgramF.2 Declare required 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> fromfeature(s) supported discovery ofby the inoperable Condition Fsequencer inoperable concurrent withwhen its redundant inoperability ofrequired feature(s) redundantis inoperable, requiredfeature(s)G.-----NOTE-----G.1 Restore required AC 1 hourNot applicable when source(s) to OPERABLEthree or more required status. ORAC sources _intentionally madeinoperable. In accordancewith the RiskInformedThree or more required Completion TimeAC sources inoperable. Program(continued)PALO VERDE UNITS 1,2,33..5AMNETNO 2,3.8.1-5AMENDMENT NO.

AC Sources -Operating3.8.1ACTIONS (conti nued)CONDITION REQUIRED ACTION COMPLETION TIMEH. One or more required H.1 Restore required 1 houroffsite circuit(s) do capability of thenot meet requi red offsi te ci rcui t(s).capabilIi ty. OR--------------NOTE-----Enter LCO 3.8.1 Condi ti on Aor C for required offsitecircuit(s) inoperable.H.2 Transfer the [SF 1 hourbus(es) from theoffsite circuit(s) tothe EDG(s).I. Required Action and 1.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sAssociated Completion ANDTime of Condi ti on A,B, C, D, E, F, G, or 12 B nMD .3 orH not met. ' 12 B nMD .3 orPALO VERDE UNITS 1,2,3 3816AEDETN.1~3.8.1-6AMENDMENT NO. -i-88, AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.8.1.1 Verify correct breaker alignment and In accordanceindicated power availability for each with therequi red offsi te ci rcui t. Surveill IanceFrequencyControl ProgramSR 3.8.1.2--------------NOTES- ------1. Performance of SR 3.8.1.7 satisfiesthis SR.2. All DG starts may be preceded by anengine prelube period and followed bya warmup period prior to loading.3. A modified DG start involving idlingand gradual acceleration tosynchronous speed may be used forthis SR as recommended by themanufacturer. When modified startprocedures are not used, the time,voltage, and frequency tolerancesof SR 3.8.1.7 must be met.4. The steady state voltage andfrequency limits are analyzed valuesand have not been adjusted forinstrument error.Verify each DG starts from standbycondition and achieves steady statevoltage 4000 V and 4377.2 V, andfrequency 59.7 Hz and 60.7 Hz.In accordancewith theSurveillanceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,3 3817AEDETN.1~3.8,1-7AMENDMENT NO. -!-88, AC Sources -Operating3.8.1SURVEILLANCEREQUIREMENTS (continued)SURVEILLANCEFR EQ U ENCYSR 3.8.1.3----------NOTES--------1. DG loadings may include gradualloading as recommended by themanufacturer.2. Momentary transients outside the loadrange do not invalidate this test.3. This Surveillance shall be conductedon only one DG at a time.4. This SR shall be preceded by andimmediately follow without shutdown asuccessful performance of SR 3.8.1.2or SR 3.8.1.7.Verify each DG is synchronized and loaded,and operates for 60 minutes at a load>4950 kW and 5500 kW.In accordancewith theSurveil11anceFrequencyControl ProgramSR 3.8.1.4 Verify each day tank contains 550 gal of In accordancefuel oil (minimum level of 2.75 feet). with theSurveillanceFrequencyControl ProgramSR 3.8.1.5 Check for and remove accumulated water from In accordanceeach day tank. with theSurveil11anceFrequencyControl ProgramSR 3.8.1.6 Verify the fuel oil transfer system In accordanceoperates to automatically transfer fuel with theoil from the storage tank to the day tank. SurveillanceFrequencyControl Program(continued)PALO VERDE UNITS 1,2,33.18AMNETNO ,3.8.1-8AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCEREQU I REM ENTS(continued)SURVEILLANCEFREQUENCYSR 3.8.1.7----------NOTE--------1. All DG starts may be preceded by anengine prelube period followed by awarmup period prior to loading.2. The steady state voltage and frequencylimits are analyzed values and have notbeen adjusted for instrument error.Verify each DG starts from standbycondi ti on and achi evesa. In < 10 seconds, voltage _> 3740 V andfrequency >_ 58.8 Hz; andb. Steady state voltage > 4000 V and_< 4371.2 V, and frequency > 59.7 Hzand _< 60.7 Hz.In accordancewith theSurveillanceFrequencyControl Program+SR 3.8.1.8-~~-NOTE--------This Surveillance shall not normally beperformed in MODE 1 or 2. However, thisSurveillance may be performed toreestablish OPERABILITY provided anassessment determines the safety of theplant is maintained or enhanced.Verify manual transfer of AC power sourcesfrom the normal offsite circuit to eachalternate offsite circuit.In accordancewith theSurveill anceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,3 3819AEDETN..-~3.8.1-9AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCEFREQUENCYSR 3.8.1.9-------------NOTE-- -----This Surveillance shall not normally beperformed in MODE 1, 2, 3, or 4. However,this Surveillance may be performed toreestablish OPERABILITY provided anassessment determines the safety of theplant is maintained or enhanced.Verify each DG rejects a load greater thanor equal to its associated single largestpost-accident load, and:a. Following load rejection, thefrequency is 64.5 Hz;b. Within 3 seconds following loadrejection, the voltage is 3740 Vand 4580 V; andc. Within 3 seconds following loadrejection, the frequency is58.8 Hz and 61.2 Hz.In accordancewith theSurveil11anceFrequencyControl ProgramSR 3.8.1.10-------------NOTE-------If performed with the DG synchronized withoffsite power, it shall be performed at apower factor of 0.89. However, if gridconditions do not permit, the power factorlimit is not required to be met. Underthis condition the power factor shall bemaintained as close to the limit aspracticable.Verify each DG does not trip, andis maintained 6200 V during anda load rejection of 4950 kW and<5500 kW.voltagefollowingIn accordancewith theSurveillanceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,33.81-0AEDNT O.4g3.8.1-10AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)_________SURVEILLANCE FREQUENCYSR 3.8.1.11---------NOTE--------1. All OG starts may be preceded by anengine prelube period.2. This Surveillance shall not normallybe performed in MODE 1, 2, 3, or 4.However, portions of the Surveillancemay be performed to reestablishOPERABILITY provided an assessmentdetermines the safety of the plant ismaintained or enhanced.3. Momentary voltage and frequencytransients induced by load changes donot invalidate this test.4. The steady state voltage and frequencylimits are analyzed values and havenot been adjusted for instrumenterror.Verify on an actual or simulated loss of In accordanceoffsite power signal: with theSurveil11ancea. De-energization of emergency buses; FrequencyControl Programb. Load shedding from emergency buses;c. DG auto-starts and:1. energizes permanently connectedloads in 10 seconds,2. energizes auto-connectedemergency loads through automaticload sequencer,3. maintains steady state voltage4000 V and 4377.2 V,4. maintains steady state frequency59.7 Hz and 60.7 Hz, and5. supplies permanently connectedand auto-connected emergencyloads for 5 minutes.(continued)PALO VERDE UNITS 1,2,338.-1AMNETNO ,3.8.1-11AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVE ILLANCEFREQUENCYSR 3.8.1.12-~~~~NOTES-------1. All OG starts may be preceded by anengine prelube period.2. This Surveillance shall not normallybe performed in MODE 1, 2, 3, or 4.However, portions of the Surveillancemay be performed to reestablishOPERABILITY provided an assessmentdetermines the safety of the plant ismaintained or enhanced.3. The steady state voltage and frequencylimits are analyzed values and havenot been adjusted for instrumenterror.Verify on an actual or simulated EngineeredSafety Feature (ESF) actuation signal(without a loss of offsite power) eachDG auto-starts and:a. In 10 seconds, achieves voltage3740 V and frequency 58.8 Hz:b. Achieves steady state voltage 4000and 4371.2 V and frequency 59.7 Hzand 60.1 Hz;c. Operates for 5 minuteson standby (running unloaded);d. Permanently connected loads remainenergized from the offsite powersystem; ande. Emergency loads are energized (auto-connected through the automatic loadsequencer) from the offsite powersystem.In accordancewith theSurveillanceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,3 38 -2AEDETN.4~3.8.1-12AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCE FREQUENCYSR 3.8.1.13Verify each DG automatic trip is bypassed In accordanceon actual or simulated loss of voltage with thesignal on the emergency bus concurrent with Surveillancean actual or simulated ESF actuation Frequencysignal except: Control Programa. Engine overspeed;b. Generator differential current;c. Engine low lube oil pressure; andd. Manual emergency stop trip.(continued)PALO VERDE UNITS 1,2,338.13AMNETNO ,3.8.1-13AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCEFREQUENCYSR 3.8.1.14-~~NOTES---1. Momentary transients outsiderange do not invalidate thisthe loadtest.2. If performed with the DG synchronizedwith offsite power, it shall beperformed at a power factor of 0.89.However, if grid conditions do notpermit, the power factor limit is notrequired to be met. Under thiscondition the power factor shall bemaintained as close to the limit aspracticable.3. All DO starts may be preceded by anengine prelube period followed by awarmup period prior to loading.4. DG loading may include gradual loadingas recommended by the manufacturer.Verify each DG operates for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s:a. For 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> loaded 4950 kW and5500 kW; andb. For the remaining hours ( 2) of thetest loaded 5775 kW and 6050 kW.In accordancewith theSurveillanceFrequencyControl Program(continued)PALO VERDE UNITS 1,2,33.8114AEDNT O.ig3.8.1-14AMENDMENT NO.

AC Sources -Operati ng3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCEFREQUENCYSR 3.8.1.15-------------NOTES--------1. This Surveillance shall be performedwithin 5 minutes of shutting down theDG after the DG, loaded 4950 kW and5500 kW, has operated 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> oruntil temperatures have stabilized.Momentary transients outside of loadrange do not invalidate this test.2. All DG starts may be preceded by anengine prelube period.3. The steady state voltage and frequencylimits are analyzed values and havenot been adjusted for instrumenterror.Verify each DG starts and achievesa. In 10 seconds, voltage 3740 V andfrequency 58.8 Hz; andb. Steady state voltage 4000 V and4377.2 V, and frequency 59.7 Hzand 60.7 Hz.In accordancewith theSurveillanceFrequencyControl ProgramSR 3.8.1.16-------------NOTE- ------This Surveillance shall not normally beperformed in MODE 1, 2, 3, or 4. However,this Surveillance may be performed toreestablish OPERABILITY provided anassessment determines the safety of theplant is maintained or enhanced.Verify each DG:a. Synchronizes with offsite power sourcewhile loaded with emergency loads upona simulated restoration of offsitepower;b. Transfers loads to offsite powersource; andc. Returns to ready-to-load operation.In accordancewith theSurveillanceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,338.15AMN ETNO ,3.8.1-15AMENDMENT NO.

AC Sources -Operating3.8.1SURVEILLANCEREQUIREMENTS (conti nued)SURVEILLANCEFREQUENCYSR 3.8.1.17------------NOTE--------This Surveillance shall not normally beperformed in MODE 1, 2, 3, or 4. However,portions of the Surveillance may beperformed to reestablish OPERABILITYprovided an assessment determines thesafety of the plant is maintained orenhanced.Verify, with a DG operating in test modeand connected to its bus, an actual orsimulated ESF actuation signal overridesthe test mode by:a. Returning DG to ready-to-loadoperation; andb. Automatically energizing the emergencyload from offsite power.In accordancewith theSurveillanceFreuecyControl ProgramSR 3.8.1.18---------NOTE--------This Surveillance shall not normally beperformed in MODE 1, 2, 3, or 4. However,this Surveillance may be performed toreestablish OPERABILITY provided anassessment determines the safety of theplant is maintained or enhanced.Verify interval between each sequenced loadblock is within +/- 1 second of designinterval for each automatic load sequencer.In accordancewith theSurveil11anceFrequencyControl Program(conti nued)PALO VERDE UNITS 1,2,3 38 -6AEDETN.-~3.8.1-16AMENDMENT AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS(continued)SURVEILLANCEFREQUENCYSR 3.8.1.19------------NOTES- ------1. All DG starts may be preceded by anengine prelube period.2. This Surveillance shall not normallybe performed in MODE 1, 2, 3, or 4.However, portions of the Surveillancemay be performed to reestablishOPERABILITY provided an assessmentdetermines the safety of the plant ismaintained or enhanced.3. The steady state voltage and frequencylimits are analyzed values and havenot been adjusted for instrumenterror.Verify on an actual or simulated loss ofoffsite power signal in conjunction with anactual or simulated ESF actuation signal:a. De-energization of emergency buses;b. Load shedding from emergency buses;c. DO auto-starts from standby conditionand:1. energizes permanently connectedloads in 10 seconds,2. energizes auto-connectedemergency loads through loadsequencer,3. achieves steady state voltage4000 V and 4377.2 V,4. achieves steady state frequency59.7 Hz and 60.7 Hz, and5. supplies permanently connectedand auto-connected emergencyloads for 5 minutes.In accordancewith theSurveillanceFrequencyControl Program(continued)PALO VERDE UNITS 1,2,3 38 -7AEDETN.156 83.8.1-17AMENDMENT NO. -I-56, 188 AC Sources -Operating3.8.1SURVEILLANCE REQUIREMENTS (continued)SURVEILLANCE FREQUENCYSR 3.8.1.20 NOTES--------1. All DG starts may be preceded by anengine prelube period.2. The steady state voltage and frequencylimits are analyzed values and havenot been adjusted for instrumenterror.Verify, when started simultaneously, each In accordanceDG achieves with thea. In 10 seconds, voltage 3740 V and Surveillancefrequency 58.8 Hz; and Frequencyb. Steady state voltage 4000 V and Control Program4377.2 V, and frequency 59.7 Hzand 60.7 Hz.PALO VERDE UNITS 1,2,3381-8AEDNTO.I,3.8.1-].8AMENDMENT NO. &-88, DC Sources -Operating3.8.43.8 ELECTRICAL POWER SYSTEMS3.8.4 DC Sources -OperatingLCO 3.8.4APPLICABILITY:The Train A and Train B DC electrical power subsystems shallbe OPERABLE.MODES 1, 2, 3, and 4.ACTI ONSCONDITION REQUIRED ACTION COMPLETION TIMEA. One battery charger on A.l Restore battery 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sone subsystem terminal voltage toinoperable, greater than or equal ORto the minimumestablished float In accordancevoltage, with the RiskAND Informedw Completion TimeProgramA.2 Verify battery float Once per 12current 2 amps. hoursANDA.3 Restore battery 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />scharger to OPERABLEstatus. ORIn accordancewith the RiskInformedCompletion TimeProgramPALO VERDE UNITS 1,2,3 384iAEDETN.~3.8.4-iAMENDMENT NO.

DC Sources -Operating3.8.4ACTIONS (continued)_________B.On D eecrialB.1 Restore DC electrical 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sB. oner DCuelectrica power subsystem topoe ubytmOPERABLE status ORinoperable for reasons _other thanCondition A. In accordancewith the RiskInformedCompletion TimeProgramC. --NOTE-----C.1 Restore at least one 1 hourNot applicable when DC electrical powersecond DC electrical subsystem to OPERABLE ORpower subsystem status. -intentionally madeinoperable. In accordancewith the RiskInformedTwo DC electrical Completion Timepower subsystems Programinoperable.D. Required Action and D.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. AND0.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sPALO VERDE UNITS 1,2,3 3842AEDETN.1~3.8.4-2AMENDMENT NO.

DC Sources -Operating3.8.4SURVEILLANCE REQUIREMENTSSURVEILLANCE FREQUENCYSR 3.8.4.1 Verify battery terminal voltage is greater In accordancethan or equal to the minimum established with thefloat voltage. Surveil11anceFrequencyControl ProgramSR 3.8.4.2 DeletedSR 3.8.4.3 DeletedSR 3.8.4.4 DeletedSR 3.8.4.5 DeletedSR 3.8.4.6 Verify each battery charger supplies In accordance>400 amps for Batteries A and B and with the>300 amps for Batteries C and D at Surveillancegreater than or equal to the minimum Frequencyestablished float voltage for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Control ProgramORVerify each battery charger can rechargethe battery to the fully charged statewithin 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while supplying the largestcombined demands of the various continuoussteady state loads, after a batterydischarge to the bounding design basisevent discharge state.(conti nued)PALO VERDE UNITS 1,2,3384-AMNETND 9,3.8.4-3AMENDMENT NO.

DC Sources -Operati ng3.8.4SURVEILLANCEREQUIREMENTS (conti nued)SURVEILLANCEFREQUENCYSR 3.8.4.7----------NOTES--------1. The modified performance discharge testin SR 3.8.6.9 may be performed in lieuof SR 3.8.4.7.2. This Surveillance shall not beperformed in MODE 1, 2. 3, or 4.Verify battery capacity is adequate tosupply, and maintain in OPERABLE status,the required emergency loads for the designduty cycle when subjected to a batteryservice test.In accordancewith theSurveillanceFreuecyControl ProgramSR 3.8.4.8 DeletedPALO VERDE UNITS 1,2,3384-AMN ETNO 1g3.8.4-4AMENDMENT NO. %,

Inverters -Operating3.8.73.8 ELECTRICAL POWER SYSTEMS3.8.7 Inverters -OperatingLCO 3.8.7The required Train A and Train B inverters shall beOPERABLE.-~~~~~~NOTE-----------One inverter may be disconnected from its associated DC busfor 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on itsassociated battery, provided:a. The associated AC vital instrument bus is energizedits Class 1E constant voltage source regulator: andfromb. All other AC vital instrument buses are energized fromtheir associated OPERABLE inverters.APPLICABILITY:MODES 1, 2, 3, and 4.ACTIONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. One required inverter A.1------NOTE-- --i noperabl e. Enter appl icableCondi ti ons andRequi red Actions ofLCO 3.8.9,"Di stri buti onSystems -Operating"with any vitalinstrument busde-energi zed.Restore inverter to 7 daysOPERABLE status.ORIn accordancewith the RiskInformedCompletion TimeProgram(conti nued)PALO VERDE UNITS 1,2,338.-AMN ETNO 3d3.8.7-IAMENDMENT NO.

Inverters -Operating3.8.7ACTIONS (continued)_________CONDITION REQUIRED ACTION COMPLETION TIMEB. --NOTE-----B.1 Restore all but one 1 hourNot applicable when inverter to OPERABLEtwo or more required status. ORi nverters _intentionally madeinoperable resulting In accordancein loss of safety with the Riskfuncti on. InformedCompl eti on Ti meProgramTwo or more requiredinverters inoperable.C. Required Action and C.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassoci ated Compl eti onTime not met. ANDC.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCEREQUIREMENTS _________SURVEILLANCE FREQUENCYSR 3.8.7.1 Verify correct inverter voltage, frequency, In accordanceand alignment to required AC vital with theinstrument buses. SurveillanceFrequencyControl ProgramPALO VERDE UNITS 1,2,3387-AMNETNO SB3.8.7-2AMENDMENT NO.

Distribution Systems -Operating3.8.93.8 ELECTRICAL POWER SYSTEMS3.8.9 Distribution Systems -OperatingLCO 3.8.9APPLICABILITY:electrical power distribution subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS_________________________CONDITION REQUIRED ACTION COMPLETION TIMEA. One AC electrical A.1 Restore AC electrical 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />spower distribution power distributionsubsystem inoperable, subsystem to OPERABLE ORstatus.In accordancewith the RiskInformedCompletion TimeProgramB. One AC vital B.1 Restore AC vital 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sinstrument bus instrument buselectrical power electrical power ORdistribution subsystem distribution -inoperable, subsystem to OPERABLE In accordancestatus. with the RiskInformedCompl eti on Ti meProgram(conti nued)PALO VERDE UNITS 1.2,3389-AMN ETNO 17,3.8.9-IAMENDMENT NO. i-1-7-,

Distribution Systems -Operating3.8.9ACTIONS (continued)CONDITION REQUIRED ACTION COMPLETION TIMEC. One DC electrical C.1 Restore DC electrical 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />spower distribution power distributionsubsystems inoperable, subsystem to OPERABLE ORstatus.In accordancewith the RiskInformedCompl eti on Ti meProgramD.-----NOTE-----D.1i Restore el ectri cal 1 hourNot appl icabl e when power di stri buti ontwo or more electrical subsystem(s) to Opower distribution OPERABLE status. ORsubsystemsintentionally made In accordanceinoperable resulting with the Riskin loss of safety Informedfunction. Completion TimeProgramTwo or more electricalpower distributionsubsystems i nope rabl e.E. Required Action and E.1 Be in MODE 3. 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sassociated Completion ANDTime not met.E.2 Be in MODE 5. 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />sSURVEILLANCE REQUIREMENTS__________SURVEILLANCE FREQUENCYSR 3.8.9.1 Verify correct breaker alignments and In accordancevoltage to required AC, DC, and AC vital with theinstrument bus electrical power Surveillancedi stri buti on subsystems. FrequencyControl ProgramPALO VERDE UNITS 1,2,3 3892AEDETN.*~g3.8.9-2AMENDMENT NO. -i-88, Programs andManuals5.55.5 Programs and Manuals (continued)5 .5 .20Risk Informed Completion Time ProgramThis program provides controls to calculate a Risk Informed(RICT) and must be implemented in accordance with NEI 06-09"Risk-Managed Technical Specifications (RMTS) Guidelines."include the following:Completion Time(Revision 0) -A,The program shalla. The RICT may not exceed 30 days;b. A RICT may only be utilized in MODE 1, 2;c. When a RICT is being used, any plant configuration change within the scopeof the Risk Informed Completion Time Program must be considered for theeffect on the RICT.1. For planned changes, the revised RICT must be determined prior toimplementation of the change in configuration.2. For emergent conditions, the revised RICT must be determined within thetime limits of the Required Action Completion Time (i.e., not the RICT)or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less.3. Revisng the RICT is not required if the plant configuration change wouldlower plant risk and would result in a longer RICT.d. Use of a RICT is not permitted for voluntary entry into a configurationwhich represents a loss of a specified safety function or inoperability ofall required trains of a system required to be OPERABLE.e. Use of a RICT is permitted fora specified safety function orsystem required to be OPERABLE"PRA functional" as defined inemergent conditions which represent a loss ofinoperability of all required trains of aif one or more of the trains are consideredSection 2.3.1 of NEI 06-09 (Revision 0) -A.PALO VERDE UNITS 1,2,3 552 MNMN O5.5-20AMENDMENT NO.

EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACH MENT 3Technical Specification Bases ChangesTS Bases PagesB 3.3.4-10B 3.3.6-16B 3.3.6-17B 3.3.6-18B 3.3.6-19B 3.4.9-5B 3.4.10-3B 3.4.12-3B 3.4.12-4B 3.5.1-7B 3.5.1-8B 3.5.3-6B 3.5.3-7B 3.5.5-7B 3.5.5-8B 3.6.2-7B 3.6.3-10B 3.6.3-11B 3.6.3-12B 3.6.3-13B 3.6.3-14B 3.6.3-15B 3.6.6-5B 3.6.6-6B 3.7.2-7B 3.7.2-8B 3.7.3-3B 3.7.3-4B 3.7.4-5B 3.7.5-5B 3.7.5-6B 3.7.5-7B 3.7.5-8B 3.7.6-3B 3.7.7-3B 3.7.7-4B 3.7.8-3B 3.7.9-2B 3.7.10-3B 3.7.12-2B 3.7.12-3B 3.7.12-4B 3.8.1-9B 3.8.1-12B 3.8.1-13B 3.8.1-14B 3.8.1-15B 3.8.1-16B 3.8.1-17B 3.8.1-18B 3.8.1-19B 3.8.1-20B 3.8.1-21B 3.8.1-22B 3.8.4-5B 3.8.4-6B 3.8.4-7B 3.8.4-8B 3.8.7-3B 3.8.7-4B 3.8.9-4B 3.8.9-5B 3.8.9-6B 3.8.9-7B 3.8.9-8B 3.8.9-9 RPS Logic and Trip InitiationB 3.3.4BASESACTIONS A.1lori mcordnmeith Condition A applies if one Matrix Logic channel isthe Rsklnrmed inoperable or three Matrix Logic channels inoperable due tothmpetRisk Tirmed a common power source failure de-energizing three matrixower supplies in any applicable MODE. Loss of a singleIProgram. Vi 1 instrument bus will de-energize one of the two matrix* powe supplies in up to three matrices. This is considereda singT -matrix failure, providing the matrix relaysassociate ith the failed power supplies de-energize asrequired. Tnchannel must be restored to OPERABLE statuswithin 48 hou s. The Completion Time of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> providesthe operator time to take appropriate actions and stillensures that any risk involved in operating with a failedchannel is acceptable. Operating experience hasdemonstrated that the probability of a random failure of asecond Matrix Logic channel is low during any given 48 hourinterval .If the channel cannot be restored to OPERABLEstatus wi thin 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, Condition E is entered.B.1, 8.2.1, and 8.2.2Condi ti on B applies to one Ini ti ation Logic channel, RTCBchannel, or Manual Trip channel in MODES 1 and 2, since theyhave the same actions. MODES 3, 4, and 5, with the RTCBsshut, are addressed in Condition C. These Required Actionsrequire opening of the affected RTCB, or the redundant RTCBin the affected Trip Leg. This removes the need for theaffected Trip Leg by performing its associated safetyfunction. With an RTCB open, the affected Functions are inone-out-of-two logic, which meets redundancy requirements,but testing on the OPERABLE channels cannot be performedwithout causing a reactor trip unless the RTCBs in theinoperable channels are closed to permit testing.Therefore, a Note has been added specifying that the RTCBsassociated with one inoperable channel may be closed for upto 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for the performance of an RPS CHANNEL FUNCTIONALTEST.(conti nued)PALO VERDE UNITS 1,2,3 B3341 EIIN~B 3.3.4-10REVISION ESFAS Logic and Manual TripB 3.3.6BASESACTIONS A.lI (continued)The channel must be restored to OPERABLE status within48 hu .This provides the operator with time to takea ;!riate actions and still ensures that any riskacoranenvlvdin operating with a failed channel is acceptable.accoranceOperating experience has demonstrated that the probabilitythe Risk of a random failure of a second Matrix Logic channel is lowmed during any given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. If the channel cannot bepletion Time restored to OPERABLE status with 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, Condition E isram ntered.Con tion B applies to one Manual Trip or Initiation Logicchannel1_inoperable.The cha pel must be restored to OPERABLE status within48 hour Operating experience has demonstrated that theprobability of a random failure in a second channel is lowduring any given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period.Failure of a single Initiation Logic channel may open onecontact affecting both Actuation Logic channels. For thepurposes of this Specification, the Actuation Logic is notinoperable. This prevents the need to enter LCO 3.0.3 inthe event of an Initiation Logic channel failure. TheActions differ from those involving one RPS manual channelinoperable, because in the case of the RPS, opening RTCBscan be easily performed and verified. Opening ani ni tiati on rel ay contact is more di fficul t to verify, andsubsequent shorting of the contact is always possible.C.1 and C.2Condition C applies to the failure of both Initiation Logicchannels affecting the same trip leg.In this case, the Actuation Logic channels are notinoperable, since they are in one-out-of-two logic andcapable of performing as requi red. This obviates the needto enter LCO 3.0.3 in the event of a matrix or vital buspower failure.(conti nued)PALO VERDE UNITS 1,2,3B33.-6RVSOB 3.3.6-16REVISION g ESFAS Logic and Manual TripB 3.3.6BASESACTIONS C_.1 and C.2 (continued) /j-channels (ed. change)Both Initiation Logic channel n the same trip leg willde-energize if a matrix pow #supply or vital instrumentbus is lost. This will o jn the Actuation Logic contacts,satisfying the Require 'ction to open at least one set ofcontacts in the affe ued trip leg. Indefinite operation inthis condition is because of the difficulty ofensuring the c ]tacts remain open under all conditions.Thus, the be restored to OPERABLE statuswithin 48 hou .This provides the operator with time toorin accordance take appr ira'te actions and still ensures that any riskwith the Risk l' vg~- i n operating with a fai led channel is acceptable.Informed erating experience has demonstrated that the probabilityof a random failure of a second channel is low during anyCompletion Time given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. If the channel cannot be restored toProgram OPERABLE status with 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, Condition E is entered.Of greater concern is the failure of the initiation circuitin a nontrip condition (e.g., due to two initiation relayfailures). With one failed, there is still the redundantcontact in the trip leg of each Actuation Logic. With bothfailed in a nontrip condition, the ESFAS Function is lostin the affected train. To prevent this, immediate openingof at least one contact in the affected trip leg isrequired. If the required contact has not opened, asi ndi cated by annunci ati on or trip l eg current lamps, ManualTrip of the affected trip leg contacts may be attempted.Caution must be exercised, since operating the wrong ESFAShandswitch may result in an ESFAS actuation.D.1Condi ti on D applies to Actuati on Logi c.With one Actuation Logic channel inoperable, automaticactuation of one train of ESF may be inhibited. Theremaining train provi des adequate protecti on i n the eventof Design Basis Accidents, but the single failure criterionmay be violated. For this reason operation in thiscondi ti on i s restricted.(conti nued)PALO VERDE UNITS 1,2,3 B3361 EIIN2B 3.3.6-17REVISION 2-7 ESFAS Logic and Manual TripB 3.3.6BASESACTI ONSD.1 (continued)The channel must be restored to OPERABLE status within48 hour .Operating experience has demonstrated that theprobab/i ity of a random failure in the Actuation Logic ofthe econd train is low during a given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period.or in accordance F Failure of a single Initiation Logic channel, matrixwith the Risk c Jhannel power supply, or vital instrument bus may open onellnfomed or both contacts in the same trip leg in both ActuationICompletion Time I Logic channels. For the purposes of this Specification,i~rogam I the Actuation Logic is not inoperable. This obviates theProramneed to enter LCO 3.0.3 in the event of a vital bus,matrix, or initiation channel failure.Each Actuation Logic channel has two sets of redundantpower supplies. The power supplies in each set are poweredfrom different vital instrument buses. Failure of a singlepower supply or a set of power supplies due to the loss ofa vital instrument bus, does not affect the operation ofthe Actuation Logic because the redundant power suppliescan supply the full system load. For the purposes of thisspecification, the Actuation Logic is not inoperable.Required Action D.1 is modified by a Note to indicate thatone channel of Actuation Logic may be bypassed for up to1 hour for Surveillance, provided the other channel isOPERABLE.This allows performance of a PPS CHANNEL FUNCTIONAL TESTan OPERABLE ESFAS trai.n without generating an ESFASactuation in the inoperable train.on~IInsertand[E~~1LJ~If the Required Actions and associated Completion Times ofConditions for CSAS, MSIS or AFAS cannot be met, the plantmust be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to atleast MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challenging plant systems.(continued)PALO VERDE UNITS 1,2,3B336-8RVSOB 3.3.6-18REVISION Insert for page B 3.3.6-18E.1With two Actuation Logic channeis inoperabie, the Required Action is to restore at leastone channel to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time isacceptable because it minimizes risk while allowing time for restoration of at least onechannel. Alternately, a Completion Time can be determined in accordance with the RiskInformed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the secondActuation Logic channel is intentionally made inoperable. This Required Action is notintended for voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one Actuation Logic channel is inoperable for anyreason and a second Actuation Logic channel is found to be inoperable, or if twoActuation Logic channels are found to be inoperable at the same time.

ESFAS Logic and Manual TripB 3.3.6(conti nued)If the Required Actions and associated Completion Times forSIAS, CIAS, or RAS are not met, the plant must be broughtto a MODE in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within6 hours and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. If the RequiredActions and associated Completion Times for SIAS, CIAS, orRAS Matrix Logic are not met this Action may be exited whenthe plant is brought to MODE 4 since the LCO does not applyin MODE 4. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from full power conditions in an orderly mannerand without challIengi ng pl ant systems.SURVEILLANCE SR 3.3.6.1REQU IREMENTSA CHANNEL FUNCTIONAL TEST is performed to ensure the entirechannel will perform its intended function when needed.The CHANNEL FUNCTIONAL TEST is part of an overlapping testsequence similar to that employed in the RPS. Thissequence, consisting of SR 3.3.5.2, SR 3.3.6.1, andSR 3.3.6.2, tests the enti re ESFAS from the bistable inputthrough the actuation of the individual subgroup relays.These overlapping tests are described in Reference 1.SR 3.3.5.2 and SR 3.3.6.1 are normally performed togetherand in conjunction with ESFAS testing. SR 3.3.6.2 verifiesthat the subgroup relays are capable of actuating theirrespective ESF components when de-energized.These tests verify that the ESFAS is capable of performingits intended function, from bistable input through theactuated components. SR 3.3.5.2 is addressed in LCO 3.3.5.SR 3.3.6.1 includes Matrix Logic tests and trip path(Initiation Logic) tests, and Manual Actuation Tests.(conti nued)PALO VERDE UNITS 1,2,3 B3361 EIIN~B 3.3.6-19REVISION PressurizerB 3.4.9or in accordancewith the RiskInformed(~ArnnI~tinn Tim~BASESACT](IONS B.1 IProgram -- \*conti nued) -If one required group of pressurizer h laters is inoperable,restoration is required within 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> .The CompletionTime of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is reasonable considering that a demandcaused by loss of offsite power would be unlikely in thisperiod. Pressure control may be maintained during this timeusing normal station powered heaters.D I required grou of pressurizer heaters ioeableDand cannot be restored within the allowed Completion Time e#,,Act,^on B.1,P the plant must be brought to a MODE inwhich the LCO does not apply. To achieve this status, theplant must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> isreasonable, based on operating experience, to reach MODE 3from full power in an orderly manner and without challengingsafety systems. Similarly, the Completion Time of 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />sis reasonable, based on operating experience, to reachMODE 4 from full power in an orderly manner and withoutchallenging plant systems.SURVEILLANCEREQUIREMENTSSR 3.4.9.1This Surveillance ensures that during steady stateoperation, pressurizer water level is maintained below thenominal upper limit to provide a minimum space for a steambubble. The Surveillance is performed by observing theindicated level. The Surveillance Frequency is controlledunder the Surveillance Frequency Control Program.(continued)PALO VERDE UNITS 1,2,3B3495REION 6B 3.4.9-5REVISION Insert for page B 3.4.9-503.1With two required groups of pressurizer heaters inoperable, the Required Action is torestore at least one required group of pressurizer heaters to OPERABLE status within 1hour to regain this safety function, prior to initiating actions to place the plant in a MODEor other specified condition in which the LCO does not apply. Alternately, a CompletionTime can be determined in accordance with the Risk Informed Completion TimeProgram.The Condition is modified by a Note stating it is not applicable when the second requiredgroup of pressurizer heaters is intentionally made inoperable. This Required Action isnot intended for voluntary removal of redundant systems or components from service.The Required Action is only applicable if one required group of pressurizer heaters isinoperable for any reason and the second required group of pressurizer heaters is foundto be inoperable, or if two required groups of pressurizer heaters are found to beinoperable at the same time.

Pressurizer Safety Valves-MODES 1, 2, and 3B 3.4.10BAS ESAPPLICABILITY(continued)The requirements for overpressure protection in other MODESare covered by LCO 3.4.11, "Pressurizer Safety Valves-MODE 4," and LCO 3.4.13, "LTOP System."The Note allows entry into MODES 3 and 4 with the liftsettings outside the LCO limits. This permits testing andexamination of the safety valves at high pressure andtemperature near their normal operating range, but onlyafter the valves have had a preliminary cold setting. Thecold setting gives assurance that the valves are OPERABLEnear their design condition. Only one valve at a time willbe removed from service for testing. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> exceptionis based on 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> outage time for each of the four valves.The 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> period is derived from operating experience thathot testing can be performed within this timeframe.Ior in accordance with the Risk InformedACTIONS ICompletion Time Program I\With one pressurizer safety valv~linoperable, restorationmust take place within 15 minutes. The Completion Time of15 minutes reflects the importance of maintaining the RCSoverpressure protection system. An inoperable safety valvecoincident with an RCS overpressure event could challengethe integrity of the RCPB.B.1 and B.2If the Required Action cannot be met within the requiredCompletion Time or if two or more pressurizer safety valvesare inoperable, the plant must be brought to a MODE in whichthe requirement does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> andto MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed isreasonable, based on operating experience, to reach MODE 3from full power without challenging plant systems.Similarly, the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed is reasonable, based onoperating experience, to reach MODE 4 without challengingplant systems.(conti nued)PALO VERDE UNITS 1,2,3B34103RVSOB 3.4.10-3REVISION 0 Pressurizer VentsB 3.4.12BASESLCO A vent path is flow capability from the pressurizer to the(continued) ROT or from the pressurizer to containment atmosphere.Loss of any single valve in the pressurizer vent system willcause two flow paths to become inoperable. A pressurizervent path is required to depressurize the RCS in a SGTRdesign basis event which assumes LOP and APSS unavailable.APPLICABILITY In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psiathe four pressurizer vent paths are required to be OPERABLE.The safety analysis for the SGTR with LOP and a SingleFailure (loss of APSS) credits a pressurizer vent path toreduce RCS pressure.In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psiathe SGs are the primary means of heat removal in the RCS,until shutdown cooling can be initiated. In MODES 1, 2, 3,and MODE 4 with RCS pressure 385 psia, assuming the APSSis not available, the pressurizer vent paths are thecredited means to depressurize the RCS to Shutdown CoolingSystem entry conditions. Further depressurization into MODE5 requires use of the pressurizer vent paths. In MODE 5 withthe reactor vessel head in place, temperature requirementsof MODE 5 (< 210°F) ensure the RCS remains depressurized.In MODE 6 the RCS is depressurized.ACTIONS A.1If two or three pressurizer vent paths are inoperable, theymust be restored to OPERABLE status. Loss of any singlevalve in the pressurizer vent system will cause two flowpaths to become inoperable. Any vent path that providesflow capability from the pressurizer to the ROT or to thecontainment atmosphere, independent of which train ispowering the valves in the flow path, can be considered anoperable vent path. The Completion Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> isreasonable because there is at least one pressurizer ventpath that remains OPERABLE.Alternatively, a Completion Time can bedetermined in accordance with the RiskInformed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B341- EIIN4B 3.4.12-3REVISION 48 PrAlternatively, a Completion Time can bedetermined in accordance with the RiskInformed Completion Time Program."essuri zer VentsB 3.4.12BASESACTIONS(conti nued)If all pressurizer vent path ae1prable, then restoreat least one pressurizer vent path to PERABLE status. TheCompletion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable- to allow time tocorrect the situation, yet emphasize the ifpo rtance ofrestoring at least one pressurizer vent path. If at leastone pressurizer vent path is not restored to OPERABLE withinthe Completion Time, then Action C is entered.C.1If the required Actions, A and B, cannot be met within theassociated Completion Times, the plant must be brought to aMODE in which the requirement does not apply. To achievethis status, the plant must be brought to at least MODE 3within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and to MODE 4 with RCS pressure < 385 psiawithin 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The allowed Completion Times arereasonable, based on operating experience, to reach therequi red pl ant condi ti ons from fullI power condi ti ons in anorderly manner without challIengi ng pl ant systems.SURVEILLANCEREQU IREMENTSSR 3.4.12.1SR 3.4.12.1 requires complete cycling of each pressurizervent path valve. The vent valves must be cycled from thecontrol room to demonstrate their operability. Pressurizervent path valve cycling demonstrates its function. TheSurveillance Frequency is controlled under the SurveillanceFrequency Control Program. This surveillance test must beperformed in Mode 5 or Mode 6. In any Mode, partialsurveillance tests can be performed for post-maintenancetesting under site procedural controls that ensure the valvebeing tested is isolated from RCS pressure.SR 3.4.12.2SR 3.4.12.2 requires verification of flow through eachpressurizer vent path. Verification of pressurizer ventpath flow demonstrates its function. The SurveillanceFrequency is controlled under the Surveillance FrequencyControl Program. This surveillance test must be performedin Mode 5 or Mode 6.(conti nued)REVISION ~PALO VERDE UNITS 1,2,3 B341-B 3.4.12-4 Insert for page B 3.4.12-4(Second paragraph for Action B. 1)The Condition is modified by a Note stating the Risk Informed Completion Time is notapplicable when the last vent path is intentionally made inoperable. This Required Actionis not intended for voluntary removal of redundant systems or components from service.The Required Action is only applicable if three pressurizer vent paths are inoperable for.any reason and the last vent path is found to be inoperable, or if all pressurizer ventpaths are found to be inoperable at the same time.

SITs-Operati ngmainain uberticaityor minimumcoroancpecipithtatiotimmaybeEeduedbutth reducmed Conentrtion efcsoaditin the voolumonenrto of the SIT is stil aviable inetion.I msine rthred boon rPEquRABEmentats arebasdin t2heuraverage boron concentration inof wtheitta vlumets ofiit thremaSintai webreintavilablet for minjcimuoon. Thuspi72thour tisemallwe to return, u the bronce concentration tofitineimts.oIfone sITcristinoeablet duein telod the minabltor verlinofylevel orC prtessren the SITe mustibe returned toopenrableshdooniscusses saurvtei d requiremetsa rmins technical e Ispjecifctions Sic the iornstreuirmentchnes urbsed in themeasurtemcnsqento satre lesssveladpesre ihn StsThey ol eifolloIng swteenot avisadlefo injSection7.4 ofus N2hurEGis6orowd o inr te accordancein owihi lmiswith heIRik"Te combinationoferabedundato level andblt pressureinst r resumentto [frayhige SIT]msertre may operovideInformedssessufficentinfo6rmatioemnsotha itnmaycntcbesroera assocatedn oe instrument [wihanrelsultdingththeasremweresufficientltel tod prepairoe in theseventfloings<trumentis doano iniat aSaetaction,74o itRE-is6caseordnc whrIOeacmltr[ST sioealuwith the Rito I "The cminoeabityo of weunante level and pressureInforchannes,'metaion which the completionTtimey toresoriethWh ufietchnticfrallyionsoprbe theaccutmuat or woldbCopltin im I wothwimead thus thias cangemp woul havrec adegigiblincreasee sfincisk." e orparoe nte vnthata scon onebecme nopeabl. (conti nuedePALO VERDE UNITS 1,2,3B351-REION.B 3.5.1-7REVISION BASESACTIONSSITs-Operati ngior in accordance B 3.5.1Iwith the Risk""Ilnformed---Completion TimeIf one SIT is inoperable for a reason other than concentration or the inability to verify level or the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.In this Condition, the required contents of three SITscannot be assumed to reach the core during a LOCA.IInsert[ACTI ONSDB.1 and D.2CE NPSD-994 (Ref. 6) provides a series of deterministic andprobabiIi stic findings that support 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> as being either"risk beneficial" or "risk neutral" in comparison to shorterperiods for restoring the SIT to OPERABLE status. CENPSD-994 (Ref. 6) discusses best-estimate analysis for atypical PWR that confirmed that, during large-break LOCAscenarios, core melt can be prevented by either operation ofone low pressure safety injection (LPSI) pump or theoperation of one high pressure safety injection (HPSI) pumpand a single SIT. CE NPSD-994 (Ref. 6) also discussesplant-specific probabilistic analysis that evaluated therisk-impact of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> recovery period in comparison toshorter recovery periods.C 1landCP2SIf the SIT cannot be restored to OPERABLE status within theassociated Completion Time, the plant must be brought to aMODE in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within6 hours and pressurizer pressure reduced to < 1837 psiawithin 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times arereasonable, based on operating experience, to reach therequi red pl ant conditions from fullI power conditions in anorderly manner and without challenging plant systems.Specification 3.5.2, "SITs -Shutdown", further requires theplant to be in Mode 5 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the SITi noperabiIi ty was discovered but not restored while in theappl icabiIi ty of Speci fi cati on 3.5.1, "SITs -Operating".D.1If more than one SIT is inoperable, thc unit is in acondition outside the accid~t analyses. ~I Pn 0 ~J.Reviewer's note: the TSTF Bases state that this Condition is onlyapplicable to plants that have not adopted a RICT Program.(conti nued)PALO VERDE UNITS 1,2,3 B3518RVSOB 3.5.1-8REVISION 1 Insert for page B 3.5.1-8C.1With two or more SITs inoperable, the Required Action is to restore all but oneSIT to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain this safety function. The 1 hourCompletion Time is acceptable because it minimizes risk while allowing time forrestoration of sufficient SITs to regain safety function. Alternately, a CompletionTime can be determined in accordance with the Risk Informed Completion TimeProgram.The Condition is modified by a Note stating it is not applicable when two or moreSITs are intentionally made inoperable. The Required Action is not intended forvoluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one SIT is inoperable for any reason andadditional SITs are found to be inoperable, or if two or more SITs are found to beinoperable at the same time.

or in acciRisk InfoCompletiBASES ProaramEGGS -OperatingB 3.5.3ACTIONSA.1Condition A addresss the specific condition where the onlyaffected EGGS subsys em is a single LPSI subsystem. Theavailability of at le, st 100% of the EGGS flow equivalent toa single OPERABLE EGGS train is implicit in the definitionof Condition A. \If LCO 3.5.3 requirements are not met due only to theexistence of Condition A,\then the inoperable LPSI subsystemcomponents must be to OPERABLE status within 1 daysof discovery of Condition This 7 day Completion Time isbased on the findings of the determini sti c and probabiIi sticanalysis that are discussed in Reference 6. Seven days is areasonable amount of time to perform many corrective andpreventative maintenance items on the affected LPSIsubsystem. Reference 6 concluded that the overall riskimpact of this Completion Time was either risk-beneficial orrisk-neutral.The Configuration Risk Management Program (CRMP) in TRMSecti on 5.0. 500.19 appl ies when Condi ti on A i s entered.B.- 1 Completion Time ProgramIf one or rere EGGS trains are inoperable, except forreasons ot er than Condition A (one LPSI subsysteminoperable/, and at least 100% of the EGGS flow equivalentto a sing e OPERABLE EGGS train is available, the inoperablecomponen is must be returned to OPERABLE status within72 hours. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on an NRCstudy (Ref. 4) using a reliability evaluation and is areasonable amount of time to effect many repairs.An EGGS train is inoperable if it is not capable ofdelivering the design flow to the RCS. The individualcomponents are inoperable if they are not capable ofperforming their design function, or if supporting systemsare not available.(conti nued)PALO VERDE UNITS 1,2,3 B3536RVSOB 3.5.3-6REVISION EGGS -OperatingB 3.5.3BASESACTIONS B.1 (continued)The LCO requires the OPERABILITY of a number of independentsubsystems. Due to the redundancy of trains and thediversity of subsystems, the inoperability of one componentin a train does not render the EGGS incapable of performingits function. Neither does the inoperability of twodifferent components, each in a different train, necessarilyresult in a loss of function for the EGGS. The intent ofthis Condition is to maintain a combination of OPERABLEequipment such that 100% of the EGGS flow equivalent to 100%of a single OPERABLE train remains available. This allowsincreased flexibility in plant operations when components inopposite trains are inoperable.An event accompanied by a loss of offsite power and thefailure of an emergency DO can disable one EGGS train untilpower is restored. A reliability analysis (Ref. 4) hasshown that the impact with one full ECCS train inoperable issufficiently small to justify continued operation for72 hours.With one or more components inoperable, such that 100% ofthe equivalent flow to a single OPERABLE EGGS train is notavailable, the facility is in a condition outside theI eneed .1 .2 ndD3accident analyses. Therefore, LCO 3.0.3 must be immediatelyIf the inoperable train cannot be restored to OPERABLEstatus within the associated Completion Time, the plant mustbe brought to a MODE in which the LCO does not apply. Toachieve this status, the plant must be brought to at leastMODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure reduced to< 1837 psia and RCS Tc reduced to < 485°F within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the required unit conditionsfrom full power in an orderly manner and without challengingunit systems.(conti nued)PALO VERDE UNITS 1,2,3 B3537RVSOB 3.5.3-7REVISION 2 Insert for page B 3.5.3-7c__1Condition C is applicable with one or more trains inoperable for reasons otherthan Condition A. The allowed Completion Time is based on the assumption thatat least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train isavailable. With less than 100% of the ECCS flow equivalent to a singleOPERABLE ECCS train available, the facility is in a condition outside of theaccident analyses and flow must be restored to 100% of the ECCS flowequivalent to a single OPERABLE ECCS train within the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> CompletionTime, or a Completion Time determined under the Risk Informed CompletionTime Program. The Completion Time is based on the need to restore the ECCSflow to within the safety analysis assumptions.The Condition is modified by a Note stating it is not applicable when the secondECCS train is intentionally made inoperable. The Required Actions are notintended for voluntary removal of redundant systems or components fromservice. The Required Actions are only applicable if one ECCS train isinoperable for any reason and the second ECCS train is found to be inoperable,or if two ECCS trains are found to be inoperable at the same time.

RWTB 3.5.5BASESLCO The RWT ensures that an adequate supply of borated water isavailable to cool and depressunize the containment in theevent of a Design Basis Accident (DBA) and to cool and coverthe core in the event of a LOGA, that the reactor remainssubcritical following a DBA, and that an adequate levelexists in the containment sump to support ESF pump operationin the recirculation mode.To be considered OPERABLE, the RWT must meet the limitsestablished in the SRs for water volume, boronconcentration, and temperature.APPLICABILITY In MODES 1, 2, 3, and 4, the RWT OPERABILITY requirementsare dictated by the EGGS and Containment Spray SystemOPERABILITY requirements. Since both the EGGS and theContainment Spray System must be OPERABLE in MODES 1, 2, 3,and 4, the RWT must be OPERABLE to support their operation.Gore cooling requirements in MODE 5 are addressed byLCO 3.4.7, "RGS Loops -MODE 5, Loops Filled," and LGO 3.4.8,"RGS Loops -MODE 5, Loops Not Filled." MODE 6 core coolingrequirements are addressed by LCO 3.9.4, "Shutdown Cooling(SOC) and Coolant Circulation -High Water Level ," andLCO 3.9.5, "Shutdown Cooling (SDC) and CoolantCirculation -Low Water Level."ACTIONS A.1With RWT boron concentration or borated water temperaturenot within limits, it must be returned to within limitswithin 8 In this condition neither the EGGS nor theContainment Sp ,System can perform their design functions;therefore, prompt ction must be taken to restore the tankto OPERABLE conditio The allowed Completion Time of 8hours to restore the T to within limits was developedconsidering the time req' ired to change boron concentrationor temperature and that th'ck contents of the tank are stillavailable for injection and ,<re cooling.or in accordance with the Risk InformedCompletion Time Program(conti nued)PALO VERDE UNITS 1,2,3 B3551RVSOB 3.5.5-7REVISION RWTB 3.5.5or in accordance with the Risk InformedCompietion Time ProgramI-BASESACTI ONS(conti nued)B.1With RWT borated water volume not withi\ limits, it must bereturned to within limits within 1 hou r. In this condition,neither the EGGS nor Containment Spray System can performtheir design functions; therefore, prompt action must betaken to restore the tank to OPERABLE status or to place theunit in a MODE in which these systems are not required. Theallowed Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to restore the RWT toOPERABLE status is based on this condition since thecontents of the tank are not available for injection andcore cooling.C.1 and C.2If the RWT cannot be restored to OPERABLE status within theassociated Completion Time, the plant must be brought to aMODE in which the LCO does not apply. To achieve thisstatus, the plant must be brought to at least MODE 3 within6 hours and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowedCompletion Times are reasonable, based on operatingexperience, to reach the required plant conditions from fullpower conditions in an orderly manner and withoutchallenging plant systems.SURVEILLANCEREQU IREMENTSSR 3.5.5.1RWT borated water temperature shall be verified to be withinthe limits assumed in the accident analysis. TheSurveill ance Frequency i s controllIed under the Surveill anceFrequency Control Program.The SR is modified by a Note that eliminates the requirementto perform this Surveillance when ambient air temperaturesare within the operating temperature limits of the RWT. Withambient temperatures within this range, the RWT temperatureshould not exceed the limits.(conti nued)PALO VERDE UNITS 1,2,3B355-REION 6B 3.5.5-8REVISION Containment Air LocksRequi red Action C.2 requires that one door in the affectedcontainment air lock must be verified to be close .Thisaction must be completed within the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Comple, ion Time.This specified time period is consistent with the ACTIONS ofLCO 3.6.1, which requires that containment be res ~ored toOPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.Additionally, the affected air lock(s) must be ored toOPERABLE status within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time. Thespecified time period is considered reasonable for restoringan inoperable air lock to OPERABLE status, assuming that atleast one door is maintained closed in each affected airlock.D.1 and D.2If the inoperable containment air lock cannot be restored toOPERABLE status within the required Completion Time, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toat least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required plantconditions from fullI power conditions in an orderly mannerand without challIengi ng pl ant systems.SURVEILLANCE SR 3.6.2.1REQU I REMENTSMai ntai ni ng contai nment air locks OPERABLE requirescompl iance with the leakage rate test requirements of theContainment Leakage Rate Testing Program. This SR reflectsthe leakage rate testing requirements with regard to airlock leakage (Type B leakage tests). The acceptancecri teri a were establ ished during i niti al ai r lock andcontainment OPERABILITY testing. The periodic testingrequirements verify that the air lock leakage does notexceed the allowed fraction of the overall containmentleakage rate. The Frequency is required by the ContainmentLeakage Rate Testing Program and includes testing of theairlock doors following each closing, as specified.(continued)PALO VERDE UNITS 1,2,3 B3627RVSOB 3.6.2-7REVISION Containment Isol ati on ValvesB 3.6.3BASESACTIONS A.li and A.2(conti nued)In the event one required containment isolation valve in oneor more penetration flow paths is inoperable except forpurge valve leakage not within limit (refer to Action D),theaffected penetration flow path must be isolated. The methodof isolation must include the use of at least one isolationbarrier that cannot be adversely affected by a single activefailure. Isolation barriers that mleet this criterion are aclosed and de-activated automatic valve, a closed manualvalve (including a de-activated non-automatic valve), ablind flange, and a check valve with flow through the valvesecured. Compl iance with this Acti on is established via :1) Administrative controls (i.e., permit) on the de-acti vated automatic valve, closed manual valve, bl indflange, or check valve, and 2) Administrative controls(i .e. , permit or Locked Valve/Breaker/Component Controllock) on vents, drains, and test connections located withinthe containment penetration. Instruments(i .e. , flow/pressure transmitters) located within thepenetration that are not removed from service formaintenance nor open to the atmosphere are considered aclosed loop porti on of the associated penetrati on:therefore, i sol ati on valves associated with instrumentsmeeting this criteria need not be isolated nor otherwiseadmini strati vely controllIed to comply with the requirementsof this Action. For penetrations isolated in accordancewith Required Action A.1, the device used to isolate thepenetration should be the closest available one tocontainment. Requi red Action A. 1 must be completed withinthe 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time isreasonable, considering tl" time required to isolate thepenetration and the relativ# importance of supportingcontainment OPERABILITY during MODES 1, 2, 3, and 4.For affected penetration floW paths that cannot be restoredto OPERABLE status within the\4 hour Completion Time and thathave been i sol ated in accordan e with Requi red Action A. 1,the affected penetration flow must be verified to beisolated on a periodic basis. lhis is necessary to ensurethat containment penetrations re ui red to be isolatedfol lowi ng an accident and no lon ~er capable of beingautomatically isolated will be in the isolation positionor in accordance with the Risk Informed Completion TimeIProgram(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIINAB 3.6.3-10REVISION 4-3 Containment Isolation ValvesB 3.6.3should an event occur. Th s Required Action does not requireany testing or device mani ~ul ation. Rather, it involvesverification, through a sy stern walkdown, that those isolationdevices outside contai nmen t and capable of beingmispositioned are in the position. The CompletionTime of "once per 31 days for isolation devices outsidecontainment" is appropriate considering the fact that thedevices are operated under administrative controls and theprobability of their misalignment is low. For the isolationdevices inside containment, the time period specified as"prior to entering MODE 4 from MODE 5 if not performed withinthe previous 92 days" is based on engineering judgment and isconsidered reasonable in view of the inaccessibility of thei sol ati on devices and other admi ni strati ve control s that wiIllensure that isolation device misalignment is an unlikelypossi bili ty.Condition A has been modified by a Note indicating that thisCondition is only applicable to those penetration flow pathswith two containment isolation valves. For penetration flowpaths with only one containment isolation valve and a closedsystem, Condition C provides appropri ate actions.Required Action A.2 is modified by a Note that applies toisolation devices located in high radiation areas and allowsthese devices to be verified closed by use of administrativemeans. Al lowi ng veri fi cati on by administrati ve means i sconsidered acceptable, since access to these areas istypically restricted. Therefore, the probability ofmisalignment of these devices, once they have been verifiedto be in the proper position, is small.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4B 3.6.3-11REVISION 4-3 Contai nmentIsol ati on ValvesB 3.6.3Ior in accordance with the Risk Informed Completion TimeBASES IProgrami-!ACTI ONS(conti nued)B.I1oWith two requi red containment isol ation valves in oe or morepenetration flow paths inoperable except for purge leakage not within limit *(refer to Action D), the a ectedpenetration flow path must be isolated within 1 hou .Themethod of isolation must include the use of at least oneisolation barrier that cannot be adversely affected by asingle active failure. Isolation barriers that meet thiscriterion are a closed and de-activated automatic valve, aclosed manual valve (including a de-activated non-automaticvalve), and a blind flange. Compliance with this Action isestablished via: 1) Administrative controls (i.e., permit)on the de-activated automatic valve, closed manual valve, orblind flange, and 2) Administrative controls (i.e., permit orLocked Valve/Breaker/Component Control lock) on vents,drains, and test connections located wi thin the containmentpenetration. Instruments (i.e., flow/pressure transmitters)located within the penetration that are not removed fromservice for maintenance nor open to the atmosphere areconsidered a closed loop portion of the associatedpenetrati on; therefore, i sol ati on val ves associated withinstruments meeting this criteria need not be isolated norotherwise administratively controlled to comply with therequirements of this Action. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time isconsistent with the ACTIONS of LCO 3.6.1. In the event theaffected penetration i s isolated i n accordance with Requi redAction B.1, the affected penetration must be verified to bei sol ated on a periodic basis per Requi red Acti on A.?2, whichremains in effect. This periodic veri fi cati on i s necessaryto assure leak tightness of containment and that penetrationsrequiring isolation following an accident are isolated. TheCompletion Time of once per 31 days for verifying eachaffected penetration flow path i s isolated i s appropri ateconsidering the fact that the valves are operated underadmi ni strati ve control s and the probabiIi ty of theirmisalignment is low.Condi ti on B i s modi fi ed by a Note i ndi cati ng thi s Condi tionis only applicable to penetration flow paths with twocontainment i sol ation valves. Condition A of this LCOaddresses the condition of one containment isolation valveinoperable in this type of penetration flow path.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4B 3.6.3-12REVISION 4-3 Containment Isolation ValvesB 3.6.3BASESACTIONS(conti nued)C.1 and C.2With one or more required penetration flow paths with onecontainment isolation valve inoperable, the inoperable valve_______________must be restored to OPERABLE status or the affectedAltenatvel, apenetration flow path must be isolated. The method ofAlterntivel, a \ isolation must i ncl ude the use of at least one isolationCompletion Time barrier that cannot be adversely affected by a single activecan be determined \failure. Isolation barriers that meet this criterion are ain accordance with and de-activated automatic valve, a closed manualthe Risk Informed v lye (including a de-activated non-automatic valve), and aCompletion Time bli id fl ange. Compl iance with thi s Acti on i s establishedProgram.via: 1) Administrative controls (i.e., permit) on theProgram.de-actvkated automatic valve, closed manual valve, or blindflange a d 2) Administrative controls (i .e., permit or LockedValve/Bre er/Component Control lock) on vents, drains, andtest connec ions located within the containment penetration.Instruments (1.e., flow/pressure transmitters) located withinthe penetratioi that are not removed from service formaintenance nor en to the atmosphere are considered aclosed loop portio of the associated penetration; therefore,i sol ati on valves as ci ated with instruments meeting thiscriteria need not be Xolated nor otherwise administrativelycontrolled to comply WI ~h the requirements of this Action. Acheck valve may not be u d to isolate the affectedpentaion. eured Act qn C.1 must be completed withinthe 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time. specified time period isreasonable, considering the relative stability of the closedsystem (hence, reliability) to act as a penetration isolationfolowig iolaio boundary and the relative importance of supportingIfolowng soatin iXcontainment OPERABILITY during MODES 1, 2, 3, and 4. In the\event the affected penetration is isolated in accordance withAction C.1, the affected penetration flow path mustb verified to be isolated on a periodic basis. This isnece ssary to assure leak tightness of containment and thatcont inment penetrations requiring isolation following anaccide are isolated. The Completion Time of once per31 day, for verifying that each affected penetration flowpath is isolated is appropriate considering the valves areoperated under administrative controls and the probability oftheir misalignment is low.Condition C is modified by a Note indicating that thisCondition is only applicable to those penetration flow pathswith only one containment isolation valve and a closedsystem. The only credited closed systems are the SteamGenerating and the Containment Pressure Monitoring Systems.This Note is necessary since this Condition is(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4B 3.6.3-13REVISION 4-3 Contai nmentIsolation ValvesB 3.6.3BASESACTIONSC.1 and C.2 (continued)written to specifically address those penetration flow pathswhich are neither part of the reactor coolant pressureboundary nor connected directly to the containment atmosphere(10 CFR 50, APP. A, GDC 57).Required Action C.2 is modified by a Note that applies tovalves and blind flanges located in high radiation areas andallows these devices to be verified closed by use ofadministrative means. Allowing verification byadministrative means i s considered acceptabl e, since accessto these areas is typically restricted. Therefore, theprobability of misalignment of these valves, once they havebeen verified to be in the proper position, is small.D.1, 0.2, and 0.3In the event one or more required containment purge valvesin one or more penetration flow paths are not within thepurge valve leakage limits, purge valve leakage must berestored to within limits, or the affected penetration mustbe isolated. The method of isolation must be by the use ofat least one isolation barrier that cannot be adverselyaffected by a single active fai lure. Isolation barriersthat meet this criterion are a closed and de-activatedautomatic valve with resilient seals, or a blind flange. Apurge valve with resilient seals utilized to satisfyRequired Action D.1 must have been demonstrated to meet theleakage requirements of SR 3.6.3.6. Compl iance with thisActi on i s establ ished via : 1) Admi nistrati ve control s(i .e., permit) on the de-activated automatic valve withresilient seals or blind flange, and 2) Administrativecontrols (i .e., permit or Locked Valve/Breaker/ComponentControl lock) on vents, drains, and test connections locatedwithin the containment penetration. Instruments (i.e.,flow/pressure transmitters) located within the penetrationthat are not removed from service for maintenance nor openoL the atmosphere are considered a closed loop portion ofated penetrati on ; therefore, i sol ation valvesassoci ate th instruments meeting this cri teri a need notbe i sol ated no- se admi ni strati vely controllIed tocomply with the req ents of this Action. The specifiedCompletion Time is considering that onecotimntpre valeremains se so that a grossbreach of containment does not (conti nued)IAlternatively, aCompletion Timecan be determinedin accordance withthe Risk InformedCompletion TimeProgram.PALO VERDE UNITS 1,2,3 B3631 EIIN4B 3.6.3-14REVISION 4-3 Containment Isolation ValvesB 3.6.3BASESACTIONS D.1, D.2 and D.3 (continued)In accordance with Required Action D.2, this penetration flowpath must be verified to be isolated on a periodic basis.The periodic verification is necessary to ensure thatcontainment penetrations requi red to be isolated fol lowing anaccident, which are no longer capable of being automaticallyisolated, will be in the isolation position should an eventoccur. This Required Action does not require any testing orvalve mani pul ati on. Rather, i t i nvol ves veri fi cati on,through a system wal kdown, that those isolation devicesoutside containment capable of being mispositioned are in thecorrect position. /-following isolationFor the isolation devices inside contaynment, the time periodspecified as "prior to entering MODE from MODE 5 if notperformed within the previous 92 daysv is based onengineering judgment and is considered reasonable in view ofthe inaccessibility of the isolation devices and otheradministrative controls that will ensure that isolationdevice misalignment is an unlikely possibility, ifollowing isolationlFor the required containment purge valve with a resilientJseal that i s i sol ated in accordance with Requi red Acti on/D. 1,SR 3.6.3.6 must be performed at least once every 92 This assures that degradation of the resilient seal isdetected and confirms that the leakage rate of thecontainment purge valve does not increase during the time thepenetration is isolated. The normal Frequency for SR3.6.3.6, 184 days, is based on an NRC initiative, GenericIssue B-20 (Ref. 3). Since more reliance is placed on asingle valve while in this Condition, it is prudent toperform the SR more often. Therefore, a Frequency of onceper 92 days chosen and has been shown to be acceptablebased on ope'r tng experience.E. 1 and E .2 .following isolationIf the Required Actions and associated Completion Times arenot met, the plant must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times arereasonable, based on operating experience, to reach therequi red p1 ant conditions from fullI power condi ti ons i n anorderly manner and without challenging plant systems.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4B 3.6.3-15REVISION 4-3 Containment Spray SystemB 3.6.6BASESLCO(conti nued)containment spray actuation signal and automaticallytransferring suction to the containment sump on areci rcul ati on actuati on signal .Each spray train flow pathfrom the containment sump shall be via an OPERABLE shutdowncooling heat exchanger.Therefore, in the event of an accident, the minimumrequirements are met, assuming that the worst case singleactive failure occurs.Each Containment Spray System typically includes a spraypump, a shutdown cooling heat exchanger, spray headers,nozzles, valves, piping, instruments, and controls to ensurean OPERABLE flow path capable of taking suction from the RWTupon an ESF actuation signal and automatically transferringsuction to the containment sump.APPLICABILITYIn MODES 1, 2, and 3, and Mode 4 with RCS pressure 385psia, a DBA could cause a release of radioactive material tocontainment and an increase in containment pressure andtemperature, requiring the operation of the containmentspray trains.In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6,the probability and consequences of these events are reduceddue to the pressure and temperature limitations of theseMODES. Thus, the Containment Spray System is not requiredto be OPERABLE in these MODES.ACTIONSA.1With one containment spray train inoperable, the inoperablecontainment spray train must be restored to OPERABLE statuswithin 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLEspray train is to perform the iodine removal,hydrogen mixing, and containment cooling functions. The72 hour Completi n Time takes into account the redundantheat removal cap bility afforded by the Containment SpraySystem, time for repairs, and the low probabilityof a DBA during this period.or in accordance with the Risk InformedCompletion Time Program(continued)PALO VERDE UNITS 1,2,3 B3665RVSOB 3.6.6-5REVISION Containment Spray SystemB 3.6.6BASESACTIONS(conti nued)SInsertIB.1 and 32If the inoperable containment spray train cannot be restoredto OPERABLE status within the required Completion Time, theplant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought toat least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 with RCSpressure < 385 psia within 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />. The allowed CompletionTime of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operatingexperience, to reach MODE 3 from full power conditions in anorderly manner and without challenging plant systems. Theextended interval to reach MODE 4 with RCS pressure < 385psia allows additional time for the restoration of thecontainment spray train and is reasonable when consideringthat the driving force for a release of radioactive materialfrom the Reactor Coolant System is reduced in MODE 3.Reviewer's note: the TSTF Bases state that this Condition is onlylapplicable to plants that have not adopted a RICT Program. IGALCi.. mutbincc mid~cySURVEILLANCEREQU IREMENTSSR 3.6.6.1Verifying the correct alignment for manual, power operated,and automatic valves in the containment spray flow pathprovides assurance that the proper flow paths will exist forContainment Spray System operation (positioned to takesuction from the RWT on a containment spray actuation testsignal [CSAS]). This SR does not apply to valves that arelocked, sealed, or otherwise secured in position since thesewere verified to be in the correct position prior to beingsecured. This SR also does not apply to valves that cannotbe inadvertently misaligned, such as check valves. This SRdoes not require any testing or valve manipulation. Rather,it involves verifying, through a system walkdown, that thosevalves outside containment and capable of potentially beingmispositioned are in the correct position. The SurveillanceFrequency i s controllIed under the Surveill ance FrequencyControl Program.(continued)PALO VERDE UNITS 1,2,3B3.6-REION 6B 3.6.6-6REVISION Insert for page B 3.6.6-6c3.1With two containment spray trains inoperable, the Required Action is to restore atleast one containment spray train to OPERABLE status within one hour to regainsome capability to perform iodine removal, hydrogen mixing, and containmentcooling functions. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because itminimizes risk while allowing time for restoration of at least one train. Alternately,a Completion Time can be determined in accordance with the Risk InformedCompletion Time Program.The Condition is modified by a Note stating it is not applicable when twocontainment spray trains are intentionally made inoperable. This RequiredAction is not intended for voluntary removal of redundant systems or componentsfrom service. The Required Action is only applicable if one containment spraytrain is inoperable for any reason and a second containment spray train is foundto be inoperable, or if two containment spray trains are found to be inoperable atthe same time.D.1 and D.2If the Required Action and associated Completion Time of Condition C of thisLCO is not met, the plant must be brought to a MODE in which the LCO does notapply. To achieve this status, the plant must be brought to at least MODE 3within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Timesare reasonable, based on operating experience, to reach the required plantconditions from full power conditions in an orderly manner and withoutchallenging plant systems.

MS IVsAlternately, the Completion Time can be determined in accordance with the Risk IB 3.7 .2Informed Completion Time Program.IBASES (continued)KACTIONS(conti nued)[.1 (continued)or more MSIVs inoper erble while in MODE 1 requires entryinto LCO 3.0.3.F.1With one MSIV inoperable *n MODE 1, time is allowed torestore the component to 0 ERABLE status. Some repairs canbe made to the MSIV with unit hot. The 4 hourCompletion Time is reasonabl , considering the probabilityof an accident occurring duni~ the time period that wouldrequire closure of the MSIVs."Condition F is entered when one MSIV is inoperable inMODE 1, including when both actuator trains for one MSIVare inoperable. When only one actuator train is inoperableon one MSIV, Condition A applies.The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that normallyallIowed for containment isol ati on valves that i sol ate aclosed system penetrating containment. These valves differfrom other containment isol ati on valves in that the closedsystem provides an additional means for containmenti sol ati on.If, the MSIV cannot be restored to OPER Ewtin 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />,the unit must be placed in a MODE in w ich the LCO does notapply. To achieve this status, the must be placed inMODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition would be entered. TheCompletion Time is reasonable, based on operatingexperience, to reach MODE 2, and close the MSIVs in anodrymanner and without challenging unit systems.Codition *smdfied by a Note indicating that separateCondition entry is allowed for each MSIV.Since the MSIVs are required toand 3, the inoperable MSIVs mayOPERABLE status or closed. Wheralready in the position requirecsafety analysis.be OPERABLE in MODES 2either be restored toI closed, the MSIVs areJby the assumptions in the(conti nued)PALO VERDE UNITS 1,2,3 B3727RVSOB 3.7.2-7REVISION Insert for page B 3.7.2-7G..._With two or more MSIVs inoperable, the Required Action is to restore all but oneMSIV to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a method of main steam lineisolation. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes riskwhile allowing time for restoration of sufficient required MSIVs. Alternately, aCompletion Time can be determined in accordance with the Risk InformedCompletion Time Program.The Condition is modified by a Note stating it is not applicable when two or moreMSIVs are intentionally made inoperable. This Required Action is not intendedfor voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one MSIV is inoperable for any reason andadditional MSIVs are found to be inoperable, or if two or more MSIVs are foundto be inoperable at the same time.

MS IVsB 3.7.2ACTIONS and H (continued)(continued)The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that allowedin Condition F.Inoperable MSIVs that cannot be restored to OPERABLE statuswithin the specified Completion Time, but are closed, mustbe verified on a periodic basis to be closed. This isnecessary to ensure that the assumptions in the safetyanalysis remain valid. The 7 day Completion Time isreasonable, based on engineering judgment, MSIV statusindications availIable in the control room, and otheradministrative controls, to ensure these valves are in theti on.*1and If the MSIVs cannot be restored to OPERABLE status, orclosed, within the associated Completion Time, the unit mustbe placed in a MODE in which the LCD does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the requi red unit conditionsfrom MODE 2 conditions in an orderly manner and withoutchallIengi ng unit systems.SURVEILLANCE SR 3.7.2.1REQU IREM ENTSThis SR verifies that the closure time of each MSIV iswithin the limit given in Reference 5 with each actuatortrain on an actual or simulated actuation signal and iswithin that assumed in the accident and containmentanalyses. This SR also verifies the valve closure time isin accordance with the Inservice Testing Program. This SRis normally performed upon returning the unit to operationfollowing a refueling outage. The MSIVs should not be fullstroke tested at power.The Frequency for this. SR is in accordance with theInservice Testing Program. This Frequency demonstrates thevalve closure time at least once per refueling cycle.(continued)PALO VERDE UNITS 1,2,3B372-REION4B 3.7.2-8REVISION MFIVsB 3.7.3BASES (continued)APPLICABILITY The MFIVs must be OPERABLE whenever there is significantmass and energy in the Reactor Coolant System and steamgenerators. This ensures that, in the event of an HELB, asingle failure cannot result in the blowdown of more thanone steam generator.In MODES 1, 2, 3, and 4, the MFIVs are required to beOPERABLE, except when they are closed and deactivated orisolated by a deactivated and closed power operated valve,in order to limit the amount of available fluid that couldbe added to containment in the case of a secondary systempipe break inside containment. When the valves are closedor isolated by a closed power operated valve, they areal ready performing thei r safety functi on.In MODES 5 and 6, steam generator energy is low. Therefore,the MFIVs are not required.ACTIONS The ACTIONS table is modified by a Note indicating thatseparate Condition entry is allowed for each penetrationflow path.A. ! and ,Insertthe inoperable v-alv-es w.ithin 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. When thesevalves are closed or isolated, they are performing theirrequired safety function (e.g., to isolate the line).The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account theredundancy afforded by the remaining OPERABLE valves, andthe low probability of an event occurring during this time__period that would require isolation of the MFW flow paths.IA.2.1" In ~ra le MFIVs that are closed to comply with RequiredAction .must be verified on a periodic basis to bereasonable closed. This is necessary to ensure that the assumptions in(editorial) afety. analysis remain valid. The day completiontmisbased on engi in judge .t, MFIVstatus indications availabl li he control room and otheradministrative contro , ensure these valves ire in theIfollowing isolation -(conti nued)PALO VERDE UNITS 1,2,3B 3.7.3-3REVISION Insert for page B 3.7.3-3)A.1, A.2.1, and A.2.2With one or more MFlIVs inoperable, action must be taken to restore the MFlIV(s) toOPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or in accordance with the Risk Informed CompletionTime Program OR to close or isolate the inoperable valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

MFl VsB 3.7.3(conti nued)..f..ore.th.n.one........n..h...ame.flo. path cannot beoperate au-tomatically and perform the required safetypath isolate within 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />... This actio returns thsys temn to th condtio where... at lea. t one valve in each8 hou-r Completion Time is reasonable to close an MFIV orInoperable MFIVs that cannot be restored to OPERABLE statuswithin the Completion Time, but are closed or isolated, mustbe verified on a periodic basis that they are closed orisolated. This is necessary to ensure that the assumptionsin the safety analysis remain valid. The 7 day CompletionTime is reasonable, based on engineering judgme #, in viewof valve status indications availIable in the co trol room,and other administrative controls to ensure tha thesevalves are closed or isolated.lIfollowing isolationC.1 and C.2If the MFIVs cannot be restored to OPERABLE status, closed,or isolated in the associated Completion Time, the unit mustbe placed in a MODE in which the LCO does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the requi red unit conditionsfrom full power conditions in an orderly manner and withoutchallenging unit systems.(continued)PALO VERDE UNITS 1,2,3 B3734RVSOB 3.7.3-4REVISION Insert for page B 3.7.3-4B.1. B.2.1, and B.2.2With two valves in the same flow path inoperable, action must be taken to restore onevalve to OPERABLE status within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or in accordance with the Risk InformedCompletion Time Program OR isolate the affected flow path. If more than one MFIV inthe same flow path cannot be restored to OPERABLE status, then there may be nosystem to operate automatically and perform the required safety function. Under theseconditions, valves in each flow path must be roetored to OPER.ABLE statu-s, closed orthe flow path isolated within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. This action returns the system to the conditionwhere at least one valve in each flow path is performing the required safety function.The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is reasonable to restore an MFIV to OPERABLE status, orto close an MFIV or otherwise isolate the affected flow path.

Alternately, a Completion Time can be /ADVsdetermined in accordance with the Risk B 3.7.4Informed Completion Time Program.BASESACTIONS A. 1The condition for this ACTION is modifi by a Note thatstates separate Condition entry is alloyed for each SG.This is acceptable because only one SG is required for RCSheat removal after a design basis accid, nt, and becausethis Condition provides the appropriate Required Action andCompletion Time for one inoperable ADV l ne on each SG.With one ADV line on a SO inoperable, ac ion must be takento restore that ADV line to OPERABLE sta us within 7 daysto meet the LCO for each SG that has red thisCondition. The 7-day Completion Time tales intoconsi derati on the redundant capabi li ty a iforded by theremaining OPERABLE ADV lines, the safety grade MSSVs, andthe non-safety grade backup of the SBCS.yB.1With two or more ADV lines inoperable with both ADV i nesinoperable on one or more SGs, action must be taken torestore one ADV line on each SG to OPERABLE status within 24hours. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable to repairinoperable ADV i nes, based on the availIabi li ty of the SteamBypass Control System and MSSVs, and the low probability ofan event occurring during this period that requires the ADV* lines.Ilnsert NOTE :Entry Condition B for all four ADV lines simultaneouslyis not intended for voluntary removal ofredundant systems or components from service in lieu ofother alte natives that would not result in redundantsystems or being inoperable.(conti nued)PALO VERDE UNITS 1,2,3 B3745RVSOB 3.7.4-5REVISION Insert for page B 3.7.4-5(Second paragraph for Action B. 1)The Condition is modified by a Note stating the Risk Informed Completion Time is notapplicable when all ADVs are intentionally made inoperable. This Required Action is notintended for voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if two or more ADV lines are found inoperable withboth ADV lines inoperable on one or more SGs and the last ADV line is found to beinoperable, or if all ADV lines are found to be inoperable at the same time.

AFW SystemB 3.1.5BASESAPPLICABILITY In MODES 1, 2, and 3, the AFW System is required to beOPERABLE and to function in the event that the MFW System islost. In addition, the AFW System is required to supplyenough makeup water to replace steam generator secondaryinventory, lost as the unit cools to MODE 4 conditions.In MODE 4, the AFW System may be used for heat removal viathe steam generator.In MODES 5 and 6, the steam generators are not normally usedfor decay heat removal, and the AFW System is not required.A note prohibits the application of LCD 3.0.4.b to aninoperable AFW Train. There is an increased risk associatedwith entering a MODE or other specified condition in theapplicability with an AFW train inoperable and theprovisions of LCD 3.0.4.b which allows entry into a MODE orother specified condition in the Applicability with the LCDnot met after performance of a risk assessment addressinginoperable systems and components, should not be applied inthis ci rcumstance./or in accordance with the Risk InformedACTIONS A. 1 lCompletion Time ProgramIf one of the two s eam supplies to the turbine driven AFWpumps is inoperable, or if a turbine driven pump isinoperable while in MODE 3 immediately following refueling(prior to MODE 2), # tion must be taken to restore OPERABLEstatus within 7 day .The 1 day Completion Time isreasonable based on the following reasons:a. For the inoperability of a steam supply to theturbine-driven AFW pump, the 1 day Completion time isreasonable since there is a redundant steam supplyline for the turbine driven pump.b. For the inoperability of a turbine-driven AFW pumpwhile in MODE 3 immediately subsequent to a refuelingoutage, the 7 day Completion time is reasonable due tothe minimal decay heat levels in this situation.c. For both the inoperability of a steam supply line tothe turbine-driven pump and an inoperable turbine-driven AFW pump while in MODE 3 immediately followinga refueling outage, the 7 day Completion time isreasonable due to the availability of redundantOPERABLE motor driven AFW pumps.(continued)PALO VERDE UNITS 1,2,3B375-REION4B 3.7.5-5REVISION 42-AFW SystemB 3.7.5BASESACTIONSTSTF-505 states thatit is necessary toadopt TSTF-439,"Eliminate SecondCompletion Times..."in order to adoptTSTF-505 for thoseRAs that are affectedby both travelers.APS has submittedan LAR adoptingTSTF-439(ML1 5065A031).These marked-uppages reflect thedeletions that will bemade when theTSTF-439 LAR isapproved by theNRC.A marginal note of"TSTF-439" will beadded wheredeletions are made toreflect TSTF-439 onthe following pages.A.1 (continued)'Thc sc-.-ond Cor.mpletionr,, Timc. -for Act.ion`v A.1cst'abihl cs a limit on thc m.ximu tim.c.,- allo....d for ..nyof,.Condition.,,, to bc,'i,"pr.blc during 14.,,4- any-I4,continuous faiur to -m-,.c.,- ct,., thi.,,44,,. Ih 1 dII CII TImI c p. r o%.vIdIc. s a. 1, im%%i %tation timc#%. ,allowed in thiIsr TpcfidCnditionm aftc ,-is,,'vr,,' of,reazonaDic tor situations in wnicn uonaitions :~ ana b arc1l" ~,4=1 ,4M,-~.4s-n, +-h2+ kM`-in T~mne, 2n.14-au-~...mu.taneou.ly. an the... ,orer, titiemutb met....... .....Condition A is modified by a Note which limits theappl icabiIi ty of the Condi ti on to when the unit has notentered MODE 2 fol lowing a refuel ing. Condition A al lowsthe turbine-driven AFW pump to be inoperable for 7 days vicethe 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time in Condition B. This longerCompletion Time is based on the reduced decay heat followingrefuel ing and prior to the reactor being critical.It should be noted that when in this Condition with onesteam supply to the turbine driven AFW pump inoperable, thatthe AFA train of AFW is considered to be inoperable.B. 1Completion Time ProgramWith one of the /equired rains, pump or fow inoperable, act i/on must be taken to restore OPERABLE statuswithin 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This Condi ti on includes the loss of twosteam supply lines to the turbine driven AFW pump. The12 hour Completion Time is reasonable, based on theredundant capabilities afforded by the AFW System, the timeneeded for repairs, and the low probability of a DBA eventoccurring during this period. Two AFW pumps and flow pathsremain to supply feedwater to the steam generators. 1hae~-nr,.,.,,, /""m,'1n4-4n,"', 4:,,,, DP A,,-t4i ,,- R 1 ,- =,.---1-.. -- -.-----~1 4n.4+ an 4kn m,,rv4nIufh +4rnn ~1 ln,.,nrl fnr. ~Vn, r.nrnkn+,nn nf....... n,- 4-h -4.. ... ... ... .... .. A r n -n+ i nm 4 1 u.*;me L mn O v-I ** .** S PP I~AP u*ln n* n .-"lPl_ _ J___.... I- -" ...... "!=2---- ...... 2 J "1 2--2 .L -- .k =" ---- --" -- --i~f~uu~..~iIiL .S ..... ..... ... ...... ......n... ........"1"I J 2__44.4 ,....saa4 .~. aA f'anA4 4.4 an -..P4.an A4 aiwan., a.F.. JI.P u p t,,....~ .u u I~. SI 55V'-'~t~Cn i na 4, .u mnn4' 4wl.k nI A ,Th4,- 14.,.44. 4,-,,.,,.,,,-,. ap4 a .,,4I I--2 ..-- 2 ....___ .L .L-" ..L-" L l J -- A m...J f'l~ m,,p T ' ** '. ,__.r.1T~in ,n .I .'r. ri n ,,,at n na ,A iv ,. T. n hiu.= n kit a. , a. a l ,h n.pTfl L.:'T:: ='7-:':: : ..... ... ...... ...: :::- .-%:-.;:= : :::::i: .: ::: : .. ..... ... .. ....... 3.(co1nayticaestatinCmpeioeimsapl(continued)InsertPALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 4&PALO VERDE UNITS 1,2,3B 3.7.5-6REVISION Insert for page B 3.7.5-60._1With two AFW trains inoperable in MODE 1, 2, or 3, the Required Action is torestore at least one AFW train to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain amethod of decay heat removal. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptablebecause it minimizes risk while allowing time for restoration of at least one AFWtrain. Alternately, a Completion Time can be determined in accordance with theRisk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the secondAFW train is intentionally made inoperable. This Required Action is not intendedfor voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one AFW train is inoperable for any reasonand a second AFW train is found to be inoperable, or if two AFW trains are foundto be inoperable at the same time.In MODE 4, with two AFW trains inoperable, operation is allowed to continuebecause only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO.Although it is not required, the unit may continue to cool down and start the SDC.

AFW SystemB 3.7.5BASESACIN(conti nued) __ ln72 ADWhen either Requi red Acti on A.1 1pB, cannot be compl etedwithin the required Completion Time, or if t';'o ,AFW, trains; .... unr¢ -unit must be placedinacthe LCOdosntapyReviewer's note: To achieve this status, the unit must be placed in at leastthis is deleted in the MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.TSTF asesThis Condition includes the loss of 2 AFW pumps. ThisCondition also includes the situation where one steam supplyto the turbine driven AFW pump i s i noperabl e, coi ncidentwith another ("B" or "N") AFW train inoperable.The allowed Completion Times are reasonable, based on operatingexperience, to reach the required unit conditions from fullpower condi ti ons i n an orderly manner and wi thout challIengi ngunit systems.Included aslast paragraphin new "0.1"above.Tn 1, ,.ith t',.,,- AFW, -trains inopr,-bl-, o,-,rat,-,, i,-11alod 1 ontI1,inu bccausc16 I onlyq. on., e ,AFW pump1 ,start thc SDC.i *Reuired Acti on 1 i s modi fi ed by a Note i ndi cati ng thatall required MODE changes or power reductions are suspendeduntil one AFW train is restored to OPERABLE status.Completion Times are also suspended at the time theconditions is entered. The Completion Time is resumed withthe time remaining when the Condition was entered uponrestoration of one AFW train to OPERABLE status.With all three AFW trains inoperable in MODES 1, 2, and 3.the unit is in a seriously degraded condition with no TSrelated means for conducting a cooldown, and only limitedmeans for conducting a cooldown with nonsafety gradeequipment. In such a condition, the unit should not beperturbed by any action, including a power change, thatmight result in a trip. The seriousness of this conditionrequires that action be started immediately to restore oneAFW train to OPERABLE status. LCO 3.0.3 is not applicable,as it could force the unit into a less safe condition.(conti nued)PALO VERDE UNITS 1,2,3 B3757RVSOB 3.7.5-7REVISION 9 AFW SystemB 3.7.5BASESACTIONS ___.(c~tinedr~F Required Action- l.1 is modified by a Note indicating thatall required MODE changes or power reductions are suspendeduntil one AFW train is restored to OPERABLE status.Completion Times are also suspended at the time theCondition is entered. The Completion Time is resumed withthe time remaining when the Condition was entered uponrestoration of one AFW train to OPERABLE status.With one AFW train inoperable, action must be taken toimmediately restore the inoperable train to OPERABLE statusor to immediately verify, by administrative means, theOPERABILITY of a second train. LCO 3.0.3 is not applicable,as it could force the unit into a less safe condition.In MODE 4, either the reactor coolant pumps or the SDC loopscan be used to provide forced circulation as discussed inLCO 3.4.6, "RCS Loops -MODE 4."SURVEILLANCE SR 3.7.5.1REQU IREMENTSVerifying the correct alignment for manual, power operated,and automatic valves in the AFW water and steam supply flowpaths provides assurance that the proper flow paths existfor AFW operation. This SR does not apply to valves thatare locked, sealed, or otherwise secured in position, sincethese valves are verified to be in the correct positionprior to locking, sealing, or securing. This SR also doesnot apply to valves that cannot be inadvertently misaligned,such as check valves. This Surveillance does not requireany testing or valve manipulations; rather, it involvesverification that those valves capable of potentially beingmispositioned are in the correct position.The Surveillance Frequency is controlled under theSurveillance Frequency Control Program.SR 3.7.5.2Verifying that each AFW pump's developed head at the flowtest point is greater than or equal to the requireddeveloped head ensures that AFW pump performance has notdegraded during the cycle. Flow and differential head are(conti nued)PALO VERDE UNITS 1,2,3B3.58REION 6B 3.7.5-8REVISION BCSTB3.7.6BASESAPPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator isbeing relied upon for heat removal, the CST is required tobe OPERABLE.In MODES 5 and 6, the CST is not required because the AFWSystem is not required.ACTIONS _AI and _A.? / is inoperablelIf the CST level ,is not ,within the limit, the OPERABILITY ofthe backup water supply (RMWT) must be verified within 4and nce er 1 ' of the RMWT must include initial alignment andand oce pe 12 verification of the OPERABILITY of flow paths from the RMWThours thereafter .to ntvthe AFW pumps, and availability of sufficient total waterinventory using the combined CST and RMWT inventories tosatisfy the requirements of l ong-term cool ing event whichincludes both LOCA Long-Term Cooling and Reactor SystemsBranch Technical Position 5-1 (RSB 5-1). The CST mustbe to OPERABLE status within 7 days, as the RMWTm y<e performing this function in addition to its normalIrestored (editorial) functions. 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, based' on operatid experience, to verify the OPERABILITY of theRMWT. The 7\day Completion Time is reasonable, based on anOPERABLE RMW being availIable, and the low probabilIity of anevent requiriM the use of the water from the CST occurringduring this pe iod.\ IAlternately, a Completion Time can beL-Idetermined in accordance with the RiskCompletion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3763RVSOB 3.7.6-3REVISION 5-5 EW SystemB 3.7.7BASESLCO(continued) not acceptable and would render both the EW System and theSDC system inoperable (Ref. 3). The EW System is inoperablein this situation because it is operating outside of theacceptable limits of the system.APPLICABILITYIn MODES 1, 2, 3, and 4, the EW System must be prepared toperform its post accident safety functions, primarily RCSheat removal by cooling the SDC heat exchanger.When the plant is in other than MODES 1, 2, 3 or 4, therequirements for the EW System shall be consistent with thedefinition of OPERABILITY which requires (support) equipmentto be capable of performing its related support function(s).1or in accordance with the Risk InformedCompletion Time ProgramACTIONSA.1Required Action A.1 is modiT Led by a Note indicating therequirement of entry into the applicable Conditions andRequired Actions of LCO 3.4.6, "RCS Loops -MODE 4," for SDCmade inoperable by EW. This not is only applicable in Mode4. This is an exception to LCO 3.0.6 and ensures the properactions are taken for these compon ts.With one EW train inoperable, action be taken torestore OPERABLE status within 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> .In this Condition,the remaining OPERABLE EW train is adequate to perform theheat removal function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is basedon the redundant capabilities afforded by the OPERABLEtrain, and the low probability of a DBA occurring duringthis period.IInsert2B.1 and/B.2If the EW train c be restored to OPERABLE status withinthe associated Completion Time, the unit must be placed in aMODE in which the LCO does not apply. To achieve thisstatus, the unit must be placed in at least MODE 3 within6 hours and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.(conti nued)PALO VERDE UNITS 1,2,3B3.7- RVSO 4B 3.7.7-3,REVISION Insert for page B 3.7.7-3B.1With two EW trains inoperable, the Required Action is to restore at least one ofthe required EW trains to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sinkfor safety related components. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptablebecause it minimizes risk while allowing time for restoration of at least one train.Alternately, a Completion Time can be determined in accordance with the RiskInformed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the secondEW train is intentionally made inoperable. This Required Action is not intendedfor voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one EW train is inoperable for any reasonand a second EW train is found to be inoperable, or if two EW trains are found tobe inoperable at the same time.

LW SystemB 3.7.7BASESACTIONS nS2(continued)Te allowed Completion Times are reasonable, based onoperating experience, to reach the required unit conditionsfrom full power conditions in an orderly manner and withoutchallenging unit systems.SURVEILLANCE SR 3.7.7.1REQUIREMENTSVerifying the correct alignment for manual, power operated,and automatic valves in the EW flow path provides assurancethatthe proper flow paths exist for LW operation. This SRdoes not apply to valves that are locked, sealed, orotherwise secured in position, since these valves areverified to be in the correct position prior to locking,sealing, or securing. This SR also does not apply to valvesthat cannot be inadvertently misaligned, such as checkvalves. This Surveillance does not require any testing orvalve manipulation: rather, it involves verification thatthose valves capable of potentially being mispositioned arein their correct position.This SR is modified by a Note indicating that the isolationof the LW components or systems renders those components orsystems inoperable but does not necessarily affect theOPERABILITY of the LW System. Isolation of the LW System tothe Essential Chiller, while rendering the Essential Chillerinoperable, is acceptable and does not impact theOPERABILITY of the LW System. Isolation of the LW System tothe SDC system heat exchanger is not acceptable and wouldrender both the LW System and the SDC system inoperable(Ref. 3). The LW System is inoperable in this situationbecause it is operating outside of the acceptable limits ofthe system.The Surveillance Frequency is controlled under theSurveillance Frequency Control Program.SR 3.7.7.2This SR verifies proper automatic operation of the LW valveson an actual or simulated actuation signal. ThisSurveillance is not required for valves that are locked,sealed, or otherwise secured in the required position under(conti nued)PALO VERDE UNITS 1,2,3B37.-REION 6B 3.7.7-4REVISION ES PSB 3.7.8BASESACTIONSA.1With one ESPS train inoperable, actionA\iust be taken torestore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition,the remaining OPERABLE ESPS train is adequate to perform theheat removal function. However, the overall reliability isreduced because a single failure in the ESPS train couldresult in loss of ESPS function. Required Action A.1 ismodified by two Notes. The first Note indicates that theapplicable Conditions of LCO 3.8.1, "AC Sources -Operating,"must be entered when the inoperable ESPS train results in aninoperable emergency diesel generator. The second Noteindicates that the applicable Conditions and RequiredActions of LCO 3.4.6, "RCS Loops -MODE 4," should be enteredif an inoperable ESPS train results in an inoperable SDCSystem. This note is only applicable in MODE 4. The72 hour Completion Time is based on the redundantcapabilities afforded by the OPERABLE train, and the low[InsertI probability of a DBA occurring during this time period.If the ESPS train ant be restored to OPERABLE statuswithin the associated Completion Time, the unit must beplaced in a MODE in which the LCO does not apply. Toachieve this status, the unit must be placed in at leastMODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the required unit conditionsfrom full power conditions in an orderly manner and withoutchallenging unit systems.SURVEILLANCEREQUIREMENTSSR 3.7.8.1Verifying the correct alignment for manual and poweroperated, valves in the ESPS flow path ensures that theproper flow paths exist for ESPS operation. This SR doesnot apply to valves that are locked, sealed, or otherwisesecured in position, since they are verified to be in thecorrect position prior to locking, sealing, or securing.This SR also does not apply to valves that cannot beinadvertently misaligned, such as check valves. This(conti nued)PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISIONPALO VERDE UNITS 1,2,3B 3.7.8-3REVISION Insert for page B 3.7.8-3B.1With two ESPS trains inoperable, the Required Action is to restore at least one ofthe required ESPS trains to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sinkfor safety related components. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptablebecause it minimizes risk while allowing time for restoration Of at least one train.Alternately, a Completion Time can be determined in accordance with the RiskInformed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the secondESPS train is intentionally made inoperable. This Required Action is notintended for voluntary removal of redundant systems or components fromservice. The Required Action is only applicable if one ESPS train is inoperablefor any reason and a second ESPS train is found to be inoperable, or if twoESPS trains are found to be inoperable at the same time.

UHSB 3.7.9BASESLCO The UHS is required to be OPERABLE. The UHS is consideredOPERABLE if it contains a sufficient volume of water at orbelow the maximum temperature that would allow the ESPS tooperate for at least 26 days with no makeup following thedesign basis LOCA without the loss of net positive suctionhead (NPSH), and without exceeding the maximum designtemperature of the equipment served by the ESPS. To meetthis condition, the UHS temperature should not exceed 89°Fand the level of each ESP should not fall below 12 ft usablewater depth during normal unit operation. Since the bottom1.5 ft of the ESPS is required to meet pump submergencerequirements, an actual depth of 13.5 ft is needed to meetthe 26 day requirement for inventory purposes.The 12' is the water volume that would be depleted over 26days following a design basis LOCA if no makeup wereavailable. The thermal performance analysis utilizes theentire volume inventory of the pond(s) since the entirevolume is always available as a heat sink.APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support theOPERABILITY of the equipment serviced by the UHS andrequired to be OPERABLE in these MODES.When the plant is in other than MODES 1, 2, 3, or 4, therequirements for the UHS shall be consistent with thedefinition of OPERABILITY, which requires (support)equipment to be capable of performing its related supportACTIONS A-an4 ^ --AI nd .2Tf ',-e U i ii opT~bethe unit must be placed in a MODElllfte Reqiredin whi LCO does not apply. To achieve this status,If he equre th /nit must be placed in at least MODE 3 within 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sIAction and I in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Timeslassociated --are reasonable, based on operating experience, to reach theICompletion Time Irequi red uni t condi ti ons from full power condi ti ons 1in anare ot etorderly manner and without challenging unit systems.(conti nued)PALO VERDE UNITS 1,2,3B379-REION4B 3.7.9-2REVISION 44 Insert for page B 3.7.9-2A.1 and A.2If the UHS is inoperable, the Required Action is to restore the UHS to OPERABLE statuswithin 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> completion time is acceptable because it minimizes risk whileallowing time for restoration. Alternatively, a Completion time can be determined inaccordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating the Risk Informed Completion Time is notapplicable when the UHS is intentionally made inoperable. The Required Action is notintended for voluntary removal of systems or components from service. The RequiredAction is only applicable if the UHS is found to be inoperable.

EC SystemB 3.7.10P Ior in accordance with the RisklIlnformed Completion Time ProgramBASESAPPLICABILITY(conti nued)When the plant is in other than MODES 1, 2, 3 or 4, therequirements for the EC System shall .Le consistent with thedefinition of OPERABILITY which requires (support) equipmentto be capable of performing its relate support function(s).EDITORIAL:ACTIOS A.1should read ECIf one EC train is in erable, action Jst be taken torestore OPERABLE s JTtus within 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> .In this condition,one OPERABLE is adequate to perform the coolingfunction. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, basedIInser / on the low probability of an event occurring during thist,,ime and the 100% capacity OPERABLE EC train.3/.1 at least oneI'-' If rain cannot be restored to OPERABLE status withinthe associated Completion Time, the unit must be placed in aMODE in which the LCO does not apply. To achieve thisstatus, the unit must be placed in at least MODE 3 within6 hours, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowedCompletion Times are reasonable, based on operatingexperience, to reach the required unit conditions from fullpower conditions in an orderly manner and withoutchallenging unit systems.SURVEILLANCEREQU IREMENTSSR 3.7.10.1Verifying the correct alignment for manual, power operated,and automatic valves in the EC flow path provides assurancethat the proper flow paths exist for EC operation. This SRdoes not apply to valves that are locked, sealed, orotherwise secured in position, since they are verified to bein the correct position prior to locking, sealing, orsecuring. This SR also does not apply to valves that cannotbe inadvertently misaligned, such as check valves. ThisSurveillance does not require any testing or valvemanipulation; rather, it involves verification that thosevalves capable of potentially being mispositioned are in thecorrect posi ti on.(conti nued)PALO VERDE UNITS 1,2,3 B371- EIIN1B 3.7.10-3REVISION Insert for page B 3.7.10-3B.1With two EC trains inoperable, the Required Action is to restore at least one trainto OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sink for safety-related airhandling systems. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because itminimizes risk while allowing time for restoration of at least one train. Alternately,a Completion Time can be determined in accordance with the Risk InformedCompletion Time Program.The Condition is modified by a Note stating it is not applicable when the secondEC train is intentionally made inoperable. This Required Action is not intendedfor voluntary removal of redundant systems or components from service. TheRequired Action is only applicable if one EC train is inoperable for any reasonand a second EC train is found to be inoperable, or if two EC trains are found tobe inoperable at the same time.

CREATCSB 3.7.12BASES (continued)LCO Two independent and redundant trains of the CREATCS arerequired to be OPERABLE to ensure that at least one isavailable, assuming a single failure disables the othertrain. Total system failure could result in the equipmentoperating temperature exceeding limits in the event of anaccident.The CREATCS is considered OPERABLE when the individualcomponents that are necessary to maintain the control roomtemperature are OPERABLE in both trains. These componentsinclude the cooling coils and associated temperature controlinstrumentation. In addition, the CREATCS must be OPERABLEto the extent that air circulation can be maintained.APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement ofirradiated fuel assemblies, the CREATCS must be OPERABLE toensure that the control room temperature will not exceedequipment OPERABILITY requirements following isolation ofthe control room.Movement of spent fuel casks containing irradiated fuelassemblies is not within the scope of the Applicability ofthis technical specification. The movement of dry caskscontaining irradiated fuel assemblies will be done with asingle-failure-proof handling system and with transportequipment that would prevent any credible accident thatcould result in a release of radioactivity.ACTIONS A.1With one CREATCS train inoperable, action must be taken torestore OPERABLE status within 30 days. In this Condition,the remaining OPERABLE CREATCS train is adequate to maintainthe control room temperature within limits. The 30 dayCompletion Time is reasonable, based on the low probabilityof an event occurring requiring control room isolation,consideration that the remaining train can provide therequired capabilities, and the alternate safety or nonsafetyrelated cooling means that are available.L ~I7J>(conti nued)PALO VERDE UNITS 1,2,3 B371- EIIN2B 3.7.12-2REVISION 2-$

Insert for page B 3.7.12-2B.1With two CREATCS trains inoperable in MODE 1, 2, 3, or 4, the Required Actionis to restore at least one CREATCS train to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> toregain temperature control for the control room following isolation of the controlroom. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk whileallowing time for restoration of at least one train. Alternately, a Completion Timecan be determined in accordance with the Risk Informed Completion TimeProgram.The Condition is modified by a Note stating it is not applicable when the secondCREATCS train is intentionally made inoperable. This Required Action is notintended for voluntary removal of redundant systems or components fromservice. The Required Action is only applicable if one CREATCS train isinoperable for any reason and a second CREATCS train is found to beinoperable, or if two CREATCS trains are found to be inoperable at the sametime.

CR EATC SB 3.7.12BASES (continued)and,.,B.2- }oB.11ACTIONS.1ad 2(continued) /i / /In MODE 1, 2, 3, or 4, when Required Action A.1 cannot tbebe placed in a MODE that minimizes the accident risk. Toachieve this status, the unit must be placed in at leastMODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.The allowed Completion Times are reasonable, based onoperating experience, to reach the required unit conditionsfrom full power conditions in an orderly manner and withoutchallIengi ng unit systems.In MODE 5 or 6, if Required Action A.1 cannot be completedD wthin the required Completion Time, the OPERABLE CREATCS trainmust be placed in operation immediately (including supportingsystems. This action ensures that the remaining train isOPERABLE, that no failures preventing automaticactuation willoccur, and that any active failIure willI be readily detected.IiJngovement of i rradi ated fuel assembl ies, i f Requi redAction A.1 cannot be completed within the Required CompletionTime, the OPERABLE CREATCS train must be placed in operationimmediately (i ncl udi ng supporting systems) or movement ofirradiated fuel assemblies must be suspended immediately. Thefirst action ensures that the remaining train is OPERABLE,that no undetected failIures preventing system operati on wiIlloccur, and that any active failIure wilIl be readily detected.If the system is not immediately placed in operation, thisacti on requi res suspensi on of the movement of i rradi ated fuelassemblies in order to minimize the risk of a release ofradi oacti vi ty that might requi re i sol ati on of the controlroom. This does not preclude the movement of fuel to a safeposi ti on.In MDE bor 6, or during movement of irradiated fuelassembl ies with two CREATCS trains inoperabl e, action mustbe taken immediately to suspend activities that could resulti n a rel ease of radi oacti vi ty that might requi re i sol ati onof the control room. This places the unit in a conditionthat minimizes the accident risk. This does not precludethe movement of fuel to a safe position.(conti nued)PALO VERDE UNITS 1,2,3B37123RVSOB 3.7.12-3REVISION 5-5 CREATCSReviewer's Note: The B 3.7.12TSTF-505 Bases state that thisaction is not applicable for plantswith a RICT Program.BASESIACTTIOlSV "r'*" CP~ATr~i t"~n~ ~m 4"cm.~h'r' 4p Mflfl~ 1, ?, '~, ~ Afunction and thc unit iz in a condition outzidc thc accidcnt~ia4y&i-s~- Thcrcforc, LCO 3.0.3 muzt bc cntcrcd imnicdiatcly.SURVEILLANCE SR 3.7.12.1REQU IREMENTSThis SR verifies that the heat removal capability of thesystem is sufficient to meet design requirements. This SRconsists of a combination of testing and calculations. TheSurveillance Frequency is controlled under the SurveillanceFrequency Control Program.REFERENCES 1. UFSAR, Section 9.4.PALO VERDE UNITS 1,2,3 B371- EIIN~B 3.7.12-4REVISION AC Sources -OperatingR 2P 1Alternatively, a Completion T~~imcabedtridincodneI LI 'J.LJ.+/-IACTIONSTSTF-439deletionsA.2 (continued) /Additionally, the/24 hour Completion Time takes into accountthe capacity and capability of the remaining AC sources, areasonable time/for repairs, and the low probability of aDBA occurring ring this period.A.3"According t/Regulatory Guide 1.93 (Ref. 6), operation maycontinue il Condition A for a period that should not exceed72 hours. vWi th one offsi te ci rcui t i noperabl e, therel iabi1i ty of the offsi te system i s degraded, and thepotential for a loss of offsite power is increased, withattendant potential for a challenge to the unit safetysystems. In this Condition, however, the remaining OPERABLEoffsite circuit and DGs are adequate to supply electricalpower to the onsite Class lE Distribution System.The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the capacityand capability of the remaining AC sources, a reasonabletime for repairs, and the low probability of a DBA occurringduring this period.The secondA Completion Time for Requi. red Action. A.3 establishes~ta1limit the maximum ti;me for~ any, co,-mbination ofconiguus "ccurence failn to4 mee the. LCO. 44meet the LCO, to restore the offsite circuit. At this time, ahOPERBE, an d an additional 10 days. (for. 0a tota of 23 days)Completion....Time prvides._ a limit onl the, time....... 4r alloe in..,4 aconmnecto between the, 12 hor., and 13 day Completion. Time. mansAs in Requ~i",red Action A.2, the. Completiorn Time allow for. an..exceptio÷4n to. t"he nor~mal "ti4mezro" "f or~/'i beginningad t-heoutage'r time. This will result÷ in(conti nued)PALO VERDE UNITS 1,2,3B3819REION4B3.8.1-9REVISION 42=

AC Sources -OperatingB 3.8.1IAlternatively, a Completion Time can be determined in accordanceBASES Iwith the Risk Informed Completion Time Program.ACTIONS B.3.1 and B.3.2 (continued)According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> ireasonable to confirm that the OPERABLE DG(s) is notaffected by the same problem as the inoperable DG.B.4In Condition B, the remaining OPERABLE DG and offsitecircuits are adequate to supply electrical power to thonsite Class 1E Distribution System. The 10 day Compi tionTime takes into account the capacity and capability of theremaining AC sources, a reasonable time for repairs, a, thelow probabiIi ty of a DBA occurri ng during this period.When utiIi zing an extended DG Compl eti on Time (a Compl eti onTime greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and less than or equal to 10days), the compensatory measures listed below shall beimplemented. For planned maintenance utiIi zing an extendedCompletion Time, the compensatory measures shall beimplemented prior to entering Condition B. For an unplannedentry into an extended Completion Time, the compensatorymeasures shall be implemented without delay.1. The redundant DG (along with all of its requiredsystems, subsystems, trains, components, and devices)will be verified OPERABLE (as required by TS) and nodiscretionary maintenance activities will be scheduledon the redundant (OPERABLE) DG.2. No discretionary maintenance activi ties wilIl bescheduled on the station blackout generators (SBOGs).3. No discretionary maintenance activi ties wilIl bescheduled on the startup transformers.4. No discretionary maintenance activi ties wilIl bescheduled in the APS switchyard or the unit's 13.8 kVpower supply lines and transformers which could cause aSi ne outage or challIenge offsi te power availIabiIi ty tothe unit utilizing the extended DG Completion Time.5. All activity, including access, in the Salt RiverProject (SRP) switchyard shall be closely monitored andcontrolled. Discretionary maintenance within theswitchyard that could challenge offsite power supplyavailability will be evaluated in accordance with 10 CFR50.65(a)(4) and managed on a graded approach accordingto risk significance.6. The SBOGs will not be used for non-safety functions(i.e., power peaking to the grid).(continued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-12REVISION 4@

AC Sources -Operati ngB 3.8.1BASESACTIONSB.4 (continued)7. Weather condition:DG from service ddAddi ti onal ly, DGsevere weather cotconditions are 8. All maintenance acis utilizing theassessed and mana9. The functionalityensuring that thesuccessful ly complbefore entering th10. The OPERABILITY ofpump will be verifC'nmnlptfinn will be assessed prior to removing aring planned maintenance acti vi ties.utages will not be scheduled whenditions and/or unstable griddicted or present.tivities associated with the unit thatKtended DG Completion Time will be_d per 10 CFR 50.65 (Maintenance Rule))f the SBOGs will be verified byonthly start test has beented within the previous four weeksextended DG Completion Time.the steam driven auxiIi ary feedwatered before entering the extended DG11. The system dispatc 1er will be contacted once per day andinformed of the DG status, along with the power needs ofthe facilIi ty.12. Should a severe weather warning be issued for the localarea that could affect the switchyard or the offsitepower supply during the extended DO Completion Time, anoperator will be av ilable locally at the SBOG shouldlocal operation of ;he SBOG be required as a result ofon-site weather rel damage.13. No discretionary ma ntenance will be allowed on the mainand unit auxi li ary ransformers associated with theuni t.If one or more of the a ove compensatory measures is not metwhile in the extended c impletion time, the corrective actionprogram shallI be entere l, the risk managed in accordancewith the Maintenance Ru , and the compensatory measure(s)restored without delay.TSTF-439deletionsThc ...o.d Completion Time for ,,uicdAtin,.during.any..ingle contguou oinurrenc offailin to LCO to restore he nG. ,At this time an. offsite circuit(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-13REVISION 48 AC Sources -OperatingB 3.8.1BASESACTIONSTSTF-439deletionsB.4 (continued)could# .g.n..c.... np..bcth.DGr....d....BEanan.additional 72 ,4--a total o-,f 416 , day,) al,- lowed"AND conccor ctwcn te 1 da and 13 day, Competioalloe time'4"÷' "clock." This will resul t in establishing theC.1 and C.2Requi red Acti on C. 1, which appl ies when two offsite circuitsare inoperable, is intended to provide assurance that anevent with a coincident single failure will not result in acomplete loss of redundant required safety functions. TheCompletion Time for this failure of redundant requiredfeatures is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from that allowed for onetrain without offsite power (Required Action A.2). Therationale for the reduction to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is that RegulatoryGuide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> fortwo requi red offsite ci rcuits inoperable, based upon theassumption that two complete safety trains are OPERABLE.When a concurrent redundant required feature failure exists,this assumption is not the case, and a shorter CompletionTime of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate. These features are poweredfrom redundant AC safety trains. These features requi reClass lE power from PBA-S03 or PBB-S04 ESF buses to beOPERABLE, and are identical to those specified in ACTIONA. 2. Mode appl icabi li ty i s as specified in each appropriateTS section.The Completion Time for Required Action C.1 is intended toallow the operator time to evaluate and repair anydiscovered inoperabilities. This Completion Time alsoallows for an exception to the normal "time zero" forbeginning the allowed outage time "clock.' In this RequiredAction, the Completion Time only begins on discovery thatboth:a. All required offsite circuits are inoperable; andb. A required feature is inoperable.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-14REVISION 48 AC Sources -OperatingB 3.8.1BASESACTIONSC.1 and C.2 (continued)If at any time during the existence of Condition C (two offsitecircuits inoperable) and a required feature becomes inoperable,this Completion Time begins to be tracked.According to Regulatory Guide 1.93 (Ref. 6), operation maycontinue in Condition C for a period that should not exceed 24hours. This level of degradation means that the offsiteelectrical power system does not have the capability to effecta safe shutdown and to mitigate the effects of an accident;however, the onsite AC sources have not been degraded. Thislevel of degradation generally corresponds to a total loss ofthe immediately accessible offsite power sources.Because of the normally high availability of the offsitesources, this level of degradation may appear to be more severethan other combinations of two AC sources inoperable thatinvolve one or more DGs inoperable. However, two factors tendto decrease the severity of this level of degradation:a. The configuration of the redundant AC electrical powersystem that remains available is not susceptible to asingle bus or switching failure; andAlternatively, aCompletion Timecan be determinedin accordance withthe Risk InformedCompletion TimeProgram.b.The time required to detect and restore an unavailableoffsite power source is generally much less than thatrequired to detect and restore an unavailable onsiteWtbo othe required offsite circuits inoperable,sufficient ksite AC sources are available to maintain the unitin a safe shut n condition in the event of a DBA ortransient. In fac 1a simultaneous loss of offsite AC sources,a LOCA, and a worst c msingle failure were postulated as apart of the design basis safety analysis. Thus, the 24hour Completion Time provide of time to effectrestorati on of one of the offsit ci rcuits commensurate withthe importance of maintaining an AC e gtrical power systemcapable of meeting its design cri teri According to Regulatory Guide 1.93 (Ref. 6), with the availableoffsite AC sources, two less than required by the LCO,operation may continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If two offsite sourcesare restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, unrestricted operation maycontinue. If only one offsite source is restored within 24hours, power operation continues in accordance withCondition A.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-15REVISION 48 AC Sources -OperatingB 3.8.1BASESACTI ONSAlternatively, aCompletion Timecan be determinedin accordance withthe Risk InformedCompletion TimeProgram.C.1 and C.2 (continued)Condition C applies only when the offsite circuits areunavailable to commence automatic load sequencing in theevent of a design basis accident (DBA). In cases where theoffsite circuits are available for sequencing, but a DBAcould cause actuation of the Degraded Voltage Relays,Condition G applies.D.1 and D.2Pursuant to LCO 3.0.6, the Distribution System ACTIONS wouldnot be entered even if all AC sources to it were inoperablein de-energization. Therefore, the RequiredXctions of Condition D are modified by a Note to indicatewhen Condition D is entered with no AC source to at amn, the Conditions and RequiredActions for LCO 3.8.9,"D~stribution Systems -Operating," must be immediatelyen red. This allows Condition D to provide requirementsfor \the loss of one offsite circuit and one DO withoutregad to whether a train is de-energized. LCO 3.8.9provi es the appropriate restrictions for a de-energizedAccordin Regulatory Guide 1.93 (Ref. 6), operation maycontinue ~n Condition D for a period that should not exceed12 hours.In Condition D, individual redundancy is lost in both theoffsite electrical power system and the onsite AC electricalpower system. Since power system redundancy is providedbytwo diverse sources of power, however, the reliability ofthe power systems in this Condition may appear higher thanthat in Condition C (loss of both required offsitecircuits). This difference in reliability is offset by thesusceptibility of this power system configuration to asingle bus or switching failure. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> CompletionTime takes into account the capacity and capability of theremaining AC sources, a reasonable time for repairs, and thelow probability of a DBA occurring during this period,Alternatively, a Completion Time can bedetermined in accordance with the Risk InformedCompletion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-16REVISION AC Sources -OperatingB 3.8.1BASESACTIONS(conti nued)Alternatively, aCompletion Timecan be determinedin accordance withthe Risk InformedCompletion TimeProgram.E.1With Train A and Train B DGs inoperable, there are noremaining standby AC sources. Thus, with an assumed loss ofoffsite electrical power, insufficient standby AC sourcesare available to power the minimum required ESF functions.Since the offsite electrical power system is the only sourceof AC power for this level of degradation, the risksociated with continued operation for a short time couldb ess than that associated with an immediate controlledshdwn (the immediate shutdown could cause gridis ility, which could result in a total loss of ACpoe) Since any inadvertent generator trip could al soresult total loss of offsite AC power, the time allowedfor conti operation is severely restricted. The intenthere is to ~void the risk associated with an immediatecontr~olle~d s ~utdown and to minimize the risk associated withthis level of egradation.According to Reg atory Guide 1.93 (Ref. 6), with both DGsinoperable, operat qn may continue for a period that shouldnot exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.'P.1 and F.2The sequencer(s) is an essential support system to both theoffsite circuit and the DG associated with a given [SF bus.Furthermore, the sequencer is on the primary success pathfor most major AC electrically powered safety systemspowered from the associated [SF bus. Therefore, loss of anESF bus sequencer affects every major [SF system in the loadgroup. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period oftime to correct the problem commensurate with the importanceof maintaining sequencer OPERABILITY.A This time period alsoensures that the probability of an ac ident (requiringsequencer OPERABILITY) occurring durnn periods when thesequencer is inoperable is minimal. Re luired Action F.2 isintended to provide assurance that a s ngle failure of a DGSequencer will not result in a loss of safetyfunction of critical redundant requi rec features.Alternatively, a Completion Time can bedetermined in accordance with the RiskInformed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-17REVISION Insert for page B 3.8.1-17G.1With three or more required AC sources inoperable, the Required Action is torestore the required AC source(s) to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regainsome level of redundancy in the AC electrical power supplies. The 1 hourCompletion Time is acceptable because it minimizes risk while allowing time forrestoration of required AC sources. Alternately, a Completion Time can bedetermined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when three ormore required AC sources are intentionally made inoperable. This RequiredAction is not intended for voluntary removal of redundant systems or componentsfrom service. The Required Action is only applicable if two required AC sourcesare inoperable for any reason and additional required AC sources are found to beinoperable, or if three or more required AC sources are found to be inoperable atthe same time.

AC Sources -OperatingB 3.8.1BASESACTIONS JG.1 and G.2(continued) 7ensure offsite circuits will not be lost as a consequencea DBE, certain conditions must be maintained. Failure toH-- -maintain these conditions may result in double sequencingshould an accident requiring sequencer operation occur.An offsite circuit meets its required capability bymaintaining either of the following conditions:1. Steady-state switchyard voltage at or above the minimumlevel needed to support the offsite circuit's functions.The minimum allowable voltage is the value calculated asfollows or 528.5 kV, whichever is less:Base minimum voltage (provides foremergency loads on PBA-S03 or PBB-S04 andhouse loads on NAN-S01 or NAN-S02)If the offsite circuit is connected to1-E-NAN-S05 or 1-E-NAN-S06If the house load group associated withthe offsite circuit is connected to bothNBN-S01 and NBN-S02 (tie breaker NBN-S01Cclosed)If the offsite circuit is connected toanother unit's PBA-S03 or PBB-S04518 kVadd 6.5 kVadd 4 kVadd 1.5 kVThis option does not apply if the unit under review isthe only Palo Verde unit synchronized to the 525 kVswitchyard and its main generator gross MVAR output is >0 or if the offsite circuit is connected to both PBA-S03and PBB-S04 in the same unit.The values used to calculate minimum allowable voltageare based on calculations 01, 02, 03-EC-MA-0221 thatanalyze many different bus alignment conditions. Thevalues are conservative, with sufficient margin toaccount for analytical uncertainties and to provideassurance that the degraded voltage relays will notactuate as a result of an accident.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-18REVISION AC Sources -OperatingB 3.8.1BASESACTIONS G.I an Q_.2 (continued)"--" The highest minimum voltage of 528.5 kV is based onmanagement of the loading of the startup transformersecondary windings to not exceed their rated 70 MVAcapacity during a design basis event. When two unitsare sharing a secondary winding, the associated tiebreaker NAN-SO3B or NAN-SO4B must always be open andfast bus transfer control switch NAN-HK-SO3B or NAN-HK-S04B in "Manual" position in at least one of the units.Meters A-E-MAN-EI-O01 and A-E-MAN-EI-002 are used tomonitor switchyard voltage. The allowable values takeinto account metering uncertainties. A voltage diplasting 35 seconds or less is considered a transient,rather than steady-state condition based on the credited35 second time delay of the degraded voltage relay. Thetime delay feature on the meters' alarms may be set upto 35 seconds to avoid nuisance alarms.2. Associated tie breaker NAN-SO3B or NAN-SO4B to houseload buses NAN-S01 or NAN-S02 open and fast bus transfercontrol switch NAN-HK-SO3B or NAN-HK-SO4B in "Manual"position. When two units are sharing a startuptransformer secondary winding, this condition must bemet in both units.If the required capability in is not met, theeffects of an AO0 or DBA could cause further depression ofthe voltage at the ESF bus and actuation of the degradedvoltage relays. These actuations would result indisconnection of the bus from the offsite circuits.Regulatory Guide 1.93 (Ref. 6) defines this condition as"The Available Offsite Power Sources Are One Less Than theLCO" or "The Available Offsite AC Power Sources Are Two LessThan the LCO," depending on the number of affected circuits.However, degraded post-trip voltage could also cause ESFelectrical equipment to be exposed to a degraded conditionduring the degraded voltage relay time-out period. There isa risk that equipment misoperation or damage could occurduring this time. In this scenario, the [SF equipment maynot perform as designed fol lowi ng an automatic di sconnecti onof the offsite circuits and reconnection to the dieselgenerators (DGs), even though adequate power is availablefrom the DG. For certain DBAs, an additional consideration(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4B 3.8.1-19REVISION AC Sources -OperatingB 3.8.1BASESACTIONS r~ .Ian d_$.2 (continued)is that the initial sequencing of the ESF equipment onto theoffsite circuits, subsequent tripping of the degradedvoltage relays, and interrupti on i n equipment credi ted i nthe UPSAR Chapter 6 and 15 safety analyses could challengethe credited equipment response times. Therefore, it isappropriate to implement Required Actions that are morestringent than those speci fi ed in Condition A or C.If the required capability in Condition G is not met, thefollowing options are available to restore full or partialOperability. Options are listed in their order ofpreference.1. Achieve Condition 1 as discussed above (switchyardvoltage at or above the minimum allowable value). Thisi s accompl ished by either of the fol lowi ng:*Increase switchyard voltage. If more than one PaloVerde unit is operating, switchyard voltage i sincreased by increasing MVAR output of any PaloVerde unit, or by any number of methods implementedby the Energy Control Center. If only one PaloVerde unit is operating, switchyard voltage isincreased by any number of methods implemented bythe Energy Control Center while maintaining thegenerator gross MVAR output of the Pal o Verde unitto-<O.* Reduce minimum allowable voltage as calculatedabove. This is achieved by realignment of equipmentpower sources, if such an option is available.2. Achieve Condition 2 as discussed above. This isaccomplished by ensuring the affected tie breaker(NAN-SO3B or NAN-SO4B) is open and the fast bustransfer control switch (NAN-HK-SO3B or NAN-HK-SO4B) isin the "Manual" position. If two units are sharing astartup transformer secondary winding, this conditionmust be achieved in both units. Although Palo Verdehas no formal restrictions on the amount of time thatfast bus transfer can be out of service, this optionshould be used judiciously in order to maintain forcedci rcul ati on capabiIi ty.(continued)PALO VERDE UNITS 1,2,3 B3812 EIIN4B 3.8.1-20REVISION AC Sources -OperatingB 3.8.1BASESACTIONS G~ l.l an (continued)3. Transfer the safety bus(es) to the diesel generator(s).This is less desirable than option 2, because it wouldperturb the plant. It would cause the plant to remainin an LCO 3.8.1 condition (A or C, depending on whetherone or two buses are transferred).Options 1 and 2 satisf~y Requi red Actior#.1, and Option 3satisfies Required Action-.2. With more than one offsiteci rcuit does not me~t the requi red capability,could be satisfied for each offsite circuit byte use of Required Actior# .1 or-G .2. The Completion Timefor both Required 1 anG. 2 is one hour. The onenour time 7imit is appropriate and consistent with the needto remove the unit from this condition, because the level ofdegradation exceeds that descri bed i n Regulatory Guide 1.93(Ref. 6) for two offsite circuits inoperable. Theregulatory guide assumes that an adequate onsite powersource is still available to both safety trains, but in ascenario involving automatic load sequencing and low voltageto the ESF buses, adequate voltage is not assured from anyof the power sources for the following systems immediatelyafter the accident signal has been generated (i .e., whilethe degraded voltage relay is timing out): radiationmonitors Train A RU-29 or Train B RU-30 (TS 3.3.9), Train BRU-145; ECCS (TS 3.5.3); containment spray (TS 3.6.6);containment isolation valves (TS 3.6.3); auxiliary feedwatersystem (TS 3.1.5); essential cooling water system(TS 3.7.7); essential spray pond system (TS 3.7.8);essential chilled water system (TS 3.7.10); control roomessential filtration system (TS 3.7.11); [SF pump room airexhaust cleanup system (TS 3.1.13); and fuel buildingventilIati on.Required Action G.2 is modified by a Note. The reason forthe Note is to ensure that the offsite circuit is notinoperable for a time greater than the Completion Timeallowed by LCO 3.8.1 Condition A or C. Therefore, ifConditions A or C are entered, the Completion Time clock forConditions A and C would start at the Time Condition G wasentered.(conti nued)PALO VERDE UNITS 1,2,3B381-1RVSO4B 3.8.1-21REVISION AC Sources -OperatingB 3.8.1BASESACTIONS(conti nued)Reviewer's Note:The TSTF-505Bases state thatthis action is notapplicable forplants with a RIOTProgram.If the inoperable AC electrical power sources cannot berestored to OPERABLE status within the required CompletionTime, the unit must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the unit must bebrought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times arereasonable, based on operating experience, to reach therequi red unit conditions from full1 power condi ti ons i n anorderly manner and without challenging unit systems.inth AC,4,,4.., elcetrica power .,1.tem wil-l c.au,.sc a-..1.* loss of -,e.,49,,,,., ,,,e,,.forc, no aditona tim, is,,.. ,justified for, commence a controlled shutdow:n.SURVEILLANCEREQU IREMENTSThe AC sources are designed to permit inspection and testingof all important areas and features, especially those thathave a standby function, in accordance with 10 CFR 50,Appendix A, GDC 18 (Ref. 8). Periodic component tests aresupplemented by extensive functional tests during refuelingoutages (under simulated accident conditions).The SR for demonstrating OPERABILITY of thethe recommendations of Regulatory Guide 1.9otherwise noted in the Updated FSAR SectionDGs are based on(Ref. 3), unless1.8.The DG capabilities (starting and loading) are required tobe met from a variety of initial conditions such as DG instandby condition with the engine hot (SR 3.8.1.15) and DGin standby condition with the engine at normal keep-warmconditions (SR 3.8.1.2, SR 3.8.1.1 and SR 3.8.1.19).Although it is expected that most DG starts will beperformed from normal keep-warm conditions, DG starts shouldbe performed with the jacket water cooling and lube oiltemperatures within the lower to upper limits of DGOPERABILITY, except as noted above. Rapid cooling of the DGdown to normal keep-warm conditions should be minimized.(conti nued)PALO VERDE UNITS 1,2,3 B3812 EIIN4B 3.8.1-22REVISION DC Sources -OperatingB 3.8.4BASESLCO Channel B includes 125 VDC bus PKB-M42, 125 VDC battery bank(continued) PKB-F12, and normal battery charger PKB-H12 or backupbattery charger PKB-H16.Channel D includes 125 VDC bus PKD-M44, 125 VDC battery bankPKD-F14, and normal battery charger PKD-H14 or backupbattery charger PKB-H16.An OPERABLE DC electrical power subsystem requires allrequired batteries and respective chargers to be operatingand connected to the associated DC bus(es).APPLICABILITY The DC electrical power sources are required to be OPERABLEin MODES 1, 2, 3, and 4 to ensure safe unit operation and toensure that:a. Acceptable fuel design limits and reactor coolantpressure boundary limits are not exceeded as a resultof AOOs or abnormal transients; andb. Adequate core cooling is provided, and containmentintegrity and other vital functions are maintained inthe event of a postulated DBA.The DC electrical power requirements for MODES 5 and 6, andduring movement of irradiated fuel assemblies are addressedin the Bases for LCO 3.8.5, "DC Sources -Shutdown."ACTIONS A.1, A.2, and A.3Condition A represents one subsystem with one batterycharger inoperable (e.g., the voltage limit of SR 3.8.4.1 isor in accordance not maintained). The ACTIONS provide a tiered response thaton returning the battery to the fully charged statewith the Risk a mLrestoring a fully qualified charger to OPERABLE statusInformed in a heasonable time period. Required Action A.1 requiresCompletion Time that the lattery terminal voltage be restored to greaterProgram than or equa o the minimum established float voltage(2.17 volts per 11~ (Vpc) times the number of connectedcells or 130.2 V fo 60 cell battery at the batteryterminals) within 2 hou .This time provides for returningthe inoperable charger to OPERABLE status or providing analternate means of restoring battery terminal voltage togreater than or equal to the minimum established floatvoltage. Restoring the battery terminal voltage to greaterthan or equal to the minimum established float voltageprovides good assurance that, within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, the batterywill be restored to its fully charged condition(cnnudPALO VERDE UNITS 1,2,3B384-REION IB 3.8.4-5REVISION DC Sources -OperatingB 3.8.4BASESACTIONS (Required Action A.2) from fully charged condition(condition) any discharge that might have occurred due to the chargerinoperability.A discharged battery having terminal voltage of at least theminimum established float voltage indicates that the batteryis on the exponential charging current portion (the secondpart) of its recharge cycle. The time to return a batteryto its fully charged state under this condition is simply afunction of the amount of the previous discharge and theor in accordance recharge characteristic of the battery. Thus there is agood assurance of fully recharging the battery within 12with the Risk hours, avoiding a premature shutdown with its own attendantInformed ri sk.Completion If esta battery terminal float voltage cannot beProgram restored to grea a equal to the minimum establishedfloat voltage within 2 o , and the charger is notoperating in the current-limiting mode, a faulty charger isindicated. A faulty charger that is incapable ofmaintaining established battery terminal float voltage doesnot provide assurance that it can revert to and operateproperly in the current limit mode that is necessary duringthe recovery period following a battery discharge event thatthe DC system is designed for.If the charger is operating in the current limit mode after2 hours that is an indication that the battery is partiallydischarged and its capacity margins will be reduced. Thetime to return the battery to its fully charged condition inthis case is a function of the battery charger capacity, theamount of loads on the associated DC system, the amount ofthe previous discharge, and the recharge characteristic ofthe battery. The charge time can be extensive, and there isnot adequate assurance that it can be recharged within 12hours (Required Action A.2).Required Action A.2 requires that the battery float currentbe verified as less than or equal to 2 amps. This indicatesthat, if the battery had been discharged as the result ofthe inoperable battery charger, it is now fully capable ofsupplying the maximum expected load requirement. The 2 ampvalue is based on returning the battery to 95% charge andassumes a 5% design margin for the battery. If at theexpiration of the initial 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period the battery floatcurrent is not less than or equal to 2 amps this indicatesthere may be additional battery problems and the batterymust be declared inoperable.(conti nued)PALO VERDE UNITS 1,2,3B3.4-REION6B 3.8.4-6REVISION DC Sources -OperatingB 3.8.4Alternately, a Completion Time can be determined inlaccordance with the Risk Informed Completion Time I--BASES Program. iIACTIONS(conti nued)Required Action A.3 limits the restoratjIgn time for theinoperable battery charger to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This action isapplicable if an alternate means of restoring batteryterminal voltage to greater than or equal to the minimumestablished float voltage has been used. The backup class1E charger is used to restore OPERABILITY as no balance ofplant non-class lE battery charger exists. The 72 hourCompletion Time reflects a reasonable time to effectrestoration of the qualified battery charger to OPERABLEstatus.B.1Condition B represents one subsystem with a loss of abilityto completely respond to an event, and a potential loss ofability to remain energized during normal operation. Thiscondition is exclusive of the status of. one battery charger.It is therefore, imperative that the operator's attentionfocus on stabilizing the unit, minimizing the potential forcomplete loss of DC power to the affected subsystem. The2 hour limit is consistent with the allowed time for ani noperabl e DC di stri buti on subsystem.If one of the required DC electrical po er subsystems isinoperable for reasons other than Condition A, the remainingDC electrical power subsystem has the capacity to support asafe shutdown and to mitigate an accident condition. Since asubsequent worst case single failure would\ however, resulti n the complete loss of the remaining 125 VC el ectricalpower subsystem with attendant loss of ESF fnctions,continued power operation should not exceed The2 hour Completion Time is based on Regulatory\Guide 1.93(Ref. 8) and reflects a reasonable time to ass ss unitstatus as a function of the inoperable DC elect ical powersubsystem and, if the DC electrical power subsys em is notrestored to OPERABLE status, to prepare to effect an orderlyand safe unit shutdown. .......- .....Mlterna~ely, a Lomple~ionTime can be determined inaccordance with the RiskInformed Completion TimeProgram.(conti nued)PALO VERDE UNITS 1,2,3 B3847RVSOB 3*8*4-7REVISION @-]:

Insert for page B 3.8.4-70.1With two DC electrical power subsystems inoperable, the Required Action is to restore atleast one DC electrical power subsystem to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regaincontrol power for the AC emergency power system. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time isacceptable because it minimizes risk while allowing time for restoration of at least onerequired DC electrical power subsystem. Alternately, a Completion Time can bedetermined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second DCelectrical power subsystem is intentionally made inoperable resulting in loss of safetyfunction. This Required Action is not intended for voluntary removal of redundantsystems or components from service. The Required Action is only applicable if one DCelectrical power subsystem is inoperable for any reason and a second DC electricalpower subsystem is found to be inoperable, or if two DC electrical power subsystem arefound to be inoperable at the same time.

DC Sources -OperatingB 3.8.4ACTIONS .1 and .2(conti nued)If the inoperable DC electrical power subsystem cannot berestored to OPERABLE status within the required CompletionTime, the unit must be brought to a MODE in which the LCOdoes not apply. To achieve this status, the unit must bebrought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times arereasonable, based on operating experience, to reach therequired unit conditions from full power conditions in anorderly manner and without challenging unit systems. TheCompletion Time to bring the unit to MODE 5 is consistentwith the time required in Regulatory Guide 1.93 (Ref. 8).SURVEILLANCE SR 3.8.4.1REQUIREMENTSVerifying battery terminal voltage while on float charge forthe batteries helps to ensure the effectiveness of thebattery chargers, which support the ability of the batteriesto perform their intended function. Float charge is thecondition in which the charger is supplying the continuouscharge required to overcome the internal losses of a batteryand maintain the battery in a fully charged state whilesupplying the continuous steady state loads of theassociated DC subsystem. On float charge, battery cellswill receive adequate current to optimally charge thebattery. The voltage requirements are based on the nominaldesign voltage of the battery and are consistent with theminimum float voltage established by the batterymanufacturer (2.17 volts per cell (Vpc) times the number ofconnected cells or 130.2 V for a 60 cell battery at thebattery terminals). This voltage maintains the batteryplates in a condition that supports maintaining the gridlife. The Surveillance Frequency is controlled under theSurveillance Frequency Control Program.SR 3.8.4.2Del etedSR 3.8.4.3Del etedSR 3.8.4.4 and SR 3.8.4.5Del eted(continued)PALO VERDE UNITS 1,2,3 B3848RVSOB 3.8.4-8REVISION Inverters -OperatingB 3.8.7BASES (continued)LCO disconnected. All other i nverters must be connected to(continued) their associated batteries and aligned to their associatedAC vital instrument buses.APPLICABILITY The i nverters are required to be OPERABLE in MODES 1, 2, 3,and 4 to ensure that:a. Acceptable fuel design limits and reactor coolantpressure boundary limits are not exceeded as a resultof AOOs or abnormal transients; andb. Adequate core cooling is provided, and containmentOPERABILITY and other vital functions are maintainedin the event of a postulated DBA.Inverter requirements for MODES 5 and 6, and during movementof irradiated fuel assemblies are covered in the Bases forLCO 3.8.8, "Inverters -Shutdown."ACTIONS A. 1With a requi red inverter inoperable, i ts associated AC vitalinstrument bus becomes i noperabl e untilI i t i s re-energi zedfrom its Cl ass lE constant voltage source regulator.edo n d atcombninatioefnse Requi red Acti on A. 1 i s modi fi ed by a Note, which states to~f dterinitic efese- enter the appl i cabl e condi ti ons and Requi red Actions ofin-depth and safety LCO 3.8.9, "Di stri buti on Systems -Operating," whenmargin inherent in the Condi ti on A is entered with one AC vital instrument buselectrical distribution de-energized. This ensures the AC vital instrument bus issystem with risk insights re-energi zed wi thin 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> vi a the Cl ass lE constantfrom the station's internal vol tage regul ator.~IevenatsPRAmdl R ui red Acti on A.1i all ows 7 days to fix the inoperableAltrntivly ain ter and return it to service. The 7 day limit is ~Completion Time can be ,4 .... ,- r- l -÷ 1 T- 4 .... .-÷ .... -L-(determined inaccordance with the RiskInformed CompletionTime Program.anyisr ll,lllr t in rint con.. ider... tion.. the.. time..required...t .repair an inverter and the additional risk to ".'hich the u-nit.....exposed ... beas of th in..rt. inoper.. bi. it, This hasto be balanced against the risk of an immediate shutdown,along with the potential challenges to safety systems such ashutdown might entail. When the AC(conti nued)PALO VERDE UNITS 1,2,3B387-REION 3B 3.8.7-3REVISION Inverters -OperatingB 3.8.7BASES (continued)ACTIONS A.1 (continued)vital instrument bus is powered from its constant voltagesource, it is relying upon interruptible AC electrical powersources (offsite and onsite). The uninterruptible invertersource to the AC vital instrument buses is the preferredsource for powering instrumentation trip setpoint devices.Planned inverter maintenance or other activities thatrequire entry into Required Action A.1 will not beundertaken concurrent with the following:a. Planned maintenance on the associated train DieselGenerator (DG): orb. Planned maintenance on another RPS or ESFAS channel thatresults in that channel being in a tripped condition.These actions are taken because it is recognized that withan inverter inoperable and the instrument bus being poweredby the regulating transformer, instrument power for thatIInser 1 train is dependent on power from the associated DG following"a loss of offsite power event.and _.B.2If the inoperable devices or components cannot be restoredto OPERABLE status within the required Completion Time, theunit must be brought to a MODE in which the LCO does notapply. To achieve this status, the unit must be brought toat least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required unitconditions from full power conditions in an orderly mannerand without challenging unit systems.PALO VERDE UNITS 1,2,3 B3874RVSOB 3.8.7-4REVISION Insert for page B 3.8.7-4B,1With two or more required inverters inoperable, the Required Action is to restoreall but one required inverter to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain ACelectrical power to the vital buses. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptablebecause it minimizes risk while allowing time for restoration of at least onerequired inverter. Alternately, a Completion Time can be determined inaccordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when two or morerequired inverters are intentionally made inoperable resulting in loss of safetyfunction. This Required Action is not intended for voluntary removal of redundantsystems or components from service. The Required Action is only applicable ifone required inverter is inoperable for any reason and additional requiredinverters are found to be inoperable, or if two or more required inverters arefound to be inoperable at the same time.

Distribution Systems -OperatingB 3.8.9With one or mo e required AC buses, load centers, or motorcontrol cente s (see Table B 3.8.9.-i), except AC vitalinstrument b 'ses, in one subsystem inoperable, the remainingAC electricaI power distribution subsystem in the othertrain is ca able of supporting the minimum safety functionsnecessary shut down the reactor and maintain it in a safeshutdown c ndition, assuming no single failure. The overallreliabilit/ is reduced, however, because a single failure inthe remai ing power distribution subsystems could result inthe mini [um required ESF functions not being supported.Therefor , the required AC buses, load centers and motorcontrol\ must be restored to OPERABLE status withinCondition A worst scenario is one train (PBA or PBB) withoutAC power (i.e., no offsite power to the train and theassociated DG inoperable). In this condition, the unit ismore vulnerable to a complete loss of AC power. It is,therefore, imperative that the unit operator's attention befocused on minimizing the potential for loss of power to theremai ni ng train by stabiIi zi ng the uni t, and on restoringpower to the affected train. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> time limit beforerequiring a unit shutdown in this condition is acceptablebecause of:a. The potential for decreased safety if the unitoperator' s attention i s diverted from the evaluationsand actions necessary to restore power to the affectedtrain, to the actions associated with taking the unitto shutdown within this time limit; andb. The potential for an event in conjunction with asingle failure of a redundant component in the trainwith AC power.TSTF-439 .h codCmito im o curdAto ....deletions combinatio of..... rcgu"" c "ub" y tem to bc'"(conti nued)PALO VERDE UNITS 1,2,3 B3894RVSOB 3.8.9-4REVISION 0 Distribution Systems -OperatingB 3.8.9BASESACTIONS AP-_ rfee.t-.... TSTF 439 for.. intnc a...C.bu... i... n............nd ..ub.equ ..ntlydeletions r-as-tor.ad OPE.RABLEc, t÷he uCO ..ay al rcady, hav b... not.. ÷c ,,..4e.÷--he0 h-,., Thiscould-, , r lead a totall of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />,-sl-nec -nitia.÷lr fa.lure ofI tlhci "LCQ, to rcsor thc;,iil ACill bccomc... ino.c..b....an....di.tributon re.tored OPERABLE.Thc Completion Timc allo..s fo an. Ccception to thc nor.malthis' will1 rosultl -in establis't.hing.t,' lhe "time zero" at tlhe timernCondition A was. entered. The 16 hour1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> Completion Time is anB.1With AC vital instrument bus(es) (Channels A or C, orChannels B or D) (see Table B 3.8.9-1) in one traini noperabl e, the remai ning OPERABLE AC vital bus el ectricalpower distribution subsystem is capable of supporting theminimum safety functions necessary to shut down the unit andmaintain it in the safe shutdown condition. Overallrel iabi1i ty is reduced, however, si nce an additional singl efailure could result in the minimum required ESF functionsnot being supported. Therefore, the required AC vitalinstrument buses must be restored to OPERABLE status within2 hours by powering the bus from the associated inverter viainverted DC voltage or the Class lE constant voltageregul ator./Condition B represents one train without adequate AC vitalinstrument us power; potentially both the DC source and theassociated A source are nonfunctioning. In this situation,the unit is ;ignificantly more vulnerable to a complete lossof all nonin1 erruptible power. It is, therefore, imperativethat the oper ator's attention focus on stabilizing the unit,minimizing potential for loss of OPERABILITY to theremaining vit 1 instrument buses, and restoring power to theaffected el ec ri cal power di stri buti on subsystem.\ Alternatively, a Completion Timelcan be determined in accordancethe Risk Informed______________________Completion Time Program. (conti nued)PALO VERDE UNITS 1,2,3 B3895RVSOB 3.8.9-5REVISION 0 Di stri buti on Systems -OperatingB 3.8.9BASESACTIONSB.1 (continued)This 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> limit is more conservative than Completion Timesallowed for the vast majority of components that are withoutadequate AC vital instrument power. Taking exception toLCO 3.0.2 for components without adequate AC vitalinstrument power, which would have the Required ActionCompletion Times shorter than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if declaredinoperable, is acceptable because of:a. The potential for decreased safety by requiring achange in unit conditions (i.e., requiring a shutdown)and not allowing stable operations to continue;b. The potential for decreased safety by requiring entryinto numerous Applicable Conditions and RequiredActions for components without adequate AC vitalinstrument power and not providing sufficient time forthe operators to perform the necessary evaluations andactions for restoring power to the affected train; andc. The potential for an event in conjunction with asingle failure of a redundant component.The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time takes into account the importanceto safety of restoring the AC vital instrument bus toOPERABLE status, the redundant capability afforded by theother OPERABLE vital instrument buses, and the lowprobability of a DBA occurring during this period.Th nsccond Coimnletioni Timc~l for Rnquire Actoncstablishc a limit on the maximum for anominatin uiue io subsystcu to beninoperabl duin an...... contguou ourr........offailng o mct hc CO.If CndiionB i cncrc whle,fo mminstancle, an ACm bus inopcrabl and subscquaentlrcturne OPEll BLE thc~ LCmO mlrcd h bccn nots fornTSTF-439deletions(conti nued)PALO VERDE UNITS 1,2,3 B3896RVSOB 3.8.9-6REVISION 0 Di stri buti on Systems -OperatingB 3.8.9BASESACTIONS 8- .... TSTF-439deletionsThis- Co-,npiction Timc, allow0..S for .... excetio t-o thc norm....... ..... fo bc in in thc..... ...o.... ou g t...... c.oc.".....This,- rcsult inm4 sabihing ,tinicm cr ,', at, the t-mct..... wa init........ll .. ....not.. met, inea of t ti ....e.C.1With DC bus(es) in one train (see Table B 3.8.9-1)inoperable, the remaining DC electrical power distributionsubsystem is capable of supporting the minimum safetyfunctions necessary to shut down the reactor and maintain itin a safe shutdown condition, assuming no single failure.The overall reli abi lity is reduced, however, because asingle failure in the remaining DC electrical powerdistribution subsystem could result in the minimum requiredESF functions not being supported. Therefore, the requiredDC buses must be restored to OPERABLE status within 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />sby powering the bus from the associated battery or batterycharger./Condition\C represents one train without adequate DC power;potenti al both wi th the battery significantly degraded andthe associ ted charger nonfunctioning. In this situation,the unit is significantly more vulnerable to a complete lossof all D C po er. It is, therefore, imperative that theoperator's ai tention focus on stabilizing the unit,minimizing potential for loss of power to the remainingDC buses and estoring power to the affected DC electricalpower di stribu in subsystem.a Completion Time can bein accordance with the RiskCompletion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3897RVSOB 3.8.9-7REVISION 0 Di stri buti on Systems -OperatingB 3.8.9BASESACTIONS C. 1 (continued)This 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> limit is more conservative than Completion Timesallowed for the vast majority of components which would bewithout power. Taking exception to LCO 3.0.2 for componentswithout adequate DC power, which would have Required ActionCompletion Times shorter than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, is acceptable becauseof:a. The potential for decreased safety by requiring achange in unit conditions (i.e., requiring a shutdown)whilIe all owing stable operations to continue;b. The potential for decreased safety by requiring entryinto numerous appl icable Condi ti ons and Requi redActions for components without DC power and notproviding sufficient time for the operators to performthe necessary evaluations and actions for restoringpower to the affected train; andc. The potential for an event in conjunction with asingle fai lure of a redundant component.The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time for DC buses is consistent withRegulatory Guide 1.93 (Ref. 3).ITSTF-439 ... ... ... .... ... .. .... .... .deletionsLi7nsertnnm.hinmtinn nf dimtrih,,tion r.,,hm,-rtem" to hertrned.... tODEDA\ILE, the IC may a...lredy hav beenI,` not met forsince failueo the ...,to .esto ..te..distribut+ion syste. ÷ t thi ti°-me, an AC train cou.ld agaiThis ..ould continu indefinitely. ,This Completion Time allow fo.. r an exceptio to- t he normal"time zero" for beginning. th allwd.uag .im. clc.".This will resu.lt in e~stalishing "time zero" at tlhe time,the LCO was. initially not met, instead of the timeCondition C w.as entered. The` 16 hour1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> Co. Time -is an-~(conti nued)PALO VERDE UNITS 1,2,3 B3898RVSOB 3.8.9-8REVISION g Insert for page B 3.8.9-8D.1IWith two or more electrical power distribution subsystems inoperable, the RequiredAction is to restore electrical power distribution subsystem(s) to OPERABLE statuswithin 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk whileallowing time for restoration. Alternately, a Completion Time can be determined inaccordance with the Risk Informed Completion Time Program.The Condition is modified by a NOTE stating it is not applicable when the two or moreelectrical power distribution subsystems are intentionally made inoperable resulting in aloss of safety function. This Required Action is not intended for voluntary removal ofredundant systems or components from service. The Required Action is only applicableif one electrical power distribution subsystem is inoperable for any reason and a secondelectrical power distribution subsystem is found to be inoperable, or if two or moreelectrical power distribution subsystems are found to be inoperable at the same time.

Di stri buti on Systems -OperatingB 3.8.9BASESACTIONS QD.1 and_.2(continued) :_El If the inoperable distribution subsystem cannot be restoredto OPERABLE status within the required Completion Time, theunit must be brought to a MODE in which the LCO does notapply. To achieve this status, the unit must be brought toat least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within36 hours. The allowed Completion Times are reasonable,based on operating experience, to reach the required unitconditions from full power conditions in an orderly mannerand without challenging unit systems.Condition E corresponds to a level of degradation in thcci cctri cal distribution system that causes a regui red safetyfunction to be lost. When more than one Condition is(conti nued)PALO VERDE UNITS 1,2,3 B3899RVSOB 3.8.9-9REVISION 0 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 4List of Regulatory Commitments EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesList of Regulatory Commitments1. Plant procedures needed to implement the Risk-Informed Completion Time Programshall be in place before the risk-informed completion times (RICTs) can be used.2. APS will notify the NRC by letter within 60 days of the first use of a RICT in each unit.3. To ensure the current baseline probabilistic risk assessment (PRA) core damagefrequency and large early release frequency values meet Regulatory Guide 1.1 74 risklimits for small changes in risk, the following will be performed prior to use of the RICTProgram in each unit:a. Install fuses in Control Room DC ammeter circuits to prevent secondary fires due tomultiple fire induced faults.b. Install fuses in non-class DC motor circuits to prevent secondary fires due to multiplefire induced faults. Alternatively, post continuous fire watches in FZ1 4 -Lower CableSpreading Room, COR2 -Corridor Building 120 ft., and TB-4B -Turbine BuildingStation DC Equipment Room, and prohibit welding or cutting activities in these areas,any time a RIOT is in effect. The alternative would only be credited in lieu of themodification if confirmed to meet Regulatory Guide 1 .174 risk limits for the specificplant configuration.c. Replace RCP control cables with one-hour fire rated cables. Alternatively, stage anoperator at the RCP switchgear to trip the ROPs upon direction from the ControlRoom, any time a RICT is in effect. The alternative would only be credited in lieu ofthe modification if confirmed to meet Regulatory Guide 1.174 risk limits for thespecific plant configuration.d. Install an additional Steam Generator makeup capability to reduce Internal Fire PRArisk.e. Implement recovery procedures for breaker coordination on class and non-classmotor control centers/distribution panels that impact risk significant functions in theInternal Fire PRA.4. Supporting requirements of ASME/ANS RA-Sa-2009 SY-C1 and SY-C2 shall be fullymet at Capability Category II prior to use of the RICT Program.5. Validate that the Unit 1 Internal Fire PRA model is bounding for Units 2 and 3 to reflectfield-routed cabling or create unit-specific internal fire models for Units 2 and 3 prior touse of the RICT Program at Units 2 and 3.6. Implementing procedures will prohibit RICT entry, or a RICT entry made shall be exited,for any condition involving a TS loss of function if a PRA functionality determinationconcludes that compliance with the LCO cannot be restored without placing the TSinoperable trains in an alignment which results in a loss of functional level PRA successcriteria.4-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTAC H MENT 5List of Revised Required Actions to CorrespondingProbabilistic Risk Assessment Functions EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesList of Revised Required Actions to CorrespondingProbabilistic Risk Assessment FunctionsSection 4.0, Item 2 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed TechnicalSpecifications (RMTS) Guidelines, (Reference 2 of this Attachment) identifies the followingneeded content:* The license amendment request ([AR) will provide identification of the TS LimitingConditions for Operation (LCOs) and action requirements to which the RMTS will apply.* The LAR will provide a comparison of the TS functions to the PRA modeled functions ofthe structures, systems, and components (SSCs) subject to those LCO actions.* The comparison should justify that the scope of the PRA model, including applicablesuccess criteria such as number of SSCs required, flow rate, etc., are consistent [with]licensing basis assumptions [i.e., 10 CFR 50.46 emergency core cooling system (ECCS)flow rates] for each of the TS requirements, or an appropriate disposition orprogrammatic restriction will be provided.This attachment provides confirmation that the Palo Verde Nuclear Generating Station (PVNGS)PRA models include the necessary scope of SSCs and their functions to address eachproposed application of the Risk-Informed Completion Time (RIOT) Program to the proposedscope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of theNRC Final Safety Evaluation. The scope of the comparison includes each of the TS LCOconditions and associated required actions within the scope of the RIOT Program. The PVNGSPRA model has the capability to model directly or through use of a bounding surrogate the riskimpact of entering each of the TS LCOs in the scope of the RIOT Program.Table A5-i, In Scope TS/LCO Conditions to Corresponding PRA Functions, lists each TS LCOCondition to which the RIOT Program is proposed to be applied, and documents the followinginformation regarding the TS with the associated safety analyses, the analogous PRA functions,and the results of the comparison:* Column "TS LCO/Condition": Lists all of the LCOs and condition statements within thescope of the submittal* Column "SSCs Covered by TS LCO/Condition": Lists the SSCs addressed by each actionrequirement* Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TSLCO/Condition are included in the PRA* Column "Function Covered by TS LCO/Condition": Contains a summary of the requiredfunctions from the design basis analyses* Column "Design Success Criteria": Lists a summary of the success criteria from the designbasis analyses* Column "PRA Success Criteria": Lists the function success criteria modeled in the PRA* Column "Comments": Provides the justification or resolution to address any inconsistenciesbetween the TS and PRA functions regarding the scope of SSCs and the success criteria.5-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesWhere the PRA scope of SSCs is not consistent with the TS, additional information isprovided to describe how the LCO condition can be evaluated using appropriate surrogateevents. Differences in the success criteria for TS functions are addressed to demonstratethe PRA criteria provide a realistic estimate of the risk of the TS condition as required byNEI 06-09-A.The corresponding SSCs for each TS LCO and the associated TS functions are identified andcompared to the PRA. This description also includes the design success criteria and theapplicable PRA success criteria. Any differences between the scope or success criteria aredescribed in the table. Scope differences are justified by identifying appropriate surrogateevents which permit a risk evaluation to be completed using the Configuration RiskManagement Program (CRMP) tool for the RIOT program. Differences in success criteriatypically arise due to the requirement in the PRA standard to make PRAs realistic rather thanoverly conservative, whereas design basis criteria are necessarily conservative and bounding.The use of realistic success criteria is necessary to conform to Capability Category II of the PRAstandard as required by NEI 06-09-A.Examples of calculated RIOTs are provided for each individual condition to which the RIOTapplies (assuming no other SS~s modeled in the PRA are unavailable) in this Attachment underTable A5-2, Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate. Actual RIOT values will becalculated based on the actual plant configuration using a current revision of the PRA modelwhich represents the as-built/as-operated condition of the plant, as required by NEI 06-09-A andthe NRC Final Safety Evaluation, and may differ from the RIOTs presented.5-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success CmetCondition TS LCOI/oee T CICondition Criteria CriteriaCondition in PRA3.3.4 6 channels of RPS No Unit shutdown to protect 1 of 6 channels N/A Note 1RPS Logic Matrix Logic core fuel design limits3nd Trip and Reactor CoolantInitiation 4channels of RPS Partial System (RCS) pressure 2of 4 channels Same Note 1initiating logic boundary4channels of of 4 channels Same Note 1RTCBs4channels of No 2of 4channels N/A Notel1manual trip3.3.6 6 Matrix Logic Partial Initiate safety systems to 1 of 6 channels Same Note 2ESFAS Logic Channels protect against violatingand Manual design limits andTrip 4Initiating Logic Partial RCS pressure boundary, 2of 4 channels Same Note 2Channels and to mitigate accidents2Actuation Logic Partial 1 of 2 channels Same Note 2Channels4Manual Trip Yes 2of 4 channels Same Note 2Channels3.4.9 >_groups of No Maintain ROS subcooling 2of 8 groups N/A Note 3Pressurizer heaters marginHeaters5-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA SuccessCondition TS LCOI/oee T CICondition Criteria Criteria Cmet_________ Condition in PRA __ _ _ _ _ _ _ _ _ ________3.4.10 SRVs Yes Prevent RCS pressure 4of 4 SRVs 4of 4 SRVsP~ressurizer from exceeding safety For limitingSafety limit anticipated[Valves Iransientithout scram(ATWS); 1 offornion ATWSscenarios3.4.12 4Pressurizer Yes Depressurize the RCS a Pressurizer Vent One of twoPressurizer Vents during a SGTR and LOP Path to parallel pathsVents Containment plus isolationcalve3.5.1 4SITS Emergency core cooling 3 of 4 SITs Same Note 4Safety system (EGOS) injectionInjection dluring a large loss-of-Tanks (SITs) soolant accident (LOCA)5-4 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success CmetCondition TS LCOI/oee T CICondition Criteria Criteria________ Condition in PRA3.5.3 High Pressure Yes Injection from RWT into (a) 1 of 2 HPSI SameEGOS -Injection Pumps cold legs pumps forOperating (HPSI) Cold leg recirculation small/mediumfrom containment sumps LOCA;SLow Pressure 1 of 2 LPSI pumpsInjection Pumps for large LOGA(LPSI)Hot leg recirculation from (b) 1 of 2 HPSl SameAssociated piping, containment sumps pumps for steamand heat generator tubee=xchangers rupture (SGTR) ormain steam linebreak (MSLB)1 of 2 HPSI or LPSl Samepumps to supplyother requiredEGGS pumpsuction and RCScold legs1 of 2 HPSI pumps Sameto supply otherrequired EGGSpumps suction andRGS hot legs5-5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA SuccessCondition TS LCOI/oee T CICondition Criteria Criteria Cmet_______ Condition in PRA3.5.5 RWT Yes Supply borated water to RWT boron RWT level The PRA does notRefueling ECCS and CS system concentration, ithin limits explicitly model theN~ater Tank during LOCA injection temperature, and impact of out of limitIRWT) phase for: level within limits boron or temperature,but conservatively,(a) containment cooling these can be addressedand depressurization for the RIOT Program byfailing the operator(b) core cooling and action to emergencyreplacement inventory borate for small boronconcentration deviationsi(c) negative reactivity for From required limits andreactor shutdown Fail the RWT for largerboron concentrations asappropriate per best-e=stimate analysis.Therefore, the LCOcondition can beevaluated using theCRMP.3.6.2 2air locks No Post-accident 2of 2 N/A SSCs for theDontainment (personnel and c'ontainment leakage containment air locks4ir Locks emergency) ithin limits can be evaluated by abounding assessmentas permitted by NEI 06-09-A. In this casecontainment isconservatively_____ ____ ____ ____ ____ _ ______ ___ ____ ____ _____ _ __ ____ ____ ___ __onsidereco sideed ifiled5-6 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1 : In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success CmetCondition TS LCOI/oee T CICondition Criteria Criteria_________ Condition in PRA__________3.6.3 2active or passive !es Each containment 1 of 2 isolation 1 of 2 isolation Any individualContainment isolation devices penetration isolated devices per devices per penetrations notIsolation on each fluid within the time limits penetration isolate penetration explicitly modeled in theValves penetration line assumed in the safety within required isolate within PRA have beenanalysis stroke time required evaluated to be lessstroke time than the 1.27" diameterfor: effective LERF containment for PVNGS. Multiplepurge; open penetrations canradwaste be modeled by failing adrain; surrogate penetrationcharging; found in the PRA model.letdown;reactor draintank (RDT)discharge;ROT Makeup;ROT vent;nitrogensupply;instrument air5-7 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TSILCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA SuccessCondition TS LCOI/oee T CICondition Criteria Criteria Cmet________ Condition in PRA3.6.6 2CS trains Yes Containment atmosphere 1 of 2 CS trains SameContainment cooling to limit post-Spray accident pressure andLemperatureIodine removal to reduceLhe release of fissionproduct radioactivity fromcontainment to theenvironment3.7.2 4MSIVs Yes Isolate steam flow from MSIV on affected 1 of 4 MSIVsMain Steam the secondary side of the steamline closes, or fail to closeIsolation SGs following a high remaining 3 MSIVsValves energy line break (HELB) on unaffected(MS IVs) steamline close.3.7.3 8 MFlIVs No Isolate feedwater flow MFIV on affected N/A MFIVs are modeled toMain from the secondary feedwater path open for flow path to feedFeedwater feedwater to the SGs closes SG. As a surrogate theIsolation following a HELB RICT will conservativelyValves fail the check valve tosteam generator closed(M FIVs) (for bypassed feed flow)and containmentpenetration failed open (forcontainment challenge ofHELB).5-8 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TS/LCO Conditions to Corresponding PRA FunctionsTS LCO/ SSCs Covered by SSCs Function Covered by Design Success PRA SuccessCondition TLCI Mdld TS LCOCI Condition Criteria Criteria CmetCondition in PRA________3.7.4 ADV lines (one Yes Cool unit to RHR entry of 4 ADVs to cool 1 of 4 ADVs The difference betweenAtmospheric per SG, each with conditions, if preferred down unit to design the Design SuccessDump ValvesADV and block heat sink via steam dump rate of 1 00°F per Criteria and PRA(ADVs) valve) to condenser not hour; 1 of 4 ADVs Success Criteria is dueavailable permit 25°F per to the Design basishour cooldown for a b~eing highlynatural circulation conservative whereascooldown event, the PRA is realistic.Thermal-hydraulicCool down RCS following 3 ADVs on intact 1 of 4 ADVs calculations haveSGTR to permit SG lines on intact SG determined only 1 ADVtermination of primary to lines is needed for adequatesecondary break flow heat removal during themost limiting accidentscenarios.5-9 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TS/LCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA SuccessCondition TS LCOI/oee T CICondition Criteria Criteria Cmet________ Condition in PRA3.7.5 2motor-driven Yes Supply feedwater to the 1 of 3 pumps for the SameAuxiliary pumps and 1 SGs to remove RCS most limiting eventFeedwater :urbine-driven decay heat (loss of main(AFW) pump feedwate r)System3.7.6 1 CST Yes Safety grade source of 1 CST aligned with SameCondensate water to SGs for minimum waterStorage Tank removing heat from RCS volume(CST)3.7.7 2trains Yes Heat transfer system to 1 of 2 loops with 1 1 of 2 loops The PRA also credits EWEssential the ultimate heat sink for of 2 EW pumps and with 1 of 2 EWto Nuclear Cooling as aCooling the removal of process 1 of 2 heat pumps and 1 backup for cooling RCPWater (EW) and operating heat from exchangers of 2 heat seals.System selected safety related air exchangershandling systems duringa DBA or transient.5-10 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TS/LCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success CmetCondition TS LCOI!oee SLO Condition Criteria Criteria________ Condition in PRA3.7.8 2trains 'es Heat sink for removal of 1 of 2 trains SameEssential process and operatingSpray Pond heat from the EWSystem system.(ESPS)3.7.9 2trains No Heat sink for removal of 1 of 2 trains N/A Per TS Bases, this impactsUltimate process and operating containment spray whenHeat Sink heat from the EW going on recirculation. This(UHS) system. is modeled for the RICT byrailing the associatedtrain's SoC HX, which failscontainment sprayrecirculation. Two trainsinoperable is modeled forthe RICT by failure of bothspray pond trains.3.7.10 trains Yes Heat transfer system to 1 of 2 trains SameEssential EW for the removal ofChilled Water process and operating(EC) System heat from selected safetyrelated air handlingsystems during a DBA ortransient.5-11 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TS/LCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success IPRA Success CmetCondition TS LCO/ Modeled TS LCOI/Condition Criteria Criteria CmetCondition in PRA3.7.12 2trains Yes Provides temperature 1 of 2 trains SameControl control for the controlRoom room following isolationEmergency of the control room.,irTemperatureControlSystem(CREATCS)3.8.1 2offsite circuits, 2 Yes Source of power to ESE ,utomatically Same Two Station BlackoutSources -diesel generators system atssociated ESE Generators (SBOG) areOperating (DG), 2 supply b)uses also credited in the PRAtrains of diesel fuel 1 of 2 trains model.oil transfersystems, Source of fuel oil to DGs 1 of 2 trains Same3.8.4 4Class 1 E DC 'es P~rovide control power to ,lign to provide SameDC Sources -subsystems ,C emergency power power to Operating system, motive and e=quipment fromcontrol power to selected battery andsafety related equipment associated chargerand backup 120 VACJital bus power5-12 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-1: In Scope TS/LCO Conditions to Corresponding PRA FunctionsTS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success CmetCondition TS LCOI/oee T CICondition Criteria Criteria________ Condition in PRA3.8.7 4Class 1 E Yes Provide uninterruptible Ilign to associated SameInverters -Inverters power to reactor 120 VAC vital bus,Operating protection system (RPS) with input powerand engineered safety From vial AC andFeatures actuation system associated battery(ESFAS)3.8.9 Class 1 E AC, DC, Yes Provide necessary power Align to provide SameDistribution and 120 volts, to ESF systems power to busesSystems -alternating (VAC)Operating ital bus electricalpower distributionsubsystemsNotes:1. Individual reactor trip system (RTS) instrumentation channels for input to the automatic RTS function will be evaluated using abounding evaluation as permitted by NEI 06-09-A. The PVNGS reactor protection design uses four quality class input channelsplaced through six channels of matrix logic to develop a trip signal to the reactor trip circuit breakers (RTCBs). The design allowsfor any one channel to be placed in bypass or trip without impacting the ability to trip the plant or perform testing with theremaining channels. Any channel which was unable to trip the circuitry at its required setpoint criteria would be both inoperableand non-functional for the RICT program. For the RICT Program, the risk for one or more inoperable instrument channels for onetrip signal will be evaluated assuming that the probability of failure of all RTCBs has increased by a factor of two. This is abounding conservative risk assessment as permitted by NEI 06-09-A. It is conservative because: (1) loss of one channel of matrixlogic can only impact three of the contacts in the initiation circuit for a RTCB; any of the remaining three will trip the breaker, and(2) the reactor protection system (RPS) logic failure rate with one matrix relay bypassed is at least one order of magnitude lessthan the reactor trip switchgear (RTSG) breaker failure rate (CE NPSD-277) and is conservatively bounded by increasing thebreaker failure rate. Therefore, the RPS is modeled in sufficient detail in the PRA model to capture the risk impacts fromunavailability of any channel. The instruments and logic for control functions are separate from and do not impact the RPS. Some5-13 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Timesquality class transmitters are shared by RPS and ESFAS, in which case the RIOT program would implement the equipment asbeing non-functional for both the RPS and ESFAS.2. The ESFAS is made up of 4 quality class input channels, 6 channels of Matrix Logic, 4 channels of Initiation Logic, 2 channels ofActuation Logic, and 4 channels of Manual Trip for 7 Functions; Safety Injection Actuation Signal (SlAS), Containment IsolationActuation Signal (CIAS), Recirculation Actuation Signal (RAS), Containment Spray Actuation Signal (OSAS), Main SteamIsolation Signal (MSlS), Auxiliary Feedwater Actuation Signal to SG-1 (AFAS-1), and Auxiliary Feedwater Actuation Signal to SG-2 (AFAS-2). Individual ESFAS instrumentation channels will be evaluated using a bounding evaluation as permitted by NEI 06-09-A. For one or more functions with manual trip or initiation logic channel inoperable, the actuation relays for one train of SlAS,OSAS, AFAS, or RAS will be assumed failed, 1 MSlV per steam generator will be failed for MSlS, and containment pressure mis-calibration will be set to logical True for CIAS. For one or more functions with two initiation logic channels inoperable or with oneactuation logic channel inoperable, the initiated equipment for one train of SIAS, CIAS, OSAS, or MSIS is assumed failed, and theinitiation relay for AFAS or RAS for one train is failed. For two actuation logic channels inoperable, both trains of the equipmentactuated by the associated signal are failed. The train of EFAS taken as failed will be the one sharing power with the channel thatis non-functional. This is conservative because: (1) a full train of ESAS-actuated equipment is being assumed unavailable at apoint downstream of the logic that is unavailable, (2) for multiple initiation channels or actuation logic inoperable, no credit istaken for operator recovery of the unavailable train except for AFAS and RAS, which have long recovery times, and (3) completefailure of the ESFAS function is assumed for two actuation logic channels inoperable. Therefore, the ESFAS is modeled insufficient detail in the PRA model to capture the risk impacts from unavailability of any channel. The instruments and logic forcontrol functions are separate from and do not impact the ESFAS. Some quality class transmitters are shared by RPS andESFAS, in which case the RIOT program would implement the equipment as being non-functional for both the RPS and ESFAS.3. Th~e pressurizer heaters will be evaluated for the RIOT Program by a bounding assessment as permitted by NEI 06-09-A. Thefunction of the heaters is to maintain subcooled conditions in the ROS for decay heat removal using forced or natural circulationwhen cooling down to shutdown cooling conditions. In the PRA, this is addressed by failing the operator action to align LPSI forshutdown cooling. This is conservative since it fails long-term cooling of the core.4. The success criteria in the PRA are consistent with the design basis criteria for large LOCA scenarios. For medium LOCAscenarios, the PRA success criteria do not require SITs based on realistic analyses consistent with the PRA standards forCapability Category II. Boron concentration out of limits will be evaluated for the RIOT Program by a bounding assessment aspermitted by NEI 06-09-A. This is conservative by failing the operator action to emergency borate for small boron concentrationdeviations from required limits and failing the SIT for larger boron concentrations as appropriate per best-estimate analysis.5-14 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-2: Units 112/3 In Scope TSILCO Conditions RICT EstimateTSILCO Condition RICT Estimate13.3.4 RPS Logic and Trip InitiationCondition A -One Matrix Logic channel inoperable 30 days3.3.6 ESFAS Logic and Manual TripCondition A -One or more Functions with one Matrix Logic channel 2 days2inoperable3.3.6 ESFAS Logic and Manual TripCondition B -One or more Functions with one Manual Trip or Initiation 2 days2Logic channel inoperable3.3.6 ESFAS Logic and Manual TripCondition C -One or more Functions with two Initiation Logic channels 2 days2inoperable3.3.6 ESFAS Logic and Manual TripCondition D -One or more Functions with one Actuation Logic channel 2 days2inoperable3.3.6 ESFAS Logic and Manual Trip 7dyCondition E -One or more Actuation Logic channels inoperable 7dy3.4.9 Pressurizer30dyCondition B -One pressurizer heater group inoperable30dy3.4.9 Pressurizer30dyCondition C -Two pressurizer heater groups inoperable30dy3.4.10 Pressurizer Safety Valves30dyCondition A -One pressurizer safety valve inoperable30dy3.4.12 Pressurizer Vents30dyCondition A -Two or three pressurizer vents inoperable30dy3.4.12 Pressurizer Vents 30 daysCondition B -All pressurizer vents inoperable_________3.5.1 Safety Injection Tanks (SITs) 30 daysConditions A and B -One SIT inoperable3.5.1 Safety Injection Tanks (SITs)30dyCondition C -Two or more SITs inoperable30dy3.5.3 Essential Core Cooling SystemCondition A -One LPSI subsystem inoperable 30 days5-!5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-2: Units 12123 In Scope TS/LCO Conditions RICT EstimateTS/LCO Condition RICT Estimate13.5.3 Essential Core Cooling System 30 daysCondition B -One or more trains inoperable3.5.3 Essential Core Cooling SystemCondition C -Less than 100% of ECCS flow equivalent to a single 10 daysOPERABLE train available3.5.5 Refueling Water Tank (RWT)Conditions A and B -RWT boron concentration or borated water 10 daystemperature not within limits_________3.6.2 Containment Air Locks25dyCondition C -One or more containment air locks inoperable25dy3.6.3 Containment Isolation ValvesCondition A -One or more penetration flow paths with one required 13 dayscontainment isolation valve inoperable3.6.3 Containment Isolation ValvesCondition B -One or more penetration flow paths with two 10 daysrequired containment isolation valve inoperable3.6.3 Containment Isolation ValvesCondition C -One or more penetration flow paths with one 16 daysrequired containment isolation valve inoperable3.6.3 Containment Isolation ValvesCondition D -One or more penetration flow paths with one 30 daysor more containment purge valves not within leakage limits3.6.6 Containment Spray System 30 daysCondition A -One containment spray train inoperable3.6.6 Containment Spray System30dyCondition C -Two containment spray trains inoperable30dy3.7.2 Main Steam Isolation Valves (MSIVs)30dyCondition F -One MISV inoperable30dy3.7.2 Main Steam Isolation Valves (MSIVs)30dyCondition G -Two or more MISVs inoperable30dy5-16 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-2: Units 112/3 In Scope TS/LCO Conditions RICT EstimateTSILCO Condition RICT Estimate13.7.3 Main Feedwater Isolation Valves (MFlIVs) 16 daysCondition A One or more ME! Vs inoperable3.7.3 Main Feedwater Isolation Valves (MFlIVs)15dyCondition B -Two valves in the same flow path inoperable15dy3.7.4 Atmospheric Dump Valves (ADVs) 30 daysCondition A -One ADV line inoperable3.7.4 Atmospheric Dump Valves (ADVs)Condition B -Two or more ADV lines inoperable with both ADV lines 30 daysinoperable on one or more SGs3.7.5 Auxiliary Feedwater System (AFW)30dyCondition A -One steam supply to turbine driven AFW pump inoperable30dy3.7.5 Auxiliary Feedwater System (AFW) 22 daysCondition B -One AFW train inoperable3.7.5 Auxiliary Feedwater System (AFW) 2 daysCondition C -Two AFW trains inoperable3.7.6 Condensate Storage Tank (CST) < 1 hr3Condition A -CST inoperable3.7.7 Essential Cooling Water System (EW) 30 daysCondition A -One EW train inoperable3.7.7 Essential Cooling Water System (EW) 30 daysCondition B -Two EW trains inoperable3.7.8 Essential Spray Pond System (ESPS) 30 daysCondition A -One ESPS train inoperable3.7.8 Essential Spray Pond System (ESPS) 28 daysCondition B -Two ESPS trains inoperable3.7.9 Ultimate Heat Sink (UHS) 30 daysCondition A -UHS inoperable3.7.10 Water (EC) System 30 daysCondition A- One EC train inoperable3.7.10 Water (EC) System 30 daysCondition B -Two EC trains inoperable3.7.12 Control Room Emergency Air Temperature Control System(CREATCS) 30 daysCondition B -Two CREACTS trains inoperable ________5-17 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-2: Units 1/213 In Scope TS/LCO Conditions RICT EstimateTS/LCO Condition RICT Estimate13.8.1 AC Sources -Operating30dyCondition A -One required offsite circuit inoperable30dy3.8.1 AC Sources -OperatingCondition B -One Diesel Generator (DG) inoperable 30 days3.8.1 AC Sources -OperatingCondition C -Two required offsite circuits inoperable 30 days3.8.1 AC Sources -OperatingCondition D -One required offsite circuit inoperable AND one DG 30 daysinoperable3.8.1 AC Sources -Operating 3dyCondition E -Two DGs inoperable 3dy3.8.1 AC Sources -OperatingCondition F -One automatic load sequencer inoperable 22 days3.8.1 AC Sources -Operating 3dyCondition G -Three or more required AC sources inoperable 3dy3.8.4 DC Sources -OperatingCondition A -One battery charger on one subsystem inoperable 30 days3.8.4 DC Sources -OperatingCondition B -One DC electrical power subsystem inoperable 3 days3.8.4 DC Sources -Operating <1h4Condition C -Two DC electrical power subsystems inoperable<1h3.8.7 Inverters -Operating30dyCondition A -One required inverter inoperable30dy3.8.7 Inverters -OperatingCondition B -Two or more required inverters inoperable 30 days3.8.9 Distribution Systems -OperatingCondition A -One AC electrical power distribution subsystem inoperable 7 days3.8.9 Distribution -OperatingCondition B -One AC vital instrument bus electrical power distribution 30 dayssubsystem inoperable5-18 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A5-2: Units 1/213 In Scope TS/LCO Conditions RICT EstimateTS/LCO Condition RICT Estimate13.8.9 Distribution Systems -Operating 6dyCondition C -One DC electrical power distribution subsystem inoperable 6dy3.8.9 Distribution Systems -OperatingCondition 0 -Two or more electrical power distribution subsystems 6 hrsinoperableNotes:1. RICTs are based on the internal events, internal flood, internal fire, and seismic PRA modelcalculations. RICTs calculated to be greater than 30 days are capped at 30 days based onNEI 06-09-A. RICTs are rounded to nearest number of days for illustrative purposes.2. This was evaluated with all of the EFAS signals being impacted to account for the "or more"condition of the LCO and thus, is a bounding value.3. The evaluation did not credit using the Reactor Makeup Water Tank to back up theCondensate Storage Tank, as it is not currently not credited in the PRA model due to lack oftesting of the flow path.4. The evaluation assumed the worst case of Train A and B batteries and chargers out ofservice concurrently.References1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(Agencywide Documents Access and Management System (ADAMS) Accession No.,ML071 200238) dated May 17, 20072. Nuclear Energy Institute (NEI) 06-09, Risk-Informed Technical Specifications Initiative 4b,Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document,Nuclear Energy Institute, Revision 0-A, (ADAMS Accession No. ML12286A322) datedNovember, 20065-19 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACH MENT 6Information Supporting Consistency withRegulatory Guide 1.200, Revision 2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesInformation Supporting Consistency withRegulatory Guide 1.200, Revision 2IntroductionNEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-ManagedTechnical Specifications (RMTS) Guidelines, (Reference 1 of this Attachment), Section 2.3.4states that the probabilistic risk assessment (PRA) shall be reviewed to the guidance ofRegulatory Guide (RG) 1.200, Revision 2 (Reference 2 of this Attachment), for a PRA whichmeets Capability Category II for the supporting requirements (SRs) of the internal events atpower PRA standard, and that deviations from these capability standards shall be justified anddocumented. APS has performed its review of the PRA to the guidance in RG 1 .200, Revision2. Section 4.0, Item 3 of the NRC Final Safety Evaluation (Reference 3 of this Attachment), forNEI 06-09-A requires the license amendment request (LAR) to include a discussion of theresults of peer reviews and self-assessments conducted for the plant-specific PRA modelswhich support the RMTS, including the resolution or disposition of any identified deficiencies(i.e., findings and observations from peer reviews). The scope of this information includes theinternal events PRA model and other models for which additional standards have beenendorsed by a revision to RG 1.200.This attachment provides information on the technical adequacy of the PVNGS PRA internalevent, internal flood, internal fire, and seismic models which support the Risk-InformedCompletion Time (RIOT) Program, in support of the LAR to revise Technical Specifications (TS)to implement NEI 06-09-A. This information is consistent with the requirements of Item 3 ofReference 3 of this Attachment and addresses each PRA model for which a RG 1 .200-endorsedstandard exists. The information is provided as follows:* Table A6-1 Internal Events PRA Peer Review A & B Findings* Table A6-2 Internal Events PRA Self-Assessment ASME SRs Not Met toCapability Category II*Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to CapabilityCategory II*Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to CapabilityCategory II*Table A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to CapabilityCategory IINote that the other external hazards have been screened out in accordance with RG 1.200,were peer reviewed in accordance with RG 1.200, Revision 2, and are further discussed inAttachment 8 of this Enclosure. Shutdown modes of operation are not in the scope of the RICTProgram and thus, low power and shutdown PRA models are not addressed. No other PRAstandards are endorsed by RG 1.200, Revision 2.All peer review findings associated with not-met ASME SRs are identified in this attachment andthose not yet met will be fully addressed prior to use of the RIOT Program, therefore satisfyingthe technical adequacy requirements of NEI 06-09-A. This attachment indicates the only twoSRs in ASME/ANS RA-Sa-2009 (Reference 4 of this Attachment), associated with the PVNGSPRA models that are currently not fully met at Capability Category II are SY-O1 and SY-C2.6-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesAPS has committed in Attachment 4 of this Enclosure to fully meet these SRs at CapabilityCategory II prior to use of the RIOT program.Since the associated peer review(s), no changes have been made to the internal event, internalflood, seismic, or internal fire PRA models that would constitute an upgrade as defined byASME/ANS RA-Sa-2009; thus no additional peer reviews are required to supportimplementation of the RIOT Program. PVNGS has a PRA model maintenance processconsistent with ASME/ANS RA-Sa-2009 reflecting the as-built, as-operated station and ensuresfuture changes (i.e., design changes, procedure changes, and equipment performancemonitoring) are periodically reflected in the PRA models. The PRA model maintenance programwas previously described in the RlITS 5b license application which was approved by Reference5 of this Attachment.Internal Events PRAA peer review of the PVNGS internal events PRA was conducted in April 1999 in accordancewith the reactor owners group peer review process (References 6 and 7 of this Attachment).APS subsequently performed a self-assessment of the PVNGS internal events models inDecember 2010 consistent with RG 1 .200, Revision 2, using the current endorsed standardASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix B.Internal Flood PRAA peer review of the PVNGS internal flood PRA was conducted in October 2010 (Reference 8 ofthis Attachment) consistent with RG 1.200, Revision 2, using the current endorsed standardASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix A.Seismic PRAA peer review of the PVNGS seismic PRA was conducted in December 2013 (Reference 9 ofthis Attachment) consistent with RG 1 .200, Revision 2 and the current endorsed standardASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix A.Internal Fire PRAA peer review of the PVNGS internal fire PRA was conducted in October 2012 (Reference 10 ofthis Attachment) consistent with RG 1.200, Revision 2, using the current endorsed standardASME/ANS RA-Sa-2009. Subsequently, a focused-scope peer review of the internal fire PRAwas conducted in December 2014 (Reference 11 of this Attachment) to address ASME PRAStandard SRs not-met to Capability Category II requirements and those SRs not-reviewed in theprior October 2012 internal fire PRA peer review.6-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times_________Table A6-1 Internal Events PRA Peer Review A and B Level Findings,Observation Sub- Level Status Finding(s) DispositionID element(s)SY-lO SY-20 A Closed Demand failures of batteries are not considered (i.e., if The finding has beenthere is a demand for [direct current] DC, battery failure resolved and closed byis more likely). Only charger failures, bus faults, circuit an update of the PRAbreaker failures, battery faults, maintenance and failure model.to restore after maintenance are modeled. Demand failure ofbatteries has beenadded to the model.DA-04 DA-8 A Closed The following common cause factors are significantly The finding has beenlower than Idaho National Engineering Environmental resolved and closed byLaboratory (IN EEL) recommended values: pumps an update of the PRAgamma and delta factors, [emergency diesel generator] model.EDG failure to start beta, and auxiliary feedwater] AFW The PRA model commonpumps failure to run beta generic pumps -beta. Note: cause factors have beenthese are based on generic sources; therefore there is a revised consistent withconcern that the values are significantly different from the NRC common causeI NEEL generic data. A sensitivity evaluation was database.performed which put these values to those similar toINEEL recommended values caused a ODE increase ofapproximately 7%.DE-07 DE-7 A Closed In general, human actions across systems appear to The finding has beentreat dependency appropriately. There are some cases resolved and closed bywhere dependencies across systems are not properly an update of the PRAaddressed. RE-AFA-LOCAL is used redundantly to model.1ALFW-2HRS-HR in sequences 7634, 14966, etc. [per The PRA model humanPRA Study, 13-NS-C29 Rev. 3, PRA Change action dependenciesDocumentation] per C-29 Rev. 3 across systems havebeen addressed.6-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable .A6-1 Internal Events PRA Peer Review A and B Level Findings __________Observation Sub- Level Status Finding(s) DispositionID element(s)QU-03 QU-18, QU-19 A Closed Currently, RE-AFA-LOCAL is being used to recover The finding has been1AFAP01-TPAFS. This is a hardware failure basic resolved and closed byevent. An evaluation should be done to determine the an update of the PRAfraction of the basic event that is recoverable. This model.appears in numerous sequences (e.g. 7830 & 14989 The PRA model recovery[per PRA Study 1 3-NS-C29 Rev.3] [per C-29 Rev.3]). action for the AFA pumphas been modified toappropriately considerthe fraction ofrecoverable events.QU-04 QU-1 8, QU-1 9 A Closed Currently, RE-AFA-LOCAL is inappropriately being used The finding has beento recover some [Stuck Open Safety Valve] SOSV resolved and closed byevents. The initial failure of the AFW Pump A causes a an update of the PRAprimary safety lift. The recovery of AFW Pump A would model.not prevent a lift. Therefore, RE-AFA-LOCAL should not The PRA model recoverybe used when the primary safety valves lift, has been removed fromstuck open safety valve__________ _____________________________________events.HR-04 HR-9 A Closed It was stated in the opening presentations that the The finding has beenoperators would take manual control of the AFW flow resolved and closed bypath globe valves. This action is not modeled. The an update of the PRAcurrent model appears not to include any action to model.control flow with the exception of local manual control. The PRA model nowcredits remote manualoperation of the AFW______f low path valves.SY-12 SY-18 A Closed Batteries C and 0 appear to have at least a 24-hour The finding has beenmission time prior to depletion. This results in resolved and closed byinstrumentation being available to adequately control an update of the PRAAFW. The bases for the 24-hour mission time are not documentation. Thedocumented. basis for the 24 hour________ _______________mission time is provided.6-4 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s)__________________________________HR-06 HR-20 A Closed The cycling of the AFW flow path globe and gate valves The finding has beento maintain AFW flow is not modeled. resolved and closed byan update of the PRAmodel.The PRA model nowincludes cycling of the_________ ______________________________________AFW flow path valves.IE-7 IE-12 B Closed The Interfacing Systems Loss of Coolant Accident The finding has been(ISLOCA) treatment for the shutdown cooling suction resolved and closed byline appears to have some questionable assumptions. an update of the PRAFirst, it is assumed that the Low Temperature Over model which nowPressure (LTOP) valve would always open. While this is includes failure of thethe most likely scenario, the LTOP valve can fail to LTOP valve to open andopen. Qualitative arguments were made that should this includes the shutdownhappen, the resulting LOCA would be inside cooling warm upcontainment (primarily based on relative pipe lengths). crossover piping.This ignores the fact that the high stress points andstress concentration points are outside containment.Furthermore, the shutdown cooling warmup crossoverpiping was not considered.IE-8 IE-5 B Closed Loss of multiple vital 125 VDC and loss of multiple vital The finding has been120 VAC buses are not considered as initiators, resolved and closed byan update of the PRAmodel which nowincludes loss of multiplevital 125 VDC and 120VAC buses as initiators.6-5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s) ___AS-02 AS-04 B Closed A discussion of Reactor Vessel Rupture was not found. The finding has beenAn internal fire PRA was not performed so accident resolved and closed bysequences were not generated to capture the impact of an update of the PRAa fire. Also there does not appear to be coding of model which nowlocations for basic events. (FIVE methodology was used includes reactor vesselto assess fire impact). Internal flooding is also not rupture event. Separatespecifically included in the accident sequences and no internal fire and internalspatial data appears to have been developed (same flood models havecould be used for fire and flooding). Industry Degraded subsequently beenCore Rulemaking (IDCORE) methodology was used to created to address theperform flooding evaluation and this determined that remainder of the finding.there are no critical flooding areas.AS-5 AS-24 B Closed The Modular Accident Analysis Program (MAAP) The finding has beenanalyses used to support timing for human actions look resolved and closed byonly at a selected set of parameters of interest and an update of the PRAneglect to look at the status of other systems which may model. Additional MAAPaffect timing and/or success criteria. One particular analyses have beenexample is that the Turbine Bypass System is assumed performed andto "always work" when evaluating the time available for associated humanrecovery of AFW. reliability actions addedto the PRA model toaddress the status ofother systems which_________ ________________ ______ ______________________________m__act__eimpattevntmtming6-6 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times_________Table A6-1 Internal Events PRA Peer Review A and B Level Findings __________Observation Sub- Level Status Finding(s) DispositionID elemnent(s)SY-02 SY-1 B Closed There is no document that specifies the content, The finding has beenrequirements, and formatting for each system study. resolved and closed byThis would aid external observers and newcomers in an update of the PRAunderstanding the intent of the system analysis documentation. The PRAdocumentation. model system studieshave been abandonedand replaced with morespecific documentationof how systems aremodeled in the PRA.SY-03 SY-3 B Open, but Many of the assumptions contained in the AFW analysis The specific issue ofwill be address plant phenomena, but contain no plant AFW diversion flowclosed by references. For example, AF024, states no significant paths has beenmeeting diversion paths were identified. But no detailed addressed andASME discussion is provided. There are several piping taps documented. However,iPRA Std from the condensate storage tank (CST). From a the more general issueSR SY- walkdown some of these taps occur high in the tank, of references for systemC1 while others associated with the condensate transfer analysis modeling is apumps are low in the tank. It is not clear that potential subset of meeting thediversions through the condensate transfer pumps have requirements of ASMEbeen examined. The drawings that illustrate the flow SR SY-C1, which isdestination for the pumps are not referenced in the AFW listed as "Open" in Tablesystem study: DGP-001, ECP-001, and EWP-001. It A6-2.also appears that the assumptions themselves are notindependently reviewed. As a result, the independent See Table A6-2 item SRreviews of the system studies are not complete. Each SY-C1 for disposition ofindividual assumption should have plant documentation the more general issueand an independent review. The system study associated with thisindependent review would then only need to ensure that finding.the assumption is applicable to and reflects the modelitself. This appears to be what is done now, but withoutan independent review of the assumptions.6-7 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s) __________SY-05 SY-4 B Open, but It is difficult to verify that the systems are in agreement This issue is part ofwill be with the as-built conditions. The current software is only ASME SR SY-C1, whichclosed by capable of displaying a two by three portion of the fault is listed as "Open" inmeeting tree. When attempting to verify the AFW system, only a Table A6-2. See TableASME sample of the fault tree was examined. From the portion A6-2 item SR SY-C1 forPRA Std examined no discrepancies were identified. There were disposition of this finding.SR SY- no direct references between the fault tree supports andC1 the plant drawings. For example the power supplies tothe motor driven pumps are contained in the fault tree,but a plant drawing reference is not directly linked to thisdependency. The back of the system study does providei a list of references, but the specific references are notlinked to dependencies. Not only does this make reviewby outside personnel difficult, it makes internalindependent reviews difficult as well.IDA-01 DA-4 B Closed In quantifying the failure rate of the turbine driven AFWV The finding has beenSpump to start and run, failures were not considered resolved and closed bybased on modifications to prevent turbine overspeed an update of the PRAtrips due to excessive condensation in steam lines. That documentation.is, failures that occurred prior to 1995 (that were Sufficient plant operatingdetermined to be due to excessive condensation), were experience has elapsedremoved from consideration. A reduction in the impact of since this finding wasthese failures would be more appropriate than provided to substantiateeliminating these failures from consideration. exclusion of condensateline overspeed eventsfrom the failure rate ofthe AFA pump. Thisevidence wasdocumented as part ofthe data update.6-8 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s)DA-02 DA-06 B Closed Currently for demanded components, the failure The finding has beenlikelihood is assumed directly related to the surveillance resolved and closed byinterval. The equation used is 1 -exp(- an update of the PRAlambda*(interval)/2). This assumption is predicted on the documentation. Thisassumption that the likelihood of failure on demand is issue has been resolvedpurely proportional to the hourly failure likelihood. This is by providing thenot necessarily true. Analysis should be done to ensure requested evidence inthat the demand failure likelihoods are appropriately the PRA documentation.calculated. There are components of the demand failurerate that are not proportional to time such as shock andhuman errors.DA-9 DA-9 B Closed When grouping components together for data, are The finding has beencomponent specific data differences reviewed. (i.e. are a resolved and closed bydisproportionate number of failures attributed to one an update of the PRAcomponent but spread out over several)? Also are the documentation. Thisnumbers of demands/run hrs comparable? issue has been resolvedby consideringcomponent specificdifferences in thegrouping of components.DA-07 DA-1 3 B Closed The NSAC document referenced in evaluating the loss The finding has beenof offsite power (LOSP) frequency and duration (NSAC- resolved and closed by203, "Losses of Offsite Power at U.S. Nuclear Power an update of the PRAPlants thru 1993") is not current. More recent NSAC and model andEPRI documents are available as a reference source. documentation.These documents have the potential to increase the Subsequent updates oflikelihood of offsite power recovery since LOP events the PRA model haveand their duration have trended downward. used the current EPRIloss of offsite power_________ _________ _____ ___________________________________________data.6-9 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times________Table A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s)DA-08 General B Closed Plant specific data was derived from a limited number of The finding has beenyears data (1994 thru 1996) resolved and closed byan update of the PRAmodel anddocumentation. Plantspecific data hassubsequently beenupdated up to 2013.HR-01 HR-i, HR-i14 B Closed Guidance effectively describes the quantification The finding has beenprocess. Two areas were identified for possible resolved and closed byimprovements: 1. The process and degree of operation an update of the PRAinput and review is not documented. Operation input as documentation. Thisdescribed appears to be marginal. It was stated that issue has beenoperator input was always obtained for knowledge addressed by upgradingbased actions and was obtained as required for the human reliabilitycomplete skill and rule-based actions. A better practice analysis documentationwould be to have all actions developed with operator to address the issues.input. 2. The process for selecting Human Reliability The HFEs have beenAnalyses (HRAs) was not described. A process is placed into the EPRIidentified in Systematic Human Action Reliability HRA calculator, whichProcedure (SHARP). It appears that the SHARP process provides a consistentwas not used. However, an undocumented, iterate and detailedprocess between the system analyst and the human documentation of the_____action analyst appears to be adequate. HRAs.6-10 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s) _______________________IHR-08 HR-25 B Closed A sensitivity study to determine human action The finding has beendependencies was not performed nor documented with resolved and closed bythe PRA results. This is considered to be a good an update of the PRApractice to ensure dependent human actions are not documentation. Theinappropriately used. A sensitivity analysis was requested sensitivityperformed during this review. No issues were noted. analysis was performedand documented onhuman actiondependencies.6-11 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- [Level [Status TFinding(s) 1 DispositionID element(s)___IHR-09HR-20BClosedHuman Action (HA) 1AFN-MSIS-....HR is failure of theoperator to override [main steam isolation signal] MSIS andalign the N pump. This action includes diagnosis error. Theaction 1AFN-MSIS-ND-HR, is a modification factor toremove the diagnosis component of 1AFN-MSIS-....HR. Inthe quantification of these two elements [PRA Study 13-NS-B62, Human Reliability Analysis] (1 3-NS-B62, p90 and91 ) it is stated that 1AFN-MSIS-ND-HR is to be used with1AFN-MSIS-....HR when it occurs in conjunction with failureto align or utilize the code pumps, i.e., in conjunction withanother human action (HA) that had an equivalentdiagnosis element. This is considered appropriate.However, as seen in cutset 10 and others, these two HAsare being used together in cutsets which do not includeanother HA with the equivalent diagnosis element. This isinappropriate. In cutset 10, the initiator is loss of 125 VDCPKB-M42 which results in loss of one AFW pump, anMSIS, failure of the downcomer valves, failure of theturbine-driven AFW pump and the 1AFN-MSIS ....HR/i1AFN-MSIS-ND-HR combination. This does not appearto be appropriate because there is no other HA whichincludes the requisite diagnosis error. This is contrary tothe stated application conditions in 13-NS-B62. The abovediscussion also applies for the 1AFW-MFW-...HR/1 AFW-MFW-ND-HR combination and any other equivalentcombinations. After looking at models in more detail, foundthat there was another Human Action in the chain. Directsolution of the trees would yield a cutset with two [HumanError Probabilities] HEPs. A recovery analysis patternremoved the two related Human actions and replaced themwith the pairings discussed above. The concept appears tobe appropriate but the manner in which it is applied isconfusing at least in this case.The finding has beenresolved and closed by anupdate of the PRAdocumentation. Thesubject human reliabilityanalysis and associateddocumentation foroverride of theMSIS and aligning the Npump has been revised toaccount for this issue.6-12 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level Findings _________Observation~ Sub- ILevel IStatus [Finding(s) [DispositionID J element(s) _ _ I_ _ _ _ _ _ _ __ _ __ _ _ _DE-02DE-l, DE-3,DE-5BClosedAs mentioned earlier there is no guidance for the systemanalysis process. This applies to the dependency aspectof the process as well. Section 3.3 of a system studylists the dependencies associated with the system. Ingeneral, the table appears to completely describe thedependencies associated with the system. I did noticeseveral cases in the high pressure safety injection(HPSl) system study where the component numberswere not identified: 1PHAM37-480-1 PW/GHLIA1-2,1 PHBM38-480-1 PW/GHI2-9, 1 SAARAS-TRA--1AT/GRASA-K405 [MOV 674], etc. In some cases, itwas possible to determine the component dependency.In other cases, it was not. Each component and itsassociated dependency should be explicitly identified.The dependencies associated with hot leg injectionappear to be improperly identified. MOV-321 should be4PKCM43-125--1PW and MOV-331 should be4PKDM44-125--1 PW. The plant references for thedependencies are not directly linked to uniquecomponent dependencies. Instead, the references arelisted in a single large mass in Appendix D. It wouldprobably save time and lead to better traceability if thereferences are directly associated with eachdependency. There are no plant references associatedwith the [heating, ventilation and air conditioning] HVACdependencies dedicated to the HPSI system. Thisapplies to 1 EWAECOOLWA--10OP, 1 EWBECOOLWB--10OP, 1 PHBM38-480-1 PW, 1 SPAESPA---10OP, etc. Theplant references could be a simple as [Updated FinalSafety Analysis Report] UFSAR text if direct failure isassumed to be as complicated as design heat-upcalculations.The finding has beenresolved and closed byan update of the PRAdocumentation.References fordependencies andHVAC success criteriahave been added to thePRA documentation.6-13 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B3 Level FindingsObservation I Sub-i Level IStatus [Finding(s) I DispositionID element(s) ___ _______________________ __ ______DE-05DE-4BClosedAlthough dependencies are identified in the systemanalysis, there is no dependency matrix. A dependencymatrix is a valuable tool for reviewers and newcomers tothe group. I believe that our evaluation of AccidentSequences would have been much morecomprehensive with a dependency matrix. There are noplant references associated with the HVACdependencies dedicated to the HPSl system. Thisapplies to 1 EWAECOOLWA--10OP, 1 EWBECOOLWB--lOP, 1PHBM38-480-1PW, 1SPAESPA---1OP, etc. Theplant references could be a simple as UFSAR text ifdirect failure is assumed to as complicated as designheat-up calculations.The finding has beenresolved and closed byan update of the PRAdocumentation. Adependency matrix hasbeen added to the PRAdocumentation.BClosedSince the general rule is documented as one-recoveryaction per sequence [13-NS-B62] (B-062), exceptionsshould be noted and justified. For example, the GTrecovery and the AFW PP A recovery actions arecredited redundantly. This is probably appropriate, butthe paragraph in B-062 indicates this is not typicallydone. Therefore justifying the exceptions is probablyappropriate.The finding has beenresolved and closed byan update of the PRAdocumentation.Exceptions to therecovery actions werejustified.-f f I,BOpen, butwill beclosed bymeetingASMEPRA StdSR SY-C1The documentation is considered marginal largely basedon the lack of traceability of the system studies to plantdocumentation for each component dependency.This issue is part ofASME SR SY-C1, whichis listed as "Open" inTable A6-2. See TableA6-2 item SR SY-Ci fordisposition of this finding.6-14 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level Findings __________Observation Sub- Level Status Finding(s) DispositionID element(s) __________QU-01 QU-1 B Closed The quantification report describes the quantification, but The finding has beenthe process is difficult to follow unless knowledgeable resolved and closed byabout the code used and the specific steps to follow. It is an update of the PRAsometimes hard to determine the basis for the delete documentation.term logic and the recovery patterns.QU-05 QU-1 8, QU-1 9 B Closed It would probably be a good idea to delete the front *s in The finding has beenthe recover search equations. I did not find any resolved and closed byinstances where this caused a problem in the existing an update of the PRAmodel, but it could be causing problems by accidentally model recoveryselecting the middle of a basic event verses the instructions.beginning.QU-07 QU-25, QU-26, B Closed Even though the data bases contain error factors and This issue has beenQU-28 their code has the capability to easily perform numerical addressed by performinguncertainty analyses, APS did not perform any and documenting theuncertainty analyses for this update of the Probabilistic quantitative uncertaintySafety Assessment (PSA) and they did not document analysis.any sensitivity studies on the impact of key assumptions__________ ~~~as part of this PSA update. __________MU-03 iMU-4 B Closed The types of changes tracked by the PRA and how this The finding has beeninformation is obtained are not specified in enough detail resolved and closed bywithin the procedure. an update of the PRA________ __________ _____model update procedure.MU-08 MU-li, MU-12 B Closed There is limited guidance on what needs to be The finding has beenconsidered for reevaluation when a significant change to resolved and closed bythe PRA models takes place. an update of the PRA_________model update procedure.6-15 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s)HR-03 HR-4, HR-5, B Closed In the HRA document (862), Section 4.2, concludes that The finding has beenHR-6, HR-7 miscalibration and common cause miscalibration of resolved and closed bycritical sensors is negligible at PVNGS. This is not an update of the PRAconsistent with the results from other PRAs. Specifically, model common causethe first supporting paragraph of dedicated teams does modeling to match thenot minimize exposure to common cause, it actually NRC common causemaximizes common cause. PVNGS's staff previously database treatment.identified this item.AS-03 AS-6, AS-7, B. Closed There are some differences between treatment of a The finding has beenAS-8, AS-24 small LOCA associated with a pipe break and an resolved and closed byinduced small LOCA (pressurizer safety valve reclosure) an update of the PRAin the transient event trees. For example: model and*In the small LOCA event tree, successful high pressure documentation.injection and recirculation lead to questioning whethercontainment heat removal is successful. In the TransientType 2 and Transient Type 3 event trees, RCS integritycan be lost if pressurizer safety valves do not reset afterlifting. In the sequences from these event trees wherehigh pressure injection and recirculation are successful,the question relating to containment heat removal is notasked.* In the small LOCA event tree, RCS depressurizationand use of low pressure injection and recirculation areconsidered if high pressure injection or recirculation fails.In the Transient Type 2 and Transient Type 3 eventtrees, consideration of RCS depressurization and use oflow pressure systems is not included because thelikelihood of high pressure injection or high pressurerecirculation are small. It would seem that this_________ _______________ ______assumption should apply to both cases, or not.6-16 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-1 Internal Events PRA Peer Review A and B Level FindingsObservation Sub- Level Status Finding(s) DispositionID element(s)__________________________________SY-13 SY-17, SY-20 B Closed The control system study states that only single failures The finding has beenthat cause the failure mode of interest are considered. resolved and closed byFor the Auxiliary Feed Actuation System (AFAS) an update of the PRAgenerated signals, which results [these result] in model andmodeling common cause only. Although this approach documentation to addmay provide a good estimate of the failure rate of these the indicated controlsafety signals, it does not necessarily provide the system dependencies.confidence that the signals are appropriately modeled.For AFAS, it appears that since the AFW flow pathvalves must cycle that control system dependenciesmay have been missed. That is, normally engineeredsafety features actuation system] (ESFAS) relaysappeared to be locked-out following actuation, but forthe AFAS valves, the relays need to react to the processsystem steam generator (S/G) low and high level. It islikely that 120 VAC Vital Bus A and B are needed.6-17 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-2 Internal Events PRA Self-Assessment of ASME SRs Not Met to Capability Category IISR Status Self-Assessment Comments Disposition3Y-C1 Open System analysis documentation developed during the This SR will be fully met by updating the system analysisIndividual Plant Examination (IPE) was abandoned documents per the requirements of SR SY-C1 prior to useprior to issuance of the ASME PRA. Key elements of of the RIOT Program.the system analysis documentation have beensubsequently captured in other PRA documentationthat is not designated as system analysisdocumentation.SY-C2 Open the following subsections of SR SY-C2 are not met: ,s indicated, most elements of this SR are addressed inic, e, j, o, p. The original system analysis PRA model documentation. However, there is no singledocumentation developed during the IPE PRA document which captures all of the elements and includesdevelopment was abandoned prior to the issuance of the not met subsections of SR SY-C2.!the ASME PRA Standard. Other subsections of SRSY-C2 (a, b, d, f, g, h, i, k, I, m, n, q, r, s) are met by This SR will be fully met by updating the system analysisalternate documentation generated when the system documents per the requirements of SR SY-C2 prior to useanalysis documentation was abandoned. of the RIOT Program.6-18 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionIFSO- Closed As noted in SRs IFSO-A1, IFSO-A3, and lFSO-A5, some areas This finding has been resolved by aB2 of the documentation do not provide sufficient detail about the documentation update. The following PRAprocess used. Specific items for which improved documentation studies have been revised to provide detailis needed include: about the specific items needed fora. Documentation of sources in the Turbine Building. improvement:b. The basis for screening sources in the Fuel, Radwaste, andTurbine Buildings (i.e., the way in which the specified criteria a. PRA Study 13-NS-C094 section 4.2.6 wasare met for each source is not documented). For example, a revised to include the flooding sources in thewalkdown during the peer review revealed that there is Turbine Building.section of the wet pipe fire protection (FP) system running b. Revised PRA Study 13-NS-C094 sectionsabove the turbine cooling water (TO) pumps that could 4.2.5 and 4.2.6 to include justification forpotentially spray both pumps. It is not clear based on 1 3-NS- screening sources in the Fuel, Radwaste, and0093 and 1 3-NS-C094 that this impact was considered and Turbine Building.dispositioned. Likewise, feedline breaks in the turbine c. The temperatures and pressures of the plantbuilding are assumed to be bounded by the loss of main fluid systems do not need to be defined as allfeedwater initiating event, but may have different impacts flooding impacts are inherently consideredsuch as loss of instrument air due to humidity impacts. due to the Assumption 2 in PRA Study 13-c. The temperature and pressure of flood sources. NS-C096 which identifies that all equipmentin the flood area in which a flood initiates, isassumed failed. Therefore it is not necessaryto describe systems in terms of pressure andtemperature to determine potential floodinduced failure modes.IFEV- Closed Potential flooding mechanisms are primarily limited to failures of This finding has been resolved by aA7 components. Human-induced flooding is screened based on documentation update. PRA Study 13-NS-C097plant maintenance practices (see 13 NS-C093, Section 3.2, Section 4.1 was revised to document the reviewItem 4 and 13-NS-C097, Section 3.5). This does not indicate of human and maintenance induced floodingthat there was any search of plant operating experience and events. A review of PVNGS maintenanceplant maintenance procedures to verify no potential for human- guidance documentation and procedures viainduced flood mechanisms. plant personnel discussions did not identify anymaintenance procedures which would lead to aninternal flooding scenario.6-19 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionIE-C5 Closed Generic pipe failure frequencies from EPRI TR-1 0131 41 were This finding has been resolved by anot converted to a per reactor-year basis as required by SR IE- documentation update. PVNGS has revised the05. quantification studies tO clarify that the resultsare specifically in units of "per critical-reactoryear" that is directly applicable to At-Poweroperating plant states. In addition, to supportPRA applications that relate to risk in terms ofannualized risk, the engineering studiesdocumenting the quantification and results wererevised to also provide converted core damagefrequency (ODE) and large early releasefrequency (LERF) in units of "per reactor-year"_____ _____ _______________________________________[per calendar-year].IFQU- Closed Sources of model uncertainty and related assumptions for the This finding has been resolved by aA7 Internal Flooding (IF) quantification are documented in 13-NS- documentation update. PRA Study 13-NS-C0990099, Section 3.1.3. As noted in other SRs related to Section 4.4 was revised to incorporate theassumptions and sources of uncertainty, there is no characterization of model uncertainty sources.characterization of the impact of these assumptions and Each assumption and source of modelsources of uncertainty on the IF model as would be required by uncertainty has been characterized according tobackward reference to SRs QU-E4 and QU-F4 in SR IFQU-A7. the draft Pressurized Water Reactor Owners_____Group (PWROG) PA-RMSC-0594.6-20 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionIFSN- Closed Based on the decision trees in the Scenario document 13-NS- This finding has been resolved by aA16 096 Revision 0, (example Figure 4.2.1.1-1, Sequence documentation update. PRA Study 13-NS-C096040A1 S02), many flood sources that can be isolated have been section 3.1 .1 was revised to describe the reasonscreened out based a simple assertion that the flood can be for screening out successfully isolated floods.isolated without documenting any of the following:a. Whether flood indication is available in the control room,b. How and where the flood source can be isolated, andc. Whether procedures exist for isolation and how much time isavailable for isolation.Based on a discussion with the plant PRA personnel, the peerreview team judged the screening to be reasonable, butdocumentation is not adequate. The review team judged this tobe met at [Cat] C I, but even for this, proper documentation is______ ~needed as noted in the finding. ____________________IFSN- Closed RG 1.200 Revision 2 documents a qualified acceptance of this This finding has been resolved by aA6 SR. The NRC resolution states that to meet Capability Category Idocumentation update. Assumption 2 in PRAII, the impacts of flood-induced mechanisms that are not study 13-NS-C096 was rewritten to clarify thatformally addressed (e.g., using the mechanisms listed under all components within a flood area where theCapability Category Ill of this requirement) must be qualitatively flood originates were assumed susceptible andassessed using conservative assumptions. failed as a result of the flood, spray, steam, jetimpingement, pipe whip, humidity, condensationand temperature concerns except whencomponent design (e.g., water-proofing), spatialeffects, low pressure source potential or otherreasonable judgment could be used for limiting_____________the effect.6-21 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionI FEV- Closed There is no evidence in 13-NS-C097 that a search was made This finding has been resolved by aA6 for plant-specific operating experience, plant design features, documentation update. PRA Study13-NS-C097and conditions that may impact flood likelihood and no Section 4.1 was revised to add evidence of theBayesian updating was performed. However, adjustments are search for plant specific operating experience.made to some initiating event frequencies based on system run The PVNGS Site Work Management Systemtimes to account for differences between impacts when the database and License Event Reports werepumps are running or in standby. searched for flood type events. Additionally, thePVNGS maintenance procedures werereviewed for flood prevention guidelines.It was determined that none of the flood eventsidentified represented a credible internalflooding scenario which would require additionalmodeling efforts. Additionally, the lack ofinternal flooding events does not providesufficient information to perform a Bayesianupdate to the initiating event data, andtherefore, no update was performed.6-22 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSHA-E1 Closed Insufficient site-specific velocity profile documentation exists to This issue was resolved and reflected in thereview the base case profile and possible uncertainties in the PRA model and documentation. New sitesite shear-wave velocity profile. Because the site fundamental specific data was subsequently collected as partsoil resonance may be near 1 second, a period that may be of the NTTF 2.1 analysis.near a critical structural resonance, documentation of theepistemic uncertainty and aleatory variability of the site velocityprofile should be developed.SHA-E2 Closed The evaluation and incorporation of uncertainties in the site A SSHAC L3 analysis was performedresponse velocity profile may not be properly incorporated subsequent to the seismic PRA development asbecause of insufficient or unreviewable site-specific data and/or part of the NTTF response to the NRC 50.54fits documentation. Also, the site response evaluation was letter on Fukushima. The SSHAC L3 analysiscompleted using a Senior Seismic Hazard Analysis Committee produced a site hazard curve which is bounded(SSHAC) Level 1 (Li) process which does not meet the ASME by the SSHAC Li hazard curve developed andgeneral Capability Category II guidelines, used in the Seismic PRA model. Therefore, theissue is resolved by the updated SSHAC L3hazard analysis.SFR-A1 Closed Some of the dispositioning in the complete seismic equipment This issue was resolved and reflected in thelist (SEL) does not have adequate documentation to justify PRA model and documentation. Contractorscreening of selected components. For example, component performed walkdown and screening evaluation1 ENANS01 (13.8 kV Non-Class 1 E Switchgear 1 ENANS01) is to compare the estimated seismic capacities ofdispositioned (screened) by the statement "Seismically induced selected Non-Safety Related equipment to thefailure of NA system (non-seismic class) assumed addressed capacity assigned to loss of offsite powerthrough seismic LOSP." The median fragility of seismic LOSP is (LOSP).0.3 g. For this screening to be viable, APS should demonstratethat the median fragility of 1 ENANS01 is significantly higher Re-quantification was performed to reflectthan 0.3 g. However, these are non-Class 1 E electrical updated hazard, updated fragility informationcomponents. This type of screening argument is used many and updated S-PRA modeling following thetimes within the complete SEL presented in Appendix B of CN- resolution of Findings and Observations from____RAM-i12-015. the industry peer review.6-23 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSFR-C6 Closed The CDF is dominated by peak ground acceleration (PGA) in This issue was resolved and reflected in thethe range of about 0.3 g. Therefore, the effect of using input PRA model and documentation. Contractormotion at the 0.3g PGA level should be examined. Contrary to performed evaluation of increased uncertaintythe self-assessment, the soil data is not sufficient to justify a Cv for soil properties.= 0.5. The effect of using Cv = 1.0 should be examined.Re-quantification was performed to reflectupdated hazard, updated fragility informationand updated S-PRA modeling following theresolution of Findings and Observations fromthe industry peer review.SFR-F2 Closed The top seven cutsets involve seismic failure events. (SF- This issue was resolved and reflected in theTBBLD, SF-SOIL, and SF-ME) that are potentially conservative PRA model and documentation. Contractorwith respect to seismic fragility and may be resulting in a performed seismic fragility investigation forseismic CDF that is not accurately reflecting the true plant PVNGS Unit 1 Main Feedwater (FW) system.response to seismic events. More analysis is required to eitherjustify the seismic fragilities presented or to refine those values. Re-quantification was performed to reflectupdated hazard, updated fragility informationEvent SF-TBBLD represents structural failure of the turbine and updated S-PRA modeling following thebuilding, resulting in collapse onto the underground pipe tunnel resolution of Findings and Observations fromfrom the CST. The concrete cover over the pipe tunnel is the industry peer review.postulated to fail, resulting in failure of the AFVW piping from theCST to the AFW pumps. There is the potential that the turbinebuilding failure might not fail the pipe tunnel.Event SF-ME involves seismic failure of main feedwater pipingoutside of containment (balance of plant). The fragility of thispiping is based on a "generic" evaluation of SC-Il componentsand is given a median acceleration of 0.21 g.6-24 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSFR-F3 Closed The draft report LTR-RAM-II-12-074 indicates that the draft This issue was resolved and reflected in therelay assessment uses the IPEEE relay assessment as the PRA model and documentation. LTR-RAM-starting point but accounts for the updated seismic hazard curve 11-12-074, Revision 2 incorporated the 69at the site. However, the report includes the following statement previously unaddressed relays.in Section 2.3 (Unaddressed Relays):Re-quantification was performed to reflect"This list [unaddressed relays] included 69 such relays. Of the updated hazard, updated fragility informationrelays that have been included in the SPRA, their seismic and updated S-PRA modeling following thefragility events are found in many of the dominant ODE cutsets", resolution of Findings and Observations fromthe industry peer review.6-25 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSPR-B1 Closed CN-RAM-12-015, Rev. 0, Palo Verde SPRA Model The first part of this finding is consideredDevelopment, identifies the followring for the Self-Assessment resolved based on conducting a RG 1.200 self-for SPR-B1 : "The S-PRA relies on an internal events model that assessment of the internal events PRA modelis assumed to be compliant with CCII of the PRA described elsewhere in this Enclosure andStandard." subsequent peer reviews of the internal floodand internal Fire PRA models which are basedIt is understood that the PVNGS PRA model received an on the internal events PRA model.industry PRA peer review in 1995 per the CEOG guidelineswhen the PRA model existed in the Risk Spectrum software The second part of this finding is consideredenvironment. The current PVNGS PRA model has since been resolved by CN-RAM-12-024 Revision 1 thatconverted to the CAFTA software environment. APS has since updated the seismic HEPs based on timing andperformed a self-assessment of the PVNGS FPIE PRA model closed all open items from Revision 0.against the ASME/ANS Standard, but a number of SRs do notmeet Capability Category I1. Re-quantification was performed to reflectupdated hazard, updated fragility informationFurthermore, as discussed in Section 4.2 of CN-RAM-12-024, and updated S-PRA modeling following thethere are five (5) open items from the FPIE HRA. Open Item #5 resolution of Findings and Observations fromaddresses that many values of T1/2 were not provided in the the industry peer review.HRA Calculator, which indicates that the time required toperform the actions may not be accurate (FPIE SR HR-G5).In addition, Section 4.3.1.4 identifies that PVNGS only uses theCause-Based Decision Tree Method, which is known tounderestimate the impact of time constrained HEPs and as aresult, current expectation for meeting supporting requirementHR-G3 is to use a combination of CBDTM and HCR methods toensure that timing is accurately reflected.6-26 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSPR-B6 Closed The review team could find no evidence that operator actions This issue was resolved and reflected in thefollowing relay chatter events were reviewed to ensure task PRA model and documentation. LTR-RAM-does not change (e.g., additional execution steps to reset relay) 11-12-074, Revision 2 performed aif action is in response to relay chatter-induced failure. comprehensive relay assessment to addressthis finding.Re-quantification was performed to reflectupdated hazard, updated fragility informationand updated S-PRA modeling following theresolution of Findings and Observations fromthe industry peer review.SPR-B7 Closed Complementary success logic is added in the SPRA logic on a This finding is considered resolved based onsequence basis for the SIET via the SHIP software, but not for meeting Addendum B of the ASME PRA Std,each basic event that represents a seismically-induced failure. which changed the requirement for thisThis is a limitation of the PRA technology and software which supporting requirement.was also noted in the Surry report. As such, this SR is assessedas Not Met.However, SR SPR-B7 has been modified in the proposedrevision of the PRA Standard (i.e., Addendum B). At themoment this calculation note's publication CC I/Il of theequivalent SR in Addendum B (SPR-B5) reads as follows: "Inthe systems-analysis models, for each basic event thatrepresents a significant seismically-caused failure, INCLUDEthe complementary "success" state where applicable to aparticular SSC, and DEFINE the criterion used for the term"significant" in this activity". Based on the wording of the newversion, success logic addressing significant seismically causedfailures are included in the model. With reference to the newwording of SR SPR-B5, this SR could be assessed as met at____________CCI/II. _______________6-27 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionSPR-B10 Closed Row SPR-B10 in Table 4.5-2 of CN-RAM-12-015 (i.e., the CN-RAM-12-015 Revision 1 addressed thissummary table of the SPRA self-assessment) identifies the finding.need to examine the effect of including a seismically-induced"small-small" LOCA. The self-assessment identifies that Section Re-quantification was performed to reflect5.1.3.9 discusses modeling a concurrent "small" LOCA. updated hazard, updated fragility informationand updated S-PRA modeling following theSection 5.1.3.9 identifies that a seismic-induced Small LOCA resolution of Findings and Observations fromprobabilistically models a seismic-induced LOSP. It is assumed the industry peer review.that this scenario would also address the scenario for aSeismic-induced LOSP with a potential for a "small small"_____ _____LOCA. ________________6-28 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to Capability Category IISR Status Finding(s) DispositionFSS-D2 Closed Generic HGL calculations were performed using OFAST This finding has been resolved by PRA modeland documented in Hughes report 0001-0014-002-002, and documentation changes.Rev 1. The CEAST HGL results have not been applied in amanner consistent with the limitations and assumptions Generic CFAST evaluations were revised to bedescribed in the report, specific to account for the limitations andassumptions of the area being modeled.EQ-El Closed Several Human Failure Events (HFEs) were discovered to This finding has been resolved by PRA modelhave a failure probability set to zero during the and documentation changes.quantification instead of the documented screening valueof 1.0 developed during the HRA task. Having the HEPs HFEs documented to have a screening value ofset to zero potentially impacts the quantification results and 1 .0 have been revised in the model to use thisthe ability to identify significant contributors to CDF, such screening value. All HEE tools were reviewed,as initiating events, accident sequences, equipment updated to be consistent with the HRAfailures, common cause failures, and operator errors. Calculator source database, and validated.There is no documentation that shows that a review of the A review of component and basic eventimportance of components and basic events to determine importance to ensure they make logical sensethat they make logical sense was performed. was subsequently conducted and documented.There is no documentation that a review of nonsignificant Conduct of cutset reviews was added to thecutsets or sequences was performed. PRA documentation.6-29 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to Capability Category IISR Status JFinding(s) IDispositionUNC-A1ClosedThe following statement was made after several sensitivityresults tables: "Because of the way the cutsets werecreated, the numbers are not correct. The exercise here isto show the ratios." This negates any of the resultsreported in the results table.The uncertainty analysis, for the most part, does notinclude any review of the uncertainty results. Therefore,how the PRA model was affected and a check for thereasonableness was not documented. Therefore it is notclear that a check for reasonableness was performed.There is a statement in the Uncertainty Analysis notebookthat this analysis was not performed for LERE. Uponreview of the notebook it was found that for someuncertainty analyses were run for both ODE and LERF. Areview of the uncertainty analysis should be performed andall uncertainty analysis should be performed for ODE andLERF.Many instances were found where assumptions were foundin notebooks that were not documented in the assumptionsection. This could lead to missing an area that needs tobe addressed in the uncertainty analysis. (Reviewdocuments and verify that where the word "assumes" isused that an actual assumption is being made.)This finding has been resolved by PRA modeland documentation changes.The sensitivity results were reviewed anddocumented to show ratios of results.Documentation has been updated to includehow the PRA model is affected by modeluncertainty and related assumptions.Sources of LERF uncertainty and assumptionshave been identified and documented.All assumptions used in the development of thePRA model have been reviewed anddocumented. Instances of modelingsimplification or conservatism were so notedversus declared as default assumptions.Assumptions with the potential to significantlyimpact results were addressed in theUncertainty and Sensitivity analyses6-30 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesReferences1. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed TechnicalSpecifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute,Revision 0, dated November 2006 (ADAMS No. ML12286A322)2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy ofProbabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 20093. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(Agencywide Documents Access and Management System (ADAMS) Accession No.,ML071 200238) dated May 17, 20074. ASME/ANS RA-Sa-2009, Standard for Levell/Large Early Release Frequency ProbabilisticRisk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME,New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 20095. NRC Letter Palo Verde Nuclear Generating Station, Units 1,2, And 3 Issuance ofAmendments Re: Adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies toLicensee Control RITSTF Initiative 5b" (ADAMS Accession No., ML1 12620293), datedDecember 15, 20116. Palo Verde Engineering Evaluation 3579223 Revision 1, dated April 10, 20117. ABB Combustion Engineering Owners Group Final Report, Palo Verde Nuclear GeneratingStation Units 1, 2, and 3 Probabilistic Safety Assessment Peer Review Report, datedNovember 19998. Westinghouse Letter LTR-RAM-II-10-082, Focused Scope RG 1.200 PRA Peer ReviewAgainst the ASME/ANS PRA Standard Requirements for the Palo Verde NuclearGenerating Station Probabilistic Risk Assessment, dated November 5, 20109. Westinghouse Letter LTR-RAM-II-13-005, Peer Review of the Palo Verde NuclearGenerating Station Seismic Probabilistic Risk Assessment Against the Seismic PRAStandard Supporting Requirements of the ASME/ANS Standard for Level 1/Large EarlyRelease Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,dated February 13, 201310. Westinghouse Letter LTR-RAM-1 2-13, Fire PRA Peer Review Against the Fire PRAStandard Supporting Requirements from Section 4 of the ASME/ANS PRA Standard for thePalo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment, dated January 2,201311. Hughes Associates Report 00101 4-RPT-01, Palo Verde Nuclear Generating Station FirePRA Focused-Scope Peer Review Report, Revision 0, dated January 22, 20156-31 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 7Information Supporting Technical Adequacy of PRAModels without PRA Standards Endorsed byRegulatory Guide 1.200, Revision 2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesInformation Supporting Technical Adequacy of PRAModels without PRA Standards Endorsed byRegulatory Guide 1.200, Revision 2This attachment is not applicable to the PVNGS submittal. APS' proposal solely uses PRAmodels in its Risk-Informed Completion Time Program for which there are standards endorsedby the NRC in Regulatory Guide 1.200, Revision 2.7-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACH MENT 8Information Supporting Justification of ExcludingSources of Risk Not Addressed by the PVNGS PRA Models EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesInformation Supporting Justification of ExcludingSources of Risk Not Addressed by the PVNGS PRA ModelsIntroductionSection 5.0, Item 5 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI06-09-A, requires that the license amendment request (LAR) provide a justification for excludingany risk sources determined to be insignificant to the calculation of configuration-specific risk,and provide a discussion of any conservative or bounding analyses to be applied to thecalculation of risk-informed completion times (RIOTs) for sources of risk not addressed by thePRA models.ScopeNEI 06-09-A and the associated Pressurized Water Reactor Owners Group (PWROG) guidance(Reference 2 of this Attachment) do not provide a specific list of hazards to be considered in anRIOT Program. However, NUREG-1 855, Guidance on the Treatment of UncertaintiesAssociated with PRAs in Risk-Informed Decision Making (Reference 3 of this Attachment),provides guidance on how to treat uncertainties associated with PRA in risk-informed decisionmaking relative to hazards that are not considered in the PRA model. Specifically, Section6.3.3.1 of NUREG-1 855 provides the following list of external hazards that should be addressedeither via a bounding analysis or included in a PRA calculation:* Aircraft impacts* External flooding* Extreme winds and tornados (including generated missiles)* External fires (addressed in Table A8-1, Screening Summary of External Hazards, bythe following two External Hazards: Forest or Range Fire and Industrial or MilitaryFacility Accident)* Accidents from nearby facilities* Pipeline accidents (e.g., natural gas)* Release of chemicals stored at the site* Seismic events* Transportation accidents* Turbine-generated missilesThe scope of this Attachment considers the above hazards for PVNGS, except for seismicevents which are addressed by the PRA model.Technical ApproachThe guidance contained in NEI 06-09-A states that all hazards that contribute significantly toincremental risk of a configuration must be quantitatively addressed in the implementation ofrisk-managed TSs. Consistent with NUREG-1 855, the process includes the ability to addressexternal hazards by:8-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times* Screening the hazard based on a low frequency of occurrence* Bounding the potential impact and including it in the decision-making* Developing a PRA model to be used to calculate RIOTs and associated RiskManagement Action Times (RMATs)ASME/ANS PRA Standard RS-S-2008 (Reference 4 of this Attachment) has endorsed thefollowing set of five external hazard screening criteria:1) The hazard would result in equal or lesser damage than the events for which the planthas been designed. This requires an evaluation of plant design bases to estimate theresistance of plant structures and systems to a particular external hazard.2) The hazard has a significantly lower mean frequency of occurrence than another event(taking into account the uncertainties in the estimates of both frequencies), and thehazard could not result in worse consequences than the other event.3) The hazard cannot occur close enough to the plant to affect it. Application of thiscriterion needs to take into account the range of magnitudes of the hazard for therecurrence frequencies of interest.4) The hazard is included in the definition of another event.5) The hazard is slow in developing, and it can be demonstrated that sufficient time existsto eliminate the source of the threat or to provide an adequate response.The review of external hazards considers two aspects of the contribution to risk. The first is thecontribution from the occurrence of beyond design basis conditions (i.e., winds greater thandesign). These beyond-design-basis conditions challenge the functionality of the systems,structures, and components (SSCs) to support safe shutdown of the plant. The second aspectaddressed are the challenges caused by external conditions that are within the design basis, butstill require some plant response to assure safe shutdown (i.e., high winds causing loss ofoffsite power). While the plant design basis assures that the safety-related equipment necessaryto respond to these challenges are protected, the occurrence of these conditions neverthelesscauses a demand on these systems and can impact configuration risk.Note that when the effect of a particular hazard is not able to be mitigated using the plant SS~s,then there is no impact on the changes in risk calculated to support the RIOT Program, andthese hazards can be screened out of the RIOT Program as well. Only events which create ademand for mitigation equipment are potentially relevant to the RIOT Program.The review and disposition of each external hazard is addressed in Table A8-1.8-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A8-1 Screening Summary of External HazardsScreening ResultExtenalHazrd SreeedScreeningEtraHaad Sree? Criterion Comment(Y/N) (Note a)Airport hazard meets 1975 StandardReview Plan (SRP)( Reference 5*)Aircraft Impact Y PS2 requirements. Additionally, airwaysP4 hazard bounding analysis per NUREG-1855 is < 1 E-6/y.AvalncheY 03 Not applicable to the site because ofclimate and topography.Sudden influxes not applicable to the03 plant design (closed loop systems forBiological Event Y C5 ECWS and CWS). Slowly developingC5 growth can be detected and mitigated by___________________surveillance.Coastl ErsionY 03 Not applicable to the site because of____ ____ location.Drouht YPlant design eliminates drought as aconcern and event is slowly developing.Plant design meets 1975 SRPExtenal loodng YPS2 (Reference 5*) requirements.The plant design basis tornado has aExtreme Wind or yPS2 frequency <1 1E-7/y. The spray pondTornado PS4 nozzles (not protected against missiles)have a bounding median risk < 1 E-7/y.Limited occurrence because of aridFog Y C1 climate and negligible impact on theplant.Not applicable to the site because ofForest or Range Fire Y 03 litevgtaonFrostLimited occurrence because of arid____ ____ ____ ____climate.Limited occurrence and bounded byC1 other events for which the plant isHalC 4 designed. Flooding impacts coveredunder Intense Precipitation.Plant is designed for this hazard.High Summer Y C1 Associated plant trips have not occurredTemperature and are not expected.High Tide, Lake Level, y 03 loctapion. o h it eaueoor River Stage Notappicaloonh.iteaueo8-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A8-1 Screening Summary of External HazardsScreening ResultExternal Hazard Screened? ScreeningComn(Y/N) (Note a)Covered under Extreme Wind orHurrcaneY 04 Tornado and Intense Precipitation.Ice blockage causing flooding is notapplicable to the site because of locationIc ovrC3 (no nearby rivers and climateC1 conditions). Plant is designed forfreezing temperatures, which areinfrequent and short in duration.Explosive hazard impacts and controlIndustrial or Military yPS2 room habitability impacts meet the 1975Facility Accident SRP requirements (Regulatory Guides1 .91 and 1.78).PRAs addressing internal flooding haveindicated this hazard typically results inInteral Foodig N one CD~s > 1 E-6/y. Also, the ASME/ANSPRA Standard requires a detailed PRAfor this hazard which is addressed in thePVNGS Internal Flooding PRA.PRAs addressing internal fire haveindicated this hazard typically results inInternal Fire N None CD~s > 1E-6/y. Also, the ASME/ANSPRA Standard requires a detailed PRAfor this hazard which is addressed in thePVNGS Internal Fire PRA.LandlideY 03 Not applicable to the site because oftopography.Lightning strikes causing loss of offsitepower or turbine trip are contributors tothe initiating event frequencies for theseLightning Y C1 events. However, other causes are alsoincluded. The impacts are no greaterthan already modeled in the internalevents PRA.Not applicable to the site becauseLowe Ltake Levl rC3 cooling is provided by treatedRiverStagewastewater piped from Phoenix.Extended freezing temperatures areLow Winter yC1 rare, the plant is designed for suchTemperature C5 events, and their impacts are slow to____ ___ ___ ___ ___ _ __ ___ ___ __ ___ ___ develop.8-4 Enclosureand Assessment of Proposed Amendment for Risk-Informed Completion TimesDescriptionTable A8-1 Screening Summary of External HazardsScreening ResultExternal Hazard Screened? ScreeningComn(YIN) (Note a) ________________The frequency of meteorites greater thanMeteorite or Satellite P4 100 lb striking the plant is around 1 E-8/yImpact YP4 and corresponding satellite impacts isaround 2E-9/y.Pipelines are not close enough toPipeline Accident Y 03 significantly impact plant structures.Re lease of Chemicals yP2 Plant storage of chemicals meets 1975in Onsite Storage YP2 SRP requirements.Rive Divrsio C3 Not applicable to the site because oflocation.The plant is designed for such events.San o Dut tor YC1 Also, a procedure instructs operators to05 replace filters before they becomeinoperable.Not applicable to the site because ofSeiche Y 03 location. Onsite reservoirs and sprayCl ponds designed for seiches.PRAs addressing seismic activity haveindicated this hazard typically results inCD~s > 1 E-6/y. Also, the ASME/ANSSeismic Activity N None PRA Standard requires a detailed PRAor Seismic Margins Assessment (SMA)for this hazard which is addressed in thePVNGS Seismic PRA.The event damage potential is less thanC1 other events for which the plant isSnwC4 designed. Potential flooding impactscovered under external flooding.The potential for this hazard is low at theSoil Shrink-Swell yC1 site, the plant design considers thisConsolidation 05 hazard, and the hazard is slowly_________________developing and can be mitigated.Not applicable to the site because ofStorm Surge Y 03 loainToxic gas covered under release ofchemicals in onsite storage, industrial orToxi GasY 04 military facility accident, andtransportation accident.8-5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A8-1 Screening Summary of External HazardsScreening ResultExternal Hazard Screened? ScreeningCriterion Comment(Y/N) (Note a)Potential accidents meet the 1975 SRPrequirements. Bounding analyses usedPS2 for offsite rail shipment of chlorine gasTransportation yPS4 and onsite truck shipment of ammoniumAccident C3 hydroxide. Marine accident notC4 applicable to the site because oflocation. Aviation and pipeline accidentscovered under those specific categories.Not applicable to the site because ofTsunami Y C3 loainTurbine-Generated Potential accidents meet the 1975 SRPMissiles S2 requirements.Not applicable to the site because ofVolcanic Activity Y C3 loainWaves associated with adjacent largeC3 bodies of water are not applicable to theWaesYC4 site. Waves associated with externalflooding are covered under that hazard.*See references of this AttachmentNote a -See Table A8-2, Progressive Screening Approach for Addressing External Hazards,for descriptions of the screening criteria.8-6 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A8-2 Progressive Screening Approach for Addressing External HazardsEvent Analysis Criterion Source CommentsN UREG/CR-2300Initial Preliminary C1. Event damage potential is (ReferenceSceein <events for which plant is 6*) andSreigdesigned. ASME/ANSStandard RA-Sa-2009NUREG/CR-02. Event has lower mean 20 nfrequency and no worse AM/Nconsequences than other Sadr Aevents analyzed. Sa-2009NUREG/CR-2300 and03. Event cannot occur close AM/Nenough to the plant to affect it. Sadr ASa-2009NUREG/CR-2300 and Not used to screen.04.Evet s icluedin he ASME/ANS Used only to includedefiitin o anthe evnt. Standard RA- within another event.Sa-200905. Event develops slowly,allowing adequate time to ASME/ANSeliminate or mitigate the Standardthreat.PrgrssvePSI. Design basis hazard ASME/ANSProresive cannot cause a core damage Standard RA-Screening accident. Sa-2009NUREG-1 407P82. Design basis for the (Referenceevent meets the criteria in the 7*) andNRC 1975 Standard Review ASME/ANSPlan (SRP). Standard RA-Sa-2009PS3. Design basis event NUE-40as modified inmean frequency is < 1 E-5/y ASME/ANSand the mean conditional core Sadr Adamage probability is < 0.1. -20NUREG-1 407PS4. Bounding mean CDF is and< 1E-6/y. ASME/ANS______________Standard RA-8-7 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A8-2 Progressive Screening Approach for Addressing External HazardsEvent Analysis Criterion Source CommentsSa-2009NUREG-1407Screening not successful.anDetailed PRA PAnestmetASME/ANSrequirements in the Sadr AASME/ANS PRA Sta~ndard. Standard RA-______*See references of this AttachmentReferences1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAGNo. MD4995), ML071 200238, dated May 17, 20072. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk-In formed Completion Time and Risk Managed Action Time for RITSTF Initiative 48, August20103. NUREG-1 855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 20094. American Society of Mechanical Engineers and American Nuclear Society, Addenda toASME/ANS RA-S-2008 Standard for Leveil1/Large Early Release Frequency ProbabilisticRisk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York(NY), February 2009.5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports forNuclear Power Plants, LWR Edition, 19756. NUREG/CR-2300, PRA Procedures Guide, January 19837. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination ofExternal Events (IPEEE) for Severe Accident Vulnerabilities, June 19918-8 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 9Baseline Core Damage Frequency andLarge Early Release Frequency EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesBaseline Core Damage Frequency andLarge Early Release FrequencySection 4.0, Item 6 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI06-09-A requires that the license amendment request (LAR) provide the plant specific total coredamage frequency (ODE) and large early release frequency (LERE) to confirm that these areless than 1 E-4/year and 1 E-5/year respectively, thus assuring that the potential risk increasesallowed under the RMTS program are consistent with Regulatory Guide (RG) 1.174, Revision 1(Reference 2 of this Attachment). RG 1.174, Revision 2 (Reference 3 of this Attachment) issuedby the NRC in May 2011, did not revise these limits.This attachment demonstrates that the total ODE and total LERE are less than the guidance ofRG 1.174, such that the risk metrics of NEI 06-09-A may be applied to the PVNGS Risk-Informed Completion Time (RIOT) Program.Table A9-1, Total Unit 1/2/3 Baseline Average Annual CDF/LERF, provides the ODE and LEREvalues that resulted from a quantification of the baseline average annual models (References 4,5, 6, 7, and 8 of this Attachment), which include contributions from internal events, internalflooding, internal fire, and seismic hazards. Other external hazards are below acceptedscreening criteria and do not contribute significantly to the totals.The ODE and LERF for each unit at PVNGS are the same because each unit is nearly identicalto the others by design and through the modification process. There are small differencesbetween the units that have been evaluated and found to have minimal risk significance.Examples include:* Unit 1 has a manual transfer switch between each of its four trains of safety-relatedinverters and their backup regulated power source, while the other two units haveautomatic transfer switches.* Field routed cablingAs demonstrated in the table, the total ODE and total LERF are within the guidance of RG 1.174to permit small changes in risk which may occur during implementation of RIOTs. Therefore, thePVNGS RIOT Program is consistent with NEI guidance.9-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A9-1 : Total Unit 112/3 Baseline Average Annual CDFILERF'(After Issues Listed in Attachment 4 are Resolved)Hazard CDF (per rx-yr) LERF (per rx-yr)Internal Events 1 .3E-6 4.3E-8Internal Flooding 4.1E-7 1.9E-8Seismic 2.8E-5 5.3E-6Internal Fire 2.8E-5 2.4E-6Total 5.8E-5 7.8E-6Note:1. The Baseline Average Annual CDF/LERF include average maintenance unavailability ofstructures, systems, and components (SSCs). The configuration risk management programmodel used for the RICT Program does not include maintenance unavailability of SSCs unlessspecific to the configuration.References1. NRC letter, Jennifer M. Golder to Buff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(TAG No. MD4995), ML071200238, dated May 17, 20072. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1November 20023. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May20114. PVNGS Study 1 3-NS-B067, At-Power PRA Quantification, Revision 65. PVNGS Study 1 3-NS-C042, At-Power Level 2 PRA LERE Quantification, Revision 16. PVNGS Study 1 3-NS-F004, Fire PRA -Quantification and Screenings, Revision 07. PVNGS Study 13-NS-C099 "Internal Flooding PRA -PRA Modeling and Quantification,Revision 28. Westinghouse Calculation CN-RAM-12-022, Palo Verde Seismic Probabilistic RiskAssessment -Quantification, Revision 19-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 10Justification of Application of At-Power PRAModels to Shutdown Modes EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesJustification of Application of At-Power PRAModels to Shutdown ModesThis attachment is not applicable to the PVNGS submittal. APS is not proposing to apply theRisk-Informed Completion Time Program in shutdown modes, but only in Modes 1 and 2.10-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 11,Probabilistic Risk Assessment Model Update Process EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesProbabilistic Risk Assessment Model Update ProcessSummarySection 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A, requires that the license amendment request (LAR) provide a discussion of thelicensee's programs and procedures which assure the probabilistic risk assessment (PRA)models which support the RMTS are maintained consistent with the as-built/as-operatedplant. Palo Verde Nuclear Generating Station (PVNGS) Procedure 70DP-0RA03 ProbabilisticRisk Assessment Model Control (Reference 2 of this Attachment), controls update andmaintenance of the PRA models. This procedure is in full compliance with ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic RiskAssessment for Nuclear Power Plant Applications (Reference 3 of this Attachment) for PRAmodel maintenance and update.This attachment describes the administrative controls and procedural processes applicableto the configuration control of PRA models used to support the Risk-Informed CompletionTime (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedurerevisions, will be identified and reviewed prior to implementation to determine if they couldimpact the PRA models. The PRA Configuration Control Program will ensure these plantchanges are incorporated into the PRA models as appropriate. The process will includediscovered conditions associated with the PRA models, which will be addressed through thePVNGS Corrective Action Program.Should a plant change or a discovered condition be identified that has a significant impact tothe RICT Program calculations as defined by the Configuration Risk Management Program(CRMP), an interim update of the PRA model will be implemented. Otherwise, the PRAmodel change is incorporated into a subsequent periodic model update. Such pendingchanges are considered when evaluating other changes until they are fully implemented intothe PRA models. Periodic PRA model updates are performed no less frequently than everytwo refueling cycles (i.e., three years), consistent with the guidance of NEI 06-09-A.PRA Model Update ProcessThe PRA Configuration Control Program ensures that the applicable PRA model used forthe RICT Program reflects the as-built, as-operated plant for the three PVNGS units. ThePRA Configuration Control Program delineates the responsibilities and guidelines forupdating the full-power internal event, internal flood, internal fire, and seismic PRAmodels, and includes both periodic and interim PRA model updates. The procedurerequires an update to be initiated at least once every three years to reflect industryoperating experience (other than data), plant design and procedure changes. An update ofPRA model data, including initiating event, component unavailability, component reliability,and common cause data is also required by the procedure to be initiated at least onceevery five years. The program includes guidance on identifying, evaluating, anddocumenting potential impacts (e.g., plant changes, plant/industry operational experience,or errors or limitations identified in the model). In addition, guidance is provided onassessing individual and cumulative risk impacts of pending changes. Finally, the PVNGSsoftware quality assurance program records the controlled version of the PRA and CRMP11-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Timesmodels and associated references.Review of Plant Chanqes for Incorporation into the PRA Model1) Plant changes or discovered conditions, as defined in the PRA Configuration ControlProgram, are reviewed for potential impact to the PRA models, including the CRMPmodel and the subsequent risk calculations which support the RICT Program.2) Plant changes that meet the criteria defined in the PRA Configuration Control Program(including consideration of the cumulative impact of other pending changes) will beincorporated in the applicable PRA model(s), consistent with the NEI 06-09-Aguidance. Otherwise, the change is assigned a priority and is incorporated at asubsequent periodic update consistent with procedural requirements.3) PRA updates for plant changes are initiated at least once every two refueling cycles,consistent with the guidance of NEI 06-09-A.4) If a change is required for the CRMP model, but cannot be immediately implementedfor a significant plant change or discovered condition, either:A. Alternative analyses to conservatively bound the expected risk impact of thechange will be performed. In such a case, these alternative analyses becomepart of the RICT Program calculation process until the plant changes areincorporated into the PRA model during the next update. The use of suchbounding analyses is consistent with the guidance of NEI 06-09-A.orB. Appropriate administrative restrictions on the use of the RICT Programwill be put in place until the model changes are completed, consistent withthe guidance of NEI 06-09-A.References1. NRC letter, Jennifer M. Golder to Buff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAGNo. MD4995), ML071 200238, dated May 17, 20072. PVNGS Procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency ProbabilisticRisk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME,New York, NY, American Nuclear Society, La Grange Park, Illinois, February 200911-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 12Attributes of theRisk Management Program ModelConfiguration EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesAttributes of theConfiguration Risk Management Program ModelIntroductionSection 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A requires that the license amendment request (LAR) provide a description ofprobabilistic risk assessment (PRA) models and tools used to support RMTS, includingidentification of how the baseline PRA model is modified for use in the Configuration RiskManagement Program (CRMP) tools, quality requirements applied to the PRA models andCRMP tools, consistency of calculated results from the PRA model and the CRMP tools, andtraining and qualification programs applicable to personnel responsible for development anduse of the CRMP tools. The scope of structures, systems, and components (SSCs) within theCRMP will be provided. This item should also confirm that the CRMP tools can be readilyapplied for each Technical Specification (TS) limiting condition for operation (LCO) within thescope of the plant specific RMTS submittal.This attachment describes the necessary changes to the peer-reviewed baseline PRAmodels for use in the CRMP software to support the Risk-Informed Completion Time (RICT)Program. The process employed to adapt the baseline models for CRMP use isdemonstrated: (1) to preserve the core damage frequency (CDF) and large early releasefrequency (LERF) quantitative results; (2) to maintain the quality of the peer-reviewed PRAmodels; and (3) to correctly accommodate changes in risk due to time-of-year, time-of-cycle,and configuration-specific considerations. Quality controls and training programs applicablefor the CRMP are also discussed in this Enclosure. Additional considerations regarding theInternal Fire PRA model to address implementation of National Fire Protection Association(NFPA) -805 as the licensing basis for the fire protection program are also discussed at theend of this attachment.Translation of Baseline PRA Model for Use in CRMP:The baseline PRA models for internal events, including internal floods, internal fires, andseismic events, are the peer-reviewed models, will be updated as described in Attachment 11of this Enclosure to reflect the as-built, as-operated plant. These models are modified toinclude changes that are needed to facilitate configuration-specific risk calculations tosupport the RICT Program implementation. The baseline models and the changes made tocreate the CRMP model used in the RICT Program are controlled using plant calculations,which include the necessary quality controls and reviews.The changes to the models to account for variations in system success criteria based ontime-of-year or time-in-operating cycle, and other specific changes needed to properlyaccount for configuration-specific issues, which are either not evaluated in the baselineaverage annual model or are evaluated based on average conditions encountered during atypical operating cycle, are described in Table A12-1, Changes Made for Configuration-Specific Risk.12-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTABLE A12-1 CHANGES MADE FOR CONFIGURATION-SPECIFIC RISKDESCRIPTION BASIS FOR CHANGEPlant Availability The baseline PRA models account for the time the reactor operates atpower by using a plant availability factor. This is appropriate fordetermining the average annual (time-based) risk, but the factor is notapplicable to configuration-specific risk calculated for the RIOT Program.In order to account for the assumption that the plant is always operating inthe RIOT Program, the frequency of initiating events which include anavailability factor are adjusted. This change is necessary to adjust themodeled initiating event frequencies from a "per year' to a "per reactoryear" basis for use in the CRMP.Maintenance Maintenance alignment probabilities in the baseline PRA models haveAlignment probabilities based on the fraction of the year the equipment isProbabilities unavailable. For the CRMP model, the actual configuration of equipment isevaluated, so the maintenance alignment probabilities are set to zero. Thisis also done for the system initiating events, which include maintenance______________ contributions.Excluded The PRA models will not remove excluded maintenance combinationsMaintenance allowed by the technical specifications (i.e., both trains of a single safetyCombinations system being simultaneously unavailable).Room Cooling The baseline PRA models include conservative success criteria for roomSuccess Criteria cooling and do not use average annual criteria; therefore, no changes tothe CRMP model for room cooling success criteria are required.Unfavorable The current PVNGS core design reflected in the baseline PRA model forExposure Time ATWT events includes a UET for variable success criteria based on time(UET) for of core life (i.e., moderator temperature coefficient early in cycle life). Theanticipated event is set to the fraction of the year for which the UET applies and willtransient without be changed to a probability of 1 or 0 based on operator input using thetrip (ATWT) CRMP tool, depending on the actual time in the operating cycle.EventsQuality Recjuirements and Consistency of PRA Model and CRMP ToolsThe approach for establishing and maintaining the quality of the PRA models, including theCRMP model, includes both a PRA maintenance and update process described inAttachment 11 of this Enclosure and the use of self-assessments and independent peerreviews described in Attachment 6 of this Enclosure.The information provided in Attachment 6 demonstrates that the PVNGS internal events,internal flood, internal fire, and seismic PRA models reasonably conform to the associatedindustry standards endorsed by Regulatory Guide (RG) 1.200, Revision 2 (Reference 2 of thisAttachment). This information provides a robust basis for concluding that the PRA models are ofsufficient quality for use in risk-informed licensing actions.The current PRA models will either be combined into a single CRMP model for use in the CRMPsoftware tool, or will be used to generate pre-solved solutions for routine plant configurationswhich will be entered into the CRMP software tool. PVNGS has been using a single CRMPmodel in EPRI EOOS for more than eight years based on combined internal events and internalfire models. The CRMP model is rigorously checked against the individual PRA model results to12-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Timesvalidate the CRMP model quality. If a new CRMP model including the upgraded internal fire andnew seismic PRA models cannot be developed that meets work management and schedulingneeds for solution speed, PVNGS will take the approach used by South Texas Project by pre-solving thousands of routine expected configurations and saving the results of those solutions inthe CRMP software tool. When unanalyzed configurations occur, PRA would promptly solve thePRA models to determine the RIOT as well as comply with existing Maintenance Ruleconfiguration risk monitoring requirements. PVNGS currently has and will continue to provide aqualified PRA engineer on call 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day, 7 days a week to support Operations and WorkManagement in assessing the risk of planned and emergent plant configurations.Changes made to the baseline PRA model in translation to the CRMP model will be controlledand documented in accordance with PVNGS procedure 700P-0RA03, Probabilistic RiskAssessment Model Control, to maintain the existing CRMP model. An acceptance test isperformed after every CRMP model update to verify proper translation of the baseline PRAmodels and acceptance of all approved changes made to the baseline PRA models pursuant totranslation to the CRMP model. This testing also verifies correct mapping of plant componentsto the basic events in the CRMP model.Training and QualificationThe PVNGS PRA staff is responsible for development and maintenance of the CRMP model.The PRA staff is trained in accordance with the site Engineering personnel training programand has passed specific qualifications on each major element of the PRA development and use.Operations and Work Control staff will use the CRMP tool under the RIOT Program and aretrained in accordance with a program using National Academy for Nuclear Training (ACAD)documents, which is accredited by INPO.Application of the CRMP Tool to the RICT Program ScopePVNGS will use either the EPRI EQOS CRMP tool or the ERIN Engineering PARAGON CRMPtool for RIOT Program calculations. The EPRI EOOS program already exists in an approved,issued version to support the RIOT Program. PVNGS currently uses an earlier version of theEPRI EQOS tool in the Maintenance Rule CRMP for at-power conditions and the PARAGONtool for low-power/shutdown conditions. APS is transitioning to the PARAGON tool forMaintenance Rule CRMP use in all modes of operation. ERIN Engineering is in the process ofdeveloping a new PARAGON version that will support the RIOT Program requirements. PVNGSplans to select one of these programs for use in the RIOT Program. The selected program willmeet RG 1.174 (Reference 3 of this Attachment) and PVNGS software quality assurancerequirements.12-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesReferences1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NE!) Topical Report (TR) NE! 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAGNo. MD4995), ML071200238, dated May 17, 20072. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy ofProbabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, datedMarch 20093. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May201112-4 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 13Key Assumptions and Sources of Uncertainty12-5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesKey Assumptions and Sources of UncertaintyIntroductionSection 4.0, Item 10 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A requires that the license amendment request (LAR) provide a discussion of howthe key assumptions and sources of uncertainty were identified, and how their impact wasassessed and dispositioned. This attachment provides that discussion.Process for Identification of Key Assumptions and Sources of UncertaintySources of model uncertainty and related assumptions, defined consistent with RegulatoryGuide 1 .200, Revision 2, (Reference 2 of this Attachment) and the ASME/ANS RA-Sa-2009,Standard for Leveil/Large Early Release Frequency Probabilistic Risk Assessment for NuclearPower Plant Applications, Addendum A to RA-S-2008 (Reference 3 of this Attachment), havebeen identified for the PVNGS PRA models using the guidance of NUREG-1 855 (Reference 4of this Attachment) and EPRI TR-1 016737 Treatment of Parameter and Model Uncertainty forProbabilistic Risk Assessment (Reference 5 of this Attachment).The detailed process of identifying, characterizing and qualitative screening of modeluncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate theuncertainties associated with the internal events PRA model; however, the approach can beapplied to other types of hazard groups.Disposition of Key Assumptions and Sources of UncertaintyThe list of assumptions and sources of uncertainty were reviewed to identify those whichwould be significant for the evaluation of configuration-specific changes in risk. If the PVNGSmodel used a non-conservative treatment, or methods which are not commonly accepted, theunderlying assumption or source of uncertainty was reviewed to determine the impact onRIOT Program calculations. Only those assumptions or sources of uncertainty that couldsignificantly impact the configuration risk calculations were considered key for thisapplication.The internal events PRA models are used to support the internal fire and seismic PRA, andso the assumptions and uncertainties evaluated would apply to these PRA models as well.Key assumptions and sources of uncertainty for the RIOT Program application are identifiedand dispositioned in Table Al13-1, Disposition of Key Assumptions/Sources of UncertaintyImpacting Configuration Risk Calculations.13-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTThe only plant system SBOGs can be aligned to multiple units to supply The existing PRA model conservatively doesmodeled in the PRA that is limited loads, not credit SBOGs in more than one unit.shared between the three units Further, the plant design for FLEX andis the station blackout beyond FLEX modifications / capabilitiesgenerators (SBOGs). provide additional 480V and 4160V suppliesSimultaneous multiple unit to safety buses not currently credited in thestation blackout conditions are PRA models. For RICT Programscreened out based on low implementation, PVNGS will consider, basedprobability. SBOGs are on plant conditions and associated risk levels,assumed aligned to one unit risk management actions (RMAs) for use ofonly during an event. FLEX equipment such as 480V and 4160Vgenerators when electric power systems torisk significant equipment are unavailable____ ___ ___ ___ ____ ___ __ ___ ____ ___ ___ ___ ____ ___ ___ ___ ___ under a RIOT.13-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTReactor Coolant Pump (RCP) RCP Seal Leak or Rupture is not modeled as a loss If flCP seal parameters are not within normalSeal Leak or Rupture of reactor coolant system (RCS) inventory safety limits indicating potential seal degradationfunction. Based on Westinghouse WCAP-1 5749 while a RIOT is in effect, RMAs will be used(Reference 6 of this Attachment) and pump seal to ensure availability of charging pumps orvendor information, it was concluded that because of other plant SSCs which can mitigatethe very tight clearances, leakage into the seal excessive RCP seal leakage.package from the RCS is limited to about 17 gpm perpump. Each of the four RCPs has a seal packagewhich consists of three seals. As a result, even if theseal package on all four RCPs failed, the total leakrate would be within the capacity of two chargingpumps and does not qualify as a LOCA. An analysisshowed that continuing to model ROP seal leakageand requiring charging pumps to mitigate theleakage represented an insignificant contribution toODE or LERF, even assuming one of the three sealson each pump failed. The analysis also showed thatmodeling catastrophic failure due to operator failureto secure the pumps upon loss of cooling and sealinjection was an insignificant contributor to CDF or____ ___ ___ ___ ___ ___ LERF.Loss of Coolant Accident NUREG/CR-6928 (Reference 7 of this Attachment) The slight variance in the range of break(LOCA) Frequencies restated the results from NUREG-1 829 (Reference 8 sizes for different LOCAs is not significantof this Attachment). The LOCA frequencies are and is judged to have minimal impact onbased upon expert elicitations. The LOCA sizes LOCA frequencies, within the uncertaintiesidentified by the NRC are different from those associated with the expert elicitation values,estimated for PVNGS. and of insignificant impact to RICTcalculations. No special measures are____ ___ ___ ____ ___ ___ ____ ___ ___ ___ ____ ___ ___ ____ ___ ___ ___ required for the RIOT Program.13-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impactinq Confiquration Risk Calculationsr R T = Assumption / UncertaintyLoss of Off-site Power (LOSP)FrequencyDiscussionDisposition for RICTThe national LOSP data presented in the latest EPRIevents reports (References 4 and 5 of thisAttachment) were used to obtain point-estimates forswitchyard-centered and severe weather-relatedLOSP frequencies. The EPRI Reports indicate thatthe generic LOSP data is subject to usermodifications and screenings to fit the local plantdesigns and environmental conditions. Thisapproach of LOSP screening is consideredreasonable and necessary to avoid erroneousskewing of the LOSP data. The frequency of extremeweather LOSP category was obtained as that of thefrequency of tornado occurrence with category F2 orhigher. The frequency of grid-related LOSP wasobtained by Bayesian updating the reported value forwestern region (Western Electricity CoordinatingCouncil) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 9 of this Attachment).The LOSP frequencies are based on recentindustry data and are appropriate torepresent plant-specific conditions. SBOGs,as well as other additional electric powersupplies, are available on site to mitigateLOSP. RMAs will consider, based on plantconditions and associated risk levels, thesealternate AC sources for applications of theRICT Program where LOSP eventssignificantly contribute to configuration risk.LOSP Associated Non- The probabilities of offsite power non-recoveries The offsite power non-recovery probabilitiesRecovery Probabilities were obtained from Table 4-1 of the draft NRC are based on the best available data and areNUREG/CR-INEEL/EXT-04-02326. The error factors appropriate to represent plant-specificassociated with LOSP frequencies and LOSP non- conditions. SBOGs, as well as otherrecovery probabilities were obtained from additional electric power supplies, areNUREG/CR-INEEL/EXT-04-02326 (when provided); available on site to mitigate LOSP. RMAs willotherwise, by using available in-house statistical consider, based on plant conditions andprograms for Iognormal and Weibull distributions, associated risk levels, these alternate ACsources for applications of the RICT Programwhere LOSP events significantly contribute to_______________________configuration risk.13-4 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key AssumotionslSources of Uncertainty Imoactina Confiauration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTBattery Life Assumptions The PVNGS batteries are not credited in the long- Crediting the actual higher capacities of theterm, because they are conservatively assumed to batteries and updated load shedding actionsbe discharged after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Although the IEEE from Fukushima-driven procedure changesClass 1 E batteries are designed to operate for 2 would result in longer RIOTs due to thehours, Engineering has determined that the class additional mitigation capabilities madebatteries' life is at least 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Thus they are available. Therefore, the current PRA modelavailable for power recovery at the 3-hour point on use for the RIOT Program is conservative andthe incident timeline. acceptable.Human Failure Events (HFEs) Accessibility for completion of non-screened HFEs A sensitivity analysis was performedduring a seismic event during a seismic event is assumed possible for all evaluating the impact of not crediting thenon-screened HFEs other than those which are subject HFEs and there was minimal impactassumed to fail in the cases of corridor building or on the ODE and LERF. Therefore, the currentturbine building collapse. Both the collapse of the seismic PRA model used for the RIOTcorridor building and turbine building and their impact Program is acceptable.on the access to the Main Steam Support Structure(MSSS) is considered in the seismic PRA model.There is a pinch point that leads into the MSSS thatcould restrict movement into the MSSS which wouldprevent local MSSS actions from being performed. ____________________Seismic performance shaping Seismic-only PS~s applied to the internal events This is considered a conservativefactors (PS~s) with respect to human error probabilities (HEPs) will over-ride the assumption. Therefore, the current seismicseismic-induced flooding flooding PS~s based on the consideration that the PRA model used for the RIOT Program isseismic events are more global events than the acceptable.specific flooding events. No additional modificationsare made to the internal events HEP to consider thepossibility of seismic-induced flooding events._____________________The seismic PRA HFE The seismic PRA dependency analysis assumes that The modification of the timing available duedependency analysis once an accident sequence is initiated, the operator to seismic considerations may result in aaction timing for a seismically-induced event is longer response or identification time andsimilar to that of an internally-induced event for main consequently a higher HEP.control room actions.Therefore, the current seismic PRA model______________________used for the RIOT Program is acceptable.13-5 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesT~hlp_ f_'isnosition of Key Assumotions/Sources of Uncertainty Imnactina Confiouration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTSeismic PRA weighting factors There is no standardized method to calculate HEPs More emphasis was given to the Surryapplied to three approaches in a seismic PRA. Therefore, a mean HEP for each method since it was a selective combinationbasic event was calculated by combining three of previous approaches and the most recentlyaccepted approaches [Surry, Kernkraftwerk performed and published method. However,Muhleberg (KKM), and Swiss Federal Nuclear Safety the Surry method has the potential to be theInspectorate (ENSI) provided in Reference 10 of this least conservative approach among the threeAttachment] using weighting factors of 0.7, 0.15, and methods. A sensitivity analysis was0.15, respectively, performed that ran the seismic PRA modelusing only the KKM and ENSI approaches,equally weighted. The change in CDF andLERF was -1.63% and 0.42%. Therefore, thecurrent seismic PRA model used for the RIOT______________________Program is acceptable.Relay chatter correlation Relay chatter between relays of the same This is a conservative assumption becausemanufacturer, model number, and plant location (i.e., the demand experienced by a relay isbuilding and elevation) was assumed to be fully dictated by in-cabinet response and not thecorrelated. Also, each relay identified as a control in-structure response spectra (ISRS) uponswitch, push button, or motor starter is fully which the binning is based. Therefore, thecorrelated with other generic, like components. current seismic PRA model used for the RIOTProgram is acceptable.Simplified Relay Fragility Low-risk importance relays (based on Risk This assumption is reasonable given thatParameters Achievement Worth) were treated with a simplified none of the pc values for the relays evaluatedfragility analysis and higher risk importance relays using the detailed fragility analysis were(10 different types) were treated with a detailed determined to have a 13c below 0.33 and mostfragility analysis. The simplified relay chatter fragility had pc of around 0.5. Therefore, the currentanalysis assumed a f3c of 0.35 based on engineering seismic PRA model used for the RIOTjudgment. Program is acceptable.13-6 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption ! Uncertainty Discussion Disposition for RICTSeismic failure of relays and For the relays modeled in the seismic PRA, the basic PRA analyst experience is credited in thebasic event mapping event associated with the seismic failure of the relay selection of the appropriate internal eventsmust be mapped to an existing internal events target PRA model component failure modes tobasic event. A key source of modeling uncertainty is reflect postulated seismic PRA modelassociated with the mapping of seismic basic events, component failure modes. This selection wasFailure modes postulated for the PVNGS internal performed by Westinghouse PRA seismicevents model may not fully align with their assigned experts and reviewed by APS PRAseismic counterparts, engineers. Therefore, the current seismicPRA model used for the RIOT Program isacceptable.Seismic PRA uses internal The PVNGS seismic PRA assumes that the internal The internal events PRA that was used toevents PRA as a starting point events PRA that is used as a starting point meets the develop the seismic PRA was evaluatedrequirements of Capability Category II of the PRA separately for its PRA quality and wasstandard. determined to meet Capability Category II ofthe PRA standard with the exception ofSystem Notebook documentation, which is acommitment herein to fully address prior toRIOT Program use. Therefore, the currentseismic PRA model used for the RIOTProgram is acceptable.Success criteria for seismic If not otherwise specified, the success criteria The base case seismic PRA uses a 24-hourPRA associated with the internal events PRA logic are mission time for the run time of mitigatingconsidered valid and applicable to accident equipment. A sensitivity case was developedsequences initiated by a seismic event. However, a to assess the impact of using a 72-hourstandard 24-hour mission time may not be suitable mission time for equipment run failures. Thefor a seismic-induced accident scenario because of change in overall ODE and LERF for thisthe longer time needed for offsite power recovery, case is 2.73% and 0.69%, respectively13-7 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTSeismic failure correlation Seismic failures are assumed to be completely The validity of this assumption of completecorrelated. This assumption implies that a single correlation is still being discussed at thebasic event is used to model the seismic failure of industry level. This is considered acomponents that are identified as pertaining to the conservative assumption. Therefore, thesame fragility. There is one exception to this where current seismic PRA model used for the RIOTfailures in the steam path in the Turbine Building are Program is acceptable.not considered correlated with failures of the______________________ feedwater lines.Seismically-induced LOSP The seismically-induced LOSP is assumed to bound The basis for this assumption is thatthe fragility of non-seismic class system. This seismically-induced LOSP has a generallyassumption implies that a number of non-seismic low seismic capacity. Scenarios where theclass systems are not addressed with a specific non-seismic support systems incurseismic failure. seismically-induced failures while off sitepower is still available are considered realisticonly for very low magnitude seismic events.Therefore, the most significant mitigatingequipment will still be available. This isconsidered a conservative assumption.Therefore, the current seismic PRA modelused for the RIOT Program is acceptable.Seismic PRA LOSP recovery In the seismic PRA, LOSP recovery is not credited It is realistic to consider that off site powerfor any seismic event above the safe shutdown recovery is available for low magnitudeearthquake (SSE), while it is credited with seismic events. The selection of the SSE as aunchanged probability for a seismic event below the threshold between recovery/no-recovery ofSSE. offsite power is arbitrary and conservative.Therefore, the current seismic PRA modelused for the RIOT Program is acceptable.13-8 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTScreening of equipment in the Screening of equipment in the SEL is based on Using a surrogate event for a number ofSeismic Equipment List (SEL) fragility analysis. Equipment screened by the fragility components that have been screened outteam as inherently rugged is not modeled in the introduces a conservative failure mode. Theseismic PRA for seismic-induced failure. In order to uncertainty introduced by the use ofquantitatively capture the impact of screened out surrogate equipment for the seismic class Iequipment, generic fragility parameters for the system is judged to have a limited impact onbuilding that housed the screened out equipment the model. Therefore, the current seismicwere used. The screened equipment is modeled PRA model used for the RIOT Program isthrough a surrogate basic event at a system level, acceptable.Operators tripping the reactor It is assumed that the operators will always trip the This is considered a conservativeabove operating basis reactor in case of a seismic event above OBE even if assumption. Therefore, the current seismicearthquake (OBE) the option for a controlled shutdown is allowed. PRA model used for the RIOT Program isacceptable.Train N Auxiliary Feedwater The AFN pump is assumed to remain functional with A sensitivity case was developed to assess(AFN) pump is assumed to small breaks or leaks at instrument tubing. The the uncertainty in crediting the AFN pumpremain functional following a fragility analysis associated with the AFN pump only and not the associated piping network. Thedesign basis earthquake addresses the pump and not the entire piping capacity of the AFN pump was reduced to thenetwork. same system level fragility parametersassociated with the instrument air system.ODE and LERF increased by 0.08% and0.03%, respectively, and indicated littlesignificance of uncertainty in thissimplification of the analysis. Therefore, thecurrent seismic PRA model used for the RIOTProgram is acceptable.Main steam line relief valves Main steam line relief valves are screened out of the A sensitivity case is developed to assess thenot explicitly included in the analysis on the basis that the steam generator and impact of this assumption. A fully dependentSEL related piping and valves are considered very seismic failure across all 20 relief valves isrugged. For this reason, the seismic failure of the modeled. ODE and LERF values did notmain steam line relief valves is not modeled. change when compared to the base caseresults. This indicates that no significantuncertainty. Therefore, the current seismicPRA model used for the RIOT Program isacceptable.13-9 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTStructural failures of buildings Structural failures of buildings are assumed to result This is a conservative assumption since thein major collapse and failure of all equipment inside fragility parameters provided are addressingthe building. the beginning of the structural failure, and afailure of limited areas of the building mayresult in failure of only a limited amount ofequipment inside the building. The mostsignificant example of this assumption is thestructural failure of the Turbine Buildingassumed to be also impacting and failing theOST tunnel. Therefore, the current seismicPRA model used for the RIOT Program is____________________________________acceptable.The Anticipated Transient The ATWT logic for seismic PRA assumes that the Moderator temperature coefficient (MTC) andWithout Trip (ATWT) logic for RCS pressure will be above the high-pressure safety ATWT pressure transient are not influencedseismic PRA injection pump shutoff head for only a short period of by the fact that the event is initiated by atime. seismic event rather than a spurious failure.Therefore, the success criteria developed forthe internal events ATWT are consideredvalid for the seismic PRA. Therefore, thecurrent seismic PRA model used for the RIOT_____________________Program is acceptable.All flood scenarios on the 40-ft A cutset review showed that the contribution of Fire This is a conservative approach and shouldand 51 -ft elevations of the Protection (FP) initiators is very low and that the not have a significant impact on the baselineAuxiliary Bulilding assume that internal flood results are not being skewed by this internal flood model. This would not have aa pipe failure drains the conservatism. significant impact on the RIOT Program.Refueling Water Tank (RWT).A single internal events PRA Since there are no significant differences between It is a realistic assumption that the Unit 1 SS0model was developed to the units, the Unit 1 system, structure, or component designators are used, since there are noquantify the plant flood risk for (SS0) designators were used. It was therefore major differences between the three units inmultiple units. assumed that the quantification results are terms of internal flood. This would not have a________________applicable to all units, significant impact on the RIOT Program.13-10 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTAll components within a flood, This is a conservative assumption that simplifies the This is a conservative approach thatarea where the flood originates impacted component list. Uncertainty exists as to simplifies the impacted component list. Thiswere assumed to be exactly where flooding would occur, the impact due would not have a significant impact on thesusceptible and failed as a to the geometry of the room and equipment, and the RIOT Program.result of the flood, spray, direction of the spray or splash for a given scenario.steam, jet impingement, pipe This assumption raises ODE.whip, humidity, condensationand temperature concernsexcept when componentdesign (e.g., waterproofing)spatial effects, low pressuresource potential or otherreasonable judgment could beused for limiting the effect.________ ______________Block walls are not credited in Unless a treatment is non-conservative, the block This has no impact and is of lowthe analysis and are treated as walls are analyzed on an individual basis. The consequence to RIOT. This would not have atypical plant walls. amount of water that could flow through the gaps is significant impact on the RIOT Program.unknown. This has no impact as there were noscenarios where the failure of block walls would leadto a non-conservative treatment.13-11 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTBreaks in pipes less than or The basis for this assumption is as follows: This is a conservative approach and is of lowequal to two inches in 1. It provides a practical limit to bound the scope of consequence to RIOT.equivalent diameter were only the analysis to potentially large flow rate andconsidered if the break would significant consequence events.dirctl reultin plnt ripor 2. Pipe sizes of less than or equal to two-inchresut i a loodindceddiameter do not accurately reflect plant fluid systemequimentfailre tat wuld flood impacts (i.e. two-inch diameter pipes produceresult in a plant trip or significantly smaller flood rates).immediate shutdown.3. At low flow rates typical of pressure boundaryfailure in pipes less than or equal to two inches, theoperator response time is longer and less stressful.Such conditions enhance operator actionssignificantly to successfully mitigate the breaks insmall bore pipes.However, piping less than two inches in diameter isconsidered on an individual basis when necessaryfor spray and flooding events. Specifically theseevents are considered in rooms without drains.Piping less than two inches was also considered forspatially specific spray events, however none weremodeled and a detailed discussion of the possibleevents are documented.Closed-loop systems and This is a conservative approach that allows for the This is a conservative approach and is of lowtanks were assumed to consideration of all consequences and does not consequence to RIOT. This would not have ainstantaneously release the require time-based calculations, significant impact on the RIOT Program.entire system inventory._____________________Control Room staff would be HEP and PSE adjustments were made during the This is a conservative approach and is of lowunable to respond effectively early stages of a flooding event to account for the consequence to RIOT. This would not have ato multiple events immediately additional stress influencing factors. The ODE is significant impact on the RIOT Program.following the flooding event, higher with this assumption._____________________13-12 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTNo addition to the control room Operator actions to isolate the flood source are It is a realistic assumption that there would becrew is credited early into a required shortly after detecting that a Pressure no addition to the control room crew early intoflood event when assessing Boundary Failure (PBF) has occurred. Often when the flood event when assessing humanhuman actions. responding to flood events, operators are responding actions. This would not have a significantto multiple alarms. impact on the RIOT Program.It is assumed that pipes that The assumption is conservative as it includes This is a conservative approach and is of loware larger than 3" were additional piping that may not be conducive to major consequence to RIOT. This would not have acapable of producing major flooding. Since major floods are not a major significant impact on the RIOT Program.floods unless it was contributor to the PBF frequency, its contribution todetermined that the piping was risk would be considered minimal.not capable of producing amajor flood.External tanks were not External tanks that rupture would not normally There is no significant impact on the model.considered as a flood source propagate into the plant. There were no tanks This would not have a significant impact onunless there is a normally identified in the internal flood PRA that propagated the RIOT Program.available pathway into the into the plant. It was assumed that the impact of anplant whereby the tank external tank rupture was bounded by the evaluationcontents could empty into a performed for internal events. Breach of an externalroom within the main plant tank was assumed to discharge to the yard area andstructulres, there would be no flood-induced failures of PRA-______________________ related components.Floods are assumed to fail all Oases in which equipment is deemed as sufficiently It is a realistic assumption and is of lowequipment in the initiating high or flood barriers are not expected to retain water consequence to RIOT. This would not have aroom and then propagate out to sufficient flood levels are treated on an individual significant impact on the RIOT Program.of the room to surrounding basis. Additionally, splitting the flood areas wouldflood areas. generate an unreasonable number of scenarios withno added insight. The top cutsets are not impacted,however if very specific isolation actions were taken_______________________this assumption could be significant.13-13 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTFloods are assumed to Water will flow down the path of least resistance; It is a realistic assumption and is of lowpropagate down pipe chases therefore a pipe chase is the preferred path rather consequence to RICT. This would not have abefore stairwells in situations than a stairwell with a door. significant impact on the RIOT Program.where pipe chases are notsurrounded by a curb and/or adoor must be opened to enterinto the stairwell.Floods are assumed to The hydrostatic load that a door can handle is based It is a realistic assumption and is of lowpropagate through doorways on whether the door closes against the frame or consequence to RIOT. This would not have awhich open out, away from the away (with relation to the room that the flood significant impact on the RIOT Program.initiating flood area more initiates). A door that is against the frame canreadily rather than doorways withstand a greater load as opposed to away fromwhich open in, towards the the door frame.initiating flood area.Floor drains were assumed to This assumption is based on the expectation that a It is a realistic assumption and is of lowbe capable of controlling water spray event will not result in a significant consequence to RIOT. This would not have alevels for spray events, accumulation of standing water. During plant significant impact on the RIOT Program.walkdowns it was observed that drain entranceswere maintained in proper working condition and freeof debris. Drains were not credited for any flood ormajor flood events. It was assumed that spuriousactuation of system relief valves would discharge alimited amount of inventory to a discharge tank. Suchevents were screened out as potential flood sources.Grouping boundary condition Grouping boundary condition sets for the LERF This is a conservative approach and is of lowsets for the LERF analysis analysis is a conservative approach. The LERF consequence to RIOT. This would not have aresults in conservative contribution of sequences that have been grouped significant impact on the RIOT Program.modelin~g of the containment for the LERF analysis and involve failure ofisolation valves, containment isolation valves is considered very low.13-14 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTThe piping layout for flood To the extent possible, the similarities were It is a realistic assumption and is of lowsources included in the internal confirmed during the plant walkdowns. Therefore, consequence to RIOT. This would not have aflood PRA was shown and Units 2 and 3 pipe lengths were assumed to be significant impact on the RIOT Program.estimated to be similar for all identical to Unit 1 pipe lengths. There are no majorthree units. differences between the three units.It is assumed that if a PBF There are no operator procedures for isolating a This is a conservative assumption and is ofwere to occur in the Safety flood event; therefore the most conservative and low consequence to RIOT. This would notInjection (SI) or Chemical & bounding location to isolate a flood of the SI or OH is have a significant impact on the RIOTVolume Control (OH) system one of the two pipe headers. Isolating at this point Program.piping, the operator would results in the loss of at least one train of ECOS,isolate the flood at one of the causing a trip. Therefore, the overall impact on thetwo pipe headers connecting model is small.the RWT to the OH and SIsystems.It is assumed that spurious Spurious actuation of a system relief valve was not This is of low consequence to RIOT. Thisactuation of system relief determined to be a credible flood source because would not have a significant impact on thevalves would discharge a the inventory that was released would be retained RIOT Program.limited amount of inventory to within the flood area and would not lead to ana discharge tank and such applicable initiating event. The risk is consideredevents were screened out as negligible as this is not considered to be a significantpotential flood sources. source of inventory.Limited or no access to an There was no credit taken for mitigation when the This is of low consequence to RIOT. Thisarea where flood initiation equipment relied on for mitigation was located in the would not have a significant impact on theoccurs was assumed. flood initiation area. Operators cannot get into RIOT Program.flooded areas.Only one internal flood The occurrence of simultaneous multiple It is a realistic assumption and is of lowinitiating event is assumed to independent internal flood events were considered to consequence to RIOT. This would not have aoccur at a time. be very unlikely and were not considered in this significant impact on the RIOT Program.evaluation._This is consistent withPRA modeling. ____________________13-15 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Im pacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTThe breach of isolation This is a simplifying assumption that has negligible This is a conservative assumption and is ofbarrier(s) that may result in a impact on the model. Propagation pathways were low consequence to RIOT. This would notmaintenance-induced flood made to be conservative for all scenarios have a significant impact on the RIOTevent was assumed to have no Program.impact on altering thepropagation paths related toother flooding mechanisms(i.e., pipe failure) for the floodsource. ________________________The indirect effects of a PBF Closed looped systems were considered to be This is a conservative assumption and is ofon the operability of a closed normally operating and providing cooling to low consequence to RIOT. This would notlooped system were equipment that is relied on to maintain the plant in a have a significant impact on the RIOTconsidered to be immediate. power production state. It was therefore assumed Program.that operator actions cannot be performed in a timelymanner to preclude a plant trip. Most closed loopsystems have a limited system capacity. A PBFwould drain the system and in most cases, operatoraction to isolate the PBF would not be feasible. Thisassumption is conservative and raises ODE.The spill rate resulting from a For a potentially unlimited source, a PBF that It is a realistic assumption and is of lowPBF of a potential unlimited resulted in a spray event (<100 gpm) would take an consequence to RIOT. This would not have aflood source that causes a extraordinary amount of time to cause a loss of that significant impact on the RIOT Program.spray event is low enough (i.e., system. Additionally, for most of the large nearly<100 gpm) to have no unlimited sources, the makeup capabilities of thesignificant impact on the system would generally exceed the flow rateoperation of the affected generated by a spray event. It was thereforesystem. assumed that such systems have sufficient designmargin to maintain the operability of the system anda plant trip would not occur. Note that for systemswith a low system capacity (e.g., the OH system) this______________________assumption was not valid. ____________________13-16 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTThe flow rate from a PBF is The spill rate for a particular break resulting from a This is a conservative assumption and is ofassumed static at the piping PBF is assumed to be the highest flow rate low consequence to RIOT. This would notmaximum possible rate and possible from the system or piping. For tanks, the have a significant impact on the RIOTthe scenario is only ended break spill rate is assumed to be constant at an Program.when the source was assumed flow rate. For systems requiring pumps, theexhausted or isolated. break spill rate is assumed to be the realistic pumpflow rate. The spill is assumed to continue in theoriginating flood area until the flood source isisolated or its water supply is limited or exhausted..The accumulation of flood water in a flood area wasconsidered halted when the flood source wasterminated, or when outflow from the flood areamatches or exceeds the inflow of flood water to theflood area. A constant maximum spill rate minimizesthe time to reach the critical heights for SSCs thatare susceptible to flooding.Spill rates were assumed to fall within the followingcategories:* Spray events: 100 gpm* Flood events: greater than 100 gpm but less than2000 gpm (or maximum capacity of the system,whichever is lower)* Major flood events: greater than 2000 gpm (orthe maximum capacity of the system, whichever________________________ is lower)13-17 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTThe treatment of main Recovery of feedwater is important for secondary This is of low consequence to RIOT. Thissteamline break and main side heat removal. The internal events analysis was would not have a significant impact on thefeedwater line break internal believed to provide sufficient analysis to be used in RIOT Program.events analysis was assumed the internal flooding PRA model.to address the impact of theseevents in assessing whethermain feedwater can berecovered following a reactortrip.It was assumed that minimal or The flood Human Reliability Analysis (HRA) did not This is of low consequence to RIOT. Thisno dependency existed include large early release specific HFEs. HFEs would not have a significant impact on thebetween flood-specific and specific to large early releases (i.e., post-core RIOT Program.large early release specific damage operator actions) are generally performedHuman Failure Events (HFEs). several hours after the initiating event occurs.No dependency between early and late operator_____________________actions. There is no impact on the model.The fire areas defined by the Fire areas are required by regulation to be It is a realistic assumption and is of lowFire Hazards Analysis (FHA) "sufficiently bounded to withstand the hazards consequence to RIOT. This would not have a(which is contained in Updated associated with the area" as defined in Generic significant impact on the RIOT Program.Final Safety Analysis Report Letter 86-10 (Enclosure 1 Section 4). Fire zoneAppendix 9B Sections 9B.2.1 boundaries are similarly assumed adequate;through 9B.2.22) will however, because fire zones have a lesser pedigreesubstantially contain the than fire areas, their boundaries are verifiedadverse effects of fires adequately in this notebook by a FHA review andoriginating from any currently plant walkdowns. Fire zone boundaries that appearinstalled fixed ignition source unable to withstand the fire hazards within the zoneor reasonably expected are combined. The internal fire PRA utilizes firetransient ignition source. Fire compartments which generally align with fire zones,zone boundaries are similarly but may be a combination of several fire zones.assumed adequate orcombined.____________________________________________13-18 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTSystems and equipment not The assumption that any fire fails all equipment It is a realistic assumption and is of lowcredited in the fire -induced lacking cable routing information has the potential to consequence to RIOT. This would not have arisk model (e.g., systems for affect the assessed fire risk. The assumption that significant impact on the RIOT Program.which cable routing will not be any fire will minimally result in a loss of main There are no systems/components that areperformed) are assumed to be feedwater and subsequent reactor trip likely adds assumed failed in the Internal Fire PRAfailed in the fire -induced risk conservatism to the internal fire PRA results, model that are within the RIOT Program.model. These systems and However, the degree of conservatism is relativelyequipment are failed in the small compared with other modeling uncertainties,worst possible failure mode, since main feedwater will trip for most transientincluding spurious operation. events.It is assumed that any fire will The impact of these assumptions was evaluated by aminimally result in a loss of sensitivity analysis case which concluded that themain feedwater and risk reduction due to crediting all componentssubsequent reactor trip. This is assumed always failed was small.a simplifying and conservativeassumption and is typical ofinternal fire PRA s. However, itmay not be true for all fires.It is assumed that the Reactor RPS design is sufficiently fail-safe and redundant to It is a realistic assumption and is of lowProtection System (RPS) preclude fire -induced failure to scram: Consistent consequence to RIOT. This would not have adesign is sufficiently fail-safe with the guidance in NUREG/CR-6850 (Reference significant impact on the RIOT Program. Theand redundant to preclude fire 11 ) Section 2.5.1, types of sequences that can low frequency of a fire occurring coincident-induce failure to scram, or generally be eliminated from consideration in internal with the low probability of independent failurerandom failure to scram during fire PRA include sequences for which a low to scram results in a negligible contribution toa fire event, as a risk frequency argument can be made, and use ATWT as fire risk.significant contributor, a specific example, because fire -induced failures willalmost certainly remove power from the control rods,resulting a trip, rather than cause a "failure to scram"condition._____________________13-19 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key AssumptionslSources of Uncertainty Impactincl Confiauration Risk CalculationsAssumption / Uncertainty Discussion Disposition for RICTProperly sized and coordinated Electrical protection design calculations provide the It is a realistic assumption and is of lowelectrical protective devices documentation of the electrical coordination between consequence to RIOT. Electrical coordinationare assumed to function within overcurrent protective devices. An evaluation was will either be established or recoverytheir design tripping performed to assess the internal fire PRA power procedures will be implemented to correct thecharacteristics, thus preventing supply coordination requirements in accordance with coordination.initiation of secondary fires NUREG/CR-6850, and provides a link to relevantthrough circuit faults created PVNGS electrical coordination calculations thatby the initiating fire. demonstrate selective tripping capability for eachcredited internal fire PRA power supply (Reference11 of this Attachment). When selective trippingcannot be demonstrated, the internal fire PRA modelwill credit recovery procedures planned to correct the_____________________coordination._____________________13-20 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty IDiscussion JDisposition for RICTIt is assumed that internal firePRA targets were assigned theappropriate radiant heat fluxdamage and temperaturedamage criteria depending onthe cable insulation informationavailable. In other words, allraceways containing cableswith thermoplastic or unknowncable insulation were assigneda radiant heat flux damagethreshold of 6 kW/m2 and 205DC. All raceways containingcables with thermosetinsulation only may beassigned a radiant heat fluxdamage threshold of 11 kW/m2and 330 00, but have beeninitially assigned thethermoplastic damagethresholds.All raceways containing cables were assigned aradiant heat flux damage threshold of 6 kW/m2 and205 00. Raceways containing cables with thermosetinsulation only may be assigned a radiant heat fluxdamage threshold of 11 kW/m2 and 330 0C, but havebeen initially assigned the thermoplastic damagethresholds. A brief review of the dominant scenariosidentified the existence of thermoplastic insulatedcables within the target raceways.It is a realistic assumption and is of lowconsequence to RIOT. It was concluded thatminimal benefit could be obtained by furtheranalysis to identify and model racewayscontaining only thermoset insulation.13-2 1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesTable A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk CalculationsAssumption I Uncertainty Discussion Disposition for RICTPlanned plant modifications This approach introduces uncertainty in the results This assumption that the planned plantand recovery actions are because the actual modifications may vary from modifications will be installed andassumed in the base case those assumed or they may not function as modeled. tested/operated as assumed in the Internalmodel. These modeled The assumed modifications are documented in the Fire PRA model has significant impact on themodifications are assumed to internal fire PRA studies. Plant and model RICT Program. The assumption is realisticcorrect the fire vulnerability configuration and control mechanisms are in place to since the PRA analysis will provide details toand not introduce any new ensure that the Internal Fire PRA model will be the design modifications group in developingfailure modes. updated to correct the as-installed modifications, the plant modifications and procedures. TheOne specific planned plant modification is the PRA model will reflect the as-built/as-installation of an additional Steam Generator operated plant configuration prior tomakeup capability in each unit to address internal implementation of the RIOT Program,fire PRA risk. A sensitivity was performed that including the installation of an additionalremoves this modification from the model Steam Generator makeup capability in eachunit.13-22 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesReferences1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAGNo. MD4995), ML071200238,dated May 17, 20072. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy ofProbabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March20093. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release FrequencyProbabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February20094. NUREG-1 855, Guidance on the Treatment of Uncertainties Associated with PRAs inRisk-Informed Decision Making, March 20095. EPRI TR-1 016737, Treatment of Parameter and Model Uncertainty for Probabilistic RiskAssessments, December 20086. WCAP-1 5749, Guidance for the Implementation of the CEOG Model for Failure of RCPSeals Given Loss of Seal Cooling, Revision 0, December 20087. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Eventsat U.S. Commercial Nuclear Power Plants, January 20078. NUREG-1 829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies through theElicitation Process, Draft9. NUREG/CR-INEEL/EXT 04-0236, Evaluation of Loss of Offsite Power Events at NuclearPower Plants: 1 986-2003 (Draft), October 200410. Westinghouse Calculation Note CN-RAM-1 2-022, Revision 1, Palo Verde SeismicProbabilistic Risk Assessment -Quantification, dated December 2, 201311. NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, September 200513-23 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 14Program Implementation EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesProgram ImplementationIntroductionSection 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A requires that the license amendment request (LAR) provide a description of theimplementing programs and procedures regarding the plant staff responsibilities for the RMTSimplementation, and specifically discuss the decision process for risk management action(RMA) implementation during a Risk-Informed Completion Time (RICT). This attachmentprovides the required description.RICT Progqram ProceduresA procedure will be developed to outline the requirements and responsibilities for the RICTProgram. It will provide guidance on departmental responsibilities and management authorityfor RICT Program application, and for required training, implementation, and monitoring of theRICT Program, including development and maintenance of the Configuration RiskManagement Program (CRMP) software tool and model reflecting the as-built, as-operatedplant.The RICT Program will be implemented by site procedures, which will fully address allaspects of the guidance of NEI 06-09-A. Operations, specifically the control room staff, isresponsible for compliance with Technical Specifications (TS) requirements, and will beresponsible for implementation Of a RICT and any RMAs determined to be appropriate for theplant configuration. Use of a RICT and associated RMAs will be approved by the PlantManager prior to entering an extended completion time (CT) for pre-planned activities. Foremergent conditions requiring an extended CT, the use of the RIOT program will beapproved by the applicable Operation's Shift Manager or Plant Manager.PVNGS Procedure 02DP-9RS01, Operational Risk Management, (Reference 2 of thisAttachment) addresses existing site controls for risk management during equipment outages.This procedure will be supplemented to address the additional guidance of NEI 06-09-A fordetailed implementation of the RICT Program. It will provide guidance to PVNGS personnelon the following topics:* Performing a Tier 2 assessment for a RICT prior to entry into the TS Limiting Conditionof Operation (LCO)* Plant conditions for which the RICT Program is applicable* Conditions under which a RICT may not be used, or may not be voluntarily entered forthe calculation of RICTs and RMA Times (RMATs).* Implementation of RICT Program front stops and 30-day back stop limit* Plant configuration changes, i.e., recalculating the RICT and RMAT within the lesser ofthe affected RA completion time or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of any change.* Conditions for exiting a RICTo Requirements to identify and implement RMAs when the RMAT is exceeded or isanticipated to be exceeded in accordance with PVNGS Protected Equipment procedure,40DP-9AP21, and NEI 06-09-A14-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Times* The use of RMAs, including the conditions under which they may be credited in RIOTcalculations* Crediting probabilistic risk assessment (PRA) functionality* Approval processes for use of a RIOT* Determining PRA availability from detailed PRA functionality characteristics for eachTechnical Specification LCO* A RIOT cannot be entered if PRA functionality must be lost in order to restore the LCO* Determining PRA availability of degraded SSCs consistent with NEI 06-09* Oases where ODE and/or LERF exceed 1 E-3Iyr and/or 1 E-4/yr as delineated in NEI 06-09* Analyzing conditions for Common Cause Failures (OCCs), planned and emergentconfigurations, in accordance with NEI 06-09-A and the guidance of Regulatory Guide1.177 (Reference 3 of this Attachment).RIOT Progqram TrainingqThe scope of the training for the RIOT Program will include training on rules and processes forthe new TS program, CRMP software, TS Actions included in the program, and procedures.This training will be conducted for the following PVNGS personnel, as applicable:* Plant General Manager* Selected members of the PVNGS management and supervisory team* Unit Operations Managers* Operations Work Control Managers* Operations Personnel (Licensed and Non-Licensed)* Work Control Manager* Work Control Personnel* Work Week Managers* Operations Training* Nuclear Regulatory Affairs* Selected Maintenance Personnel* Site Engineering* Probabilistic Risk Assessment (PRA) Engineers* Fire Protection Personnel* Other Management (e.g., Outage Management)Training will be carried out in accordance with PVNGS training procedures and processes.These procedures were written based on the Institute of Nuclear Power Operations (INPO)Accreditation (ACAD) requirements, as developed and maintained by the National Academyfor Nuclear Training. PVNGS has planned three levels of training for implementation of theRIOT Program. They are described below:14-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesUser TrainingThis is the most detailed training and is intended for the individuals who will be directlyinvoived in the implementation of the RIOT Program. This level of training includes thefollowing attributes:* Specific training on the revised TS* Record Keeping Requirements* Case Studies* Hands-on time with the CRMP tool calculating a RMAT and RIOT* Identifying appropriate RMAs* Determining PRA Functionality* Other detailed aspects of the administration and deployment of the RIOT ProgramManagement TrainingThis training is applicable for supervisors, managers, and other personnel who need abroad understanding of the RIOT Program. It is significantly more detailed than SiteAwareness Training (described below), but it is different from User Training in thathands-on time with the ORMP tool and case studies are not included. The concepts ofthe RIOT Program will be taught, but this group of personnel will not be qualified toperform the tasks for actual implementation of the RIOT Program.Site Awareness TrainingThis training is intended for the remaining personnel who require an awareness of theRIOT Program. These employees need basic knowledge of RIOT Programrequirements and procedures. This training will address RIOT Program concepts thatare important to disseminate throughout the organization. Training will include a sitewide communication plan for the RIOT program coordinated through the PVNGSCommunications Department.References1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TACNo. MD4995), ML071 200238, dated May 17, 20072. PVNGS Procedure 02DP-9RS01 Operational Risk Management, Rev 13. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-In formed Decision Making:Technical Specifications, Revision 1, May 201114-3 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 15Monitoring Program EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesMonitoring ProgramSection 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A requires that the license amendment request (LAR) provide a description of theimplementation and monitoring program as described in Regulatory Guide (RG) 1.174, AnApproach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, (Reference 2 of this Attachment) andNEI 06-09-A. (Note that RG 1.174, Revision 2 (Reference 3 of this Attachment), issued by theNRC in May 2011, made editorial changes to the applicable section referenced in the NRCsafety evaluation for Section 4.0, Item 12.)This attachment provides a description of the process applied to monitor the cumulative riskimpact of implementation of the Risk-Informed Completion Time (RICT) Program, specificallythe calculation of cumulative risk of extended Completion Times (CTs). Calculation of thecumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 ofSection 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Programfor risk-informed applications are discussed in RG 1.174, Element 3.The calculation of cumulative risk impact is required by the RICT Program at least everyrefueling cycle, not to exceed 24 months, consistent with the guidance in NEl 06-09, Revision0. For the assessment period evaluated, data is collected for the risk increases associatedwith each application of the RICT Program for both core damage frequency (CDF) and largeearly release frequency (LERF), and the total risk calculated by summing the contributors torisk associated with each RICT application. This is the change in CDF or LERF above thezero maintenance baseline levels while a RICT was in effect (i.e., beyond the front-stop CT).The change in risk is converted to an average annual value.The total average annual change in risk for extended CTs is compared to the guidance of RG1.174, Figures 4 and 5 for CDF and LERF changes, respectively. If the actual annual riskincrease is acceptable (i.e., not in Region I of the figures), then RICT Programimplementation is acceptable for the assessment period. Otherwise, further assessment ofthe cause of exceeding the RG 1.174 guidance and implementation of any necessarycorrective actions to ensure future plant operation is within the guidance is conducted underthe site Corrective Action Program.The assessment will identify areas for consideration during the evaluation, including, asexamples:* Those SSCs where the application of a RICT dominated the risk increase* Contributions from planned vs. emergent RICT applications* Risk management actions (RMAs) implemented but not credited in the riskcalculations* Offset risk due to RICT application by avoiding multiple shorter outages* Reductions in risk levels through improvements in SSC availability and reliability due todifferent maintenance strategies and the operational flexibility made possible through theRICT Program15-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesBased on the evaluation, any necessary corrective actions determined to be appropriate aredeveloped and approved by the Plant General Manager or Unit Operations Manager. Thesemay include:* Administrative restrictions on the use of RIOTs for specific high-riskconfigurations based on instantaneous risk levels* Additional RMAs for specific high-risk configurations* Rescheduling planned maintenance activities* Deferring planned maintenance to shutdown conditions* Use of temporary equipment to replace out-of-service systems, structures orcomponents (SSCs)* Plant modifications to reduce risk impact of expected future maintenanceconfigurationsIn addition to the cumulative impact of RICT Program implementation, the unavailability ofSS~s is also potentially impacted. The existing Maintenance Rule (MR) monitoring programsunder 10 CER 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailabilityimpacts that may be incurred by implementation of the RIOT Program. The use of the MRProgram is acceptable since the SSCs in the scope of the RIOT Program are also in thescope of the MR. Using the existing MR monitoring for this program is explicitly discussed inRG 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: TechnicalSpecifications, (Reference 4 of this Attachment), Section 3.2, "Maintenance Rule Control."The monitoring program for the MR, along with the specific assessment of cumulative riskimpact described above, serves as the "Implementation and Monitoring Program," definedas Element 3 of RG 1.174 for the RIOT Program.References1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NE!) Topical Report (TR) NEI 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(TAO No. MD4995), ML071 200238, dated May 17, 20072. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1,November 20023. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 20114. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making:Technical Specifications, Revision 1, May 201115-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesATTACHMENT 16Risk Management Action Examples EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesRisk Management Action ExamplesIntroductionSection 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) forNEI 06-09-A requires that the license amendment request (LAR) provide a description of theprocess to identify and provide compensatory measures and risk management actions (RMAs)during extended Completion Times (CTs), including specific examples.This attachment describes the process for identification of RMAs applicable during extendedCTs and provides examples of RMAs. RMAs will be governed by plant procedures for planningand scheduling maintenance activities. This procedure will provide guidance for thedetermination and implementation of RMAs when entering the Risk-Informed Completion Time(RICT) Program and is consistent with the guidance provided in NEI 06-09-A.ResponsibilitiesWork Planning / Work Management is responsible for identifying the need for RMAs for plannedwork and Operations is responsible for identifying the need for RMAs for emergent work.Operations, PRA and Fire Protection are responsible for developing the RMAs. Operations isresponsible for implementation of RMAs.Procedural GuidanceFor planned maintenance activities, implementation of RMAs will be required if it is anticipatedthat the risk management action time (RMAT) will be exceeded. The RMAs are implemented atthe earliest possible time, without waiting for the actual RMAT to be exceeded as appropriate forthe situation. For emergent activities, RMAs must be implemented if the RMAT is reached. Also,if an emergent event occurs, requiring recalculation of a RMAT already in place, the procedurerequires a re-evaluation of the existing RMAs for the new plant configuration to see if new RMAsare appropriate. These requirements of the RICT Program are consistent with the guidance ofNEI 06-09-A.RMAs are put in place no later than the point at which the incremental core damage probability(ICDP) of 1 E-6 is reached, or no later than the point at which an incremental large early releaseprobability (ILERP) of 1E-7 is reached. If as the result of an emergent event, the instantaneouscore damage frequency (CDF) or the instantaneous large early release frequency (LERF)exceeds 1 E-3 or 1 E-4 per year, respectively, RMAs are also required to be implemented. Theserequirements are consistent with the guidelinies of NEI 06-09-A.By determining which structures, systems, or components (SSCs) are most important from aCDF and/or LERF perspective for a specific plant configuration, RMAs may be created toprotect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to theconfiguration-specific CDF and/or LERF allows development of RMAs that enhance the plant'scapability to mitigate such events. System-specific Configuration Risk Management SystemGuidelines (CRMSGs) will be developed that will define the risk role of plant systems within thescope of the RICT Program, identify SSCs explicitly modeled in the system, and identify the key16-1 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion TimesSSC failure modes for equipment explicitly modeled. Approved system-specific RMAs will becontained in the CRMSGs and be available in each unit Control Room.It is possible to credit RMAs in the RICT calculations, but such quantification of RMAs is notrequired by NEI 06-09-A. Crediting RMAs in the RICT calculations is only done consistent withthe guidance of NEI 06-09-A.NEI 06-09-A classifies RMAs into three categories, as described below:1) Actions to increase awareness and control* Shift brief* Pre-job brief* Training (formal or informal)* Presence of system engineer or other expertise related to maintenance activity* Special purpose procedure to identify risk sources and contingency plans2) Actions to reduce the duration of maintenance activities* Pre-staging materials* Conducting training on mock-ups* Performing the activity around the clock* Performing walk-downs on the actual system(s) to be worked on prior to beginning work3) Actions to minimize the magnitude of the risk increase* Suspend/minimize activities on redundant systems* Suspend/minimize activities on other systems that adversely affect the CDF and/orLERF* Suspend/minimize activities on systems that may cause a trip or transient to minimizethe likelihood of an initiating event that the out-of-service component is meant to mitigate* Use temporary equipment for backup power* Use temporary equipment for backup ventilation* Reschedule other maintenance activitiesExamples of RMAs that may be considered during a RICT Program entry for a diesel generator(DG) or a battery to reduce the risk impact and ensure adequate defense-in-depth are:A. Diesel Generator1) The condition of the offsite power supply, switchyard, and the grid is evaluated prior toentering a RICT, and RMAs as identified below are implemented, particularly duringtimes of high grid stress conditions, such as during high demand conditions.2) Deferral of switchyard maintenance, such as deferral of discretionary maintenance onthe main, auxiliary, or startup transformers associated with the unit.3) Deferral of maintenance that affects the reliability of the trains associated with theoperable DGs.4) Deferral of planned maintenance activities on station blackout mitigating systems, and16-2 EnclosureDescription and Assessment of Proposed Amendment for Risk-Informed Completion Timestreating those systems as protected equipment.5) Contacting the dispatcher on a periodic basis to provide information on the DG statusand the power needs of the facility.B. Battery1) Limit the immediate discharge of the affected battery, if possible.2) Recharge the affected battery to float voltage conditions using a spare battery charger, ifpossible.3) Evaluate the remaining battery capacity and protect its ability to perform its safetyfunction.4) Periodically verify battery float voltage is equal to or greater than the minimum requiredfloat voltage for remaining batteries.References1NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for NuclearEnergy Institute (NE!) Topical Report (TR) NE! 06-09, Risk-Informed TechnicalSpecifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines(TAC No. MD4995), ML071 200238, dated May 17, 200716-3