Revision as of 19:25, 27 January 2019

Text

License Amendment Request Supplement for Risk-Informed Completion Times
	ML17307A188
Person / Time
Site:	Palo Verde
Issue date:	11/03/2017
From:	Lacal M L; Arizona Public Service Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	102-07587-MLL/TNW
	Download: ML17307A188 (309)
	v • d • e

10 CFR 50.90 A member of the STARS Alliance LLC Callaway

Diablo Canyon Palo Verde Wolf Creek Maria L. Lacal Senior Vice President, Nuclear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 Tel 623 393 6491 102-07587-MLL/TNW November 3, 2017 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Dear Sirs:

Reference:

Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 [Agency Documents Access and Management System (ADAMS)

Accession Number ML15218A300]

Subject:

Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Renewed Operating License Nos. NPF-41, NPF-51, NPF-74 License Amendment Request Supplement for Risk-Informed Completion Times

In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), APS submitted in the referenced letter a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.

This license amendment request (LAR) suppl ement replaces information provided in the referenced letter. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, Attachment 3 provides marked up pages of the existing TS Bases to show the proposed changes.

Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in the referenced letter. Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.

102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 2 The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (ADAMS Accession Number ML16300A245) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during th e review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.

APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) - A, Risk-Managed Technical Specifications (RMTS)

Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (ADAMS Accession Number ML12286A322).

Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (ADAMS Accession number ML15127A669) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.

This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR.

APS requests approval of the proposed license amendment within one year, with the amendment being implemented within 180 days of issuance.

In accordance with the PVNGS Quality Assurance Program, the Plant Review Board reviewed and approved this LAR supplement. By copy of this letter, this LAR supplement is being forwarded to the Arizona Radiation Regulatory Agency pursuant to 10 CFR 50.91(b)(1).

Should you have any questions concerning the content of this letter, please contact Matthew S. Cox, Licensing Section Leader, at (623) 393-5753.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on ___November 3, 2017_______ (Date)

Sincerely,

MLL/TNW/NTA 102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 3

Enclosure:

Description and Assessment of Proposed Amendment for Risk-Informed Completion Times cc: K. M. Kennedy NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS M. M. Watford O'Banion NRC NRR Project Manager C. A. Peabody NRC Senior Resident Inspector for PVNGS T. Morales Arizona Radiation Regulatory Agency (ARRA)

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times i Table of Contents

1.0 DESCRIPTION

2.0 ASSESSMENT

3.0 REGULATORY SAFETY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

ATTACHMENTS:

1. Proposed Technical Specification Changes (Mark-up) 2. Revised Technical Specification Pages (Clean Copy) 3. Technical Specification Bases Changes (Mark-up) 4. License Conditions and Regulatory Commitment 5. List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions 6. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 7. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 8. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models 9. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) 10. Justification of Application of At-Power PRA Models to Shutdown Modes 11. Probabilistic Risk Assessment Model Update Process 12. Attributes of the Configuration Risk Management Program Model 13. Key Assumptions and Sources of Uncertainty 14. Program Implementation 15. Monitoring Program 16. Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 1

1.0 DESCRIPTION

In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) submitted in reference 1, a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3. Reference 2 provided the APS response to a specific information request regarding instrumentation.

This license amendment request (LAR) suppl ement replaces information provided in reference 1. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, Attachment 3 provides marked up pages of the existing TS Bases to show the proposed changes.

Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1. Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.

The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (Reference 5) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during the review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.

APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) -

A, Risk-Managed Technical Specifications (RMTS) Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (References 4 and 6). Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (Reference 3) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.

The LAR supplement involves TS completion times (CT) for required actions (RA) to provide the option to calculate a RICT. A new program, the risk informed completion time program , is added to TS Section 5, Administrative Controls. In addition as described in section 2.3 of this enclosure, this enclosure includes the addition of a license condition, to address the scope of the probabilistic risk assessment (PRA) methods approved by the NRC staff for use in the PVNGS RICT program. Additionally, APS Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 2 requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.

2.0 ASSESSMENT

2.1 Applicability

of Published Safety Evaluation APS reviewed the safety evaluation for NEI 06-09-A (Ref erence 4), and the safety evaluation for the lead plant for risk-informed completion times (Reference 3) and concluded that they are applicable to PVNGS Units 1, 2, and 3.

2.2 Verifications

and Regulatory Commitments The following attachments are provided in accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A (Reference 4):

Attachment 4 to this enclosure lists the APS license conditions and regulatory commitment regarding changes necessary to support implementation of RICT.

to this enclosure identifies each of the TS required actions (RA) to which the RICT program will apply, with a comparison of the TS functions to the functions modeled in the PRA of the structures, systems and components (SSC) subject to those actions.

Attachment 6 to this enclosure provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT program, as required by regulatory guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009, Section 4.2.

Attachment 7 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC. Attachment 8 to this enclosure provides appropriate justification for excluding sources of risk not addressed by the PRA models.

to this enclosure provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

Attachment 10 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC. Attachment 11 to this enclosure provides a discussion of the programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

Attachment 12 to this enclosure provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified for use in the configuration risk management program (CRMP) to assess real-time configuration risk, and describes the scope of and quality controls applied to the CRMP.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 3 Attachment 13 to this enclosure provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified for this LAR, and how their impact on the RICT program was assessed and evaluated.

Attachment 14 to this enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including risk management action (RMA) implementation.

Attachment 15 to this enclosure provides a description of the monitoring program as described in NEI 06-09-A (Reference 4).

Finally, attachment 16 to this enclosure provides a description of the process to identify RMAs and includes specific examples of RMAs.

2.3 Proposed

Technical Specification and License Condition Changes APS proposes the addition of the following conditions to the PVNGS renewed operating licenses of Units 1, 2, and 3 to address the scope of the PRA methods approved by the NRC staff for use in the PVNGS RICT program.

1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.

2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Additionally, APS requests that license conditions implemented by license amendment (LA) numbers 171 and 200 be deleted because these conditions are no longer applicable.

LA number 171 adopted TSTF-448 which provided a schedule for implementation of various control room habitability tests. These tests have been completed therefore this license condition is no longer applicable.

LA number 200 authorized the Unit 3 train B emergency diesel generator (EDG) extended required action completion time which is no longer applicable.

APS proposes certain changes to the original LAR (Reference 1). These proposed differences between the PVNGS original LAR and this LAR supplement are provided in Table 1 - Supplement Summary Table.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 4 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 1 1.3 Completion Times Changes to the example in TS section 1.3 reflect a loss of function similar to the RICT lead plant submittal.

2 3.3.4 Reactor Protective System (RPS) Logic and Trip Initiation This LCO is no longer included in the RICT LAR supplement, primarily since it is not modeled in PRA. This is consistent with how it was communicated to the NRC in reference 2.

3 3.3.6 Engineered Safety Features Actuation System (ESFAS)

Logic and Manual Trip This LCO is included in the RICT LAR supplement, with changes:

Condition A (matrix logic) is no longer included since it is not modeled in PRA.

Condition B is being kept (one channel of manual trip or ESFAS initiation logic).

Condition C is no longer included (loss of function for instrumentation).

Condition D is being kept (one channel of ESFAS actuation logic).

Condition E is no longer included (loss of function for instrumentation).

4 3.4.9 Pressurizer This LCO is no longer included in the RICT LAR supplement since the pressurizer heaters are not modeled in PRA. 5 3.4.10 Pressurizer Safety Valves (PSV) - Modes 1, 2, and 3 This LCO is included in the RICT LAR supplement, similar to the RICT lead plant submittal.

Condition A is for one PSV being inoperable and the appropriate loss of function (LOF) notes have been added.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 5 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 6 3.4.12 Pressurizer Vents This LCO is included in the RICT LAR supplement. The pressurizer vent paths are modeled in the PRA and credited in the PVNGS safety analysis for the steam generator tube rupture event as described in updated final safety analysis report (UFSAR) section 15.6.3. The pressurizer vent TS at PVNGS has similarities to the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed in the RICT lead plant submittal:

Condition A for two or three vents paths is being kept.

Condition B for all vents paths inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the last pressurizer vent path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the last pressurizer vent path, as opposed to all vent paths, that renders the RICT not applicable.

7 3.5.1 Safety Injection Tanks (SIT) - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal Accumulator TS:

Condition A for a SIT inoperable due to boron concentration not within limits is no longer in RICT scope since it is a parameter.

Condition B for one SIT inoperable for reasons other than boron is also not in scope since the loss of a SIT is a loss of function condition which would be limited to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and PVNGS already has a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time.

Condition C for two or more SITs being inoperable for reasons other than boron is being kept similar to the RICT lead plant submittal approval. This is a loss of function condition with the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent SIT, as opposed to two or more SITs, intentionally made inoperable that render the condition being not applicable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 6 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 8 3.5.3 ECCS - Operating This LCO is included in the RICT LAR supplement but has changes:

Condition A for one low pressure safety injection (LPSI) subsystem inoperable is kept. The RICT lead plant submittal did not have this condition in their TS.

Condition B is kept but has changes. This is for one or more ECCS trains being inoperable AND at least 100% of the flow equivalent to one train being available. The portion after the AND is now kept in the TS similar to the RICT lead plant submittal to ensure it is not a loss of function.

Condition C is no longer included since it is only for less than 100% of flow available.

9 3.5.5 Refueling Water Tank (RWT) This LCO is included in the RICT LAR supplement but has changes:

Condition A for the RWT being inoperable for boron or temperature not within limits is no longer in the RICT scope since they are parameters.

Condition B for the RWT being inoperable for reasons other than Condition A is being kept. It is a loss of function and all appropriate notes have been added, this is similar to the RICT lead plant submittal. 10 3.6.2 Containment Air Locks This LCO is included in the RICT LAR supplement without any changes:

Only Condition C is in the scope of RICT and is for the airlock being inoperable for reasons other than Condition A (one door in the airlock inoperable) or B (interlock mechanism inoperable). There is already a required action in Condition C to evaluate overall containment leakage rate is per TS 3.6.1 so this is not a loss of function condition, this is similar to the RICT lead plant submittal.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 7 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 11 3.6.3 Containment Isolation Valves (CIVs) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one CIV inoperable is being kept.

Condition B for two CIVs in the same penetration is being kept and the appropriate LOF notes have been added. The wording of note 2 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CIV is intentionally made inoperable since this condition is part of the current licensing basis. Also, the wording was changed to be more precise that it is the second CIV, as opposed to the first two CIVs, that renders the RICT not applicable.

Condition C for one CIV inoperable in penetrations with only one CIV and a closed system inside containment is being kept. This is not a loss of function condition due to the closed system inside containment.

Condition D for one or more containment purge (CP) valves having leakage above their limit is being kept in RICT scope. The loss of function notes have been added with a clarifier that the notes only apply when there is a loss of function condition since if there is one CP valve operable, it would not be a loss of function condition. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CP valve is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second CP valve, as opposed to the first two, that renders the RICT not applicable. 12 3.6.6 Containment Spray System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one train of containment spray is being kept within the RICT scope.

Condition C for two trains is no longer included. 13 3.7.2 Main Steam Isolation Valves (MSIVs) This LCO is included in the RICT LAR supplement but has changes:

Condition F for one MSIV inoperable in MODE 1 is being kept with no changes.

Condition G for more than one MSIV inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was changed to be more precise that it is the second or a subsequent MSIV, as opposed to two or more MSIVs, intentionally made inoperable that render the condition being not applicable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 8 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 14 3.7.3 Main Feedwater Isolation Valves (MFIVs) This LCO is included in the RICT LAR supplement but has changes. The MFIVs are modeled in the PRA and credited in the safety analysis to close during a steam line break and a feedwater line break:

Condition A for one or more MFIVs inoperable is being kept.

Condition B for two valves in the same flow path is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second valve in the affected flow path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second valve in the affected flow path, as opposed to the first two, that renders the RICT not applicable. 15 3.7.4 Atmospheric Dump Valves (ADVs) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

Condition A is being kept for one ADV (per SG) without any changes.

Condition B is being kept but has a clarifier on the applicability of the loss of function notes since if one ADV is operable (with as many as three being inoperable) it is not a loss of function. With all four ADVs inoperable, it is a loss of function condition. The wording of note 1 was changed to be more precise that it is the last ADV, as opposed to all ADVs, intentionally made inoperable that renders the condition not applicable. 16 3.7.5 Auxiliary Feedwater (AFW) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one steam supply inoperable is being kept.

Condition B for one AFW train inoperable for reasons other than condition A is being kept.

Condition C for two AFW trains inoperable is being kept. It is a loss of function condition that has the appropriate notes added along with a clarifier since if one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function. The wording of note 1 was changed to be more precise that it is the second AFW train, as opposed to two AFW trains, being inoperable that renders the condition not applicable. 17 3.7.6 Condensate Storage Tank (CST) This LCO is no longer included in the RICT LAR supplement primarily since it is a single train system that was not within the RICT lead plant submittal.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 9 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 18 3.7.7 Essential Cooling Water (EW) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one train of EW inoperable is being kept.

Condition B for two trains of EW inoperable is being kept but is a loss of function condition that has the appropriate notes added. 19 3.7.8 Essential Spray Pond System (ESPS) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one train of ESPS inoperable is being kept.

Condition B for two trains of ESPS inoperable is being kept but is a loss of function condition that has the appropriate notes added. 20 3.7.9 Ultimate Heat Sink (UHS) This LCO is no longer included in RICT LAR supplement, primarily since it is a single train system. 21 3.7.10 Essential Chilled Water (EC) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:

Condition A for one train of EC inoperable is being kept.

Condition B for two trains of EC inoperable is being kept but is a loss of function condition that has the appropriate notes added. 22 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS) This LCO is no longer included in the RICT LAR supplement, primarily since Condition A for one train inoperable already allows 30 days to restore and Condition B for two trains inoperable was not within the RICT lead plant submittal.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 10 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 23 3.8.1 AC Sources - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

Condition A for one offsite circuit inoperable is being kept without changes.

Condition B for one diesel generator (DG) inoperable is being kept without changes. The Note above the 10 day Completion Time regarding License Amendment 200 is being deleted since it is no longer applicable.

Condition C for two offsite circuits inoperable is being kept without changes.

Condition D for one offsite circuit and one DG inoperable stays without changes.

Condition E for two DGs inoperable is being kept but has loss of function notes added. Note 1 was modified to be more precise that it is the second diesel generator, not two diesel generators, that renders the condition not applicable.

Condition F for one DG Sequencer inoperable is being kept without changes.

Old Condition I for three or more required alternate current (AC) sources inoperable is being kept in the RICT scope but changes to be a loss of function and designate it as new condition H. The wording of note 1 was changed to be more precise in that it is the third or a subsequent required AC source, as opposed to three or more required AC sources, intentionally made inoperable that renders the condition being not applicable.

24 3.8.4 DC Sources - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:

Condition A for one battery charger on a subsystem inoperable is being kept in RICT scope. However, required Action A.1 for restoring the battery terminal voltage to greater than minimum float voltage is no longer included in the RICT scope because it is a parameter. Only required action A.3 for restoring the battery charger to operable status stays.

Condition B for one direct current (DC) electrical power subsystem being inoperable for reasons other than Condition A is being kept.

Condition C for two DC electrical subsystems being inoperable is being kept but is a loss of function condition that has all of the appropriate LOF notes added. The wording on note 1 was changed to be more precise that it is the second DC electrical subsystem, not two DC electrical subsystems, intentionally made inoperable that renders the condition being not applicable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 11 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 25 3.8.7 Inverters - Operating This LCO is included in the RICT LAR supplement but has changes:

Condition A for one inverter being inoperable is being kept.

Condition B for two or more inverters being inoperable stays in scope but has a clarifier since this condition does not always result in a loss of function. PVNGS design has two trains of inverters with a total of four inverters channels A, B, C and D. Channels A and C are train A. Channels B and D are train B. If two inverters in the same train are inoperable and the other two inverters on the opposite train remain operable, it is not a loss of function. The wording of note 1 was changed to be more precise that it is the second or a subsequent required inverter, as opposed to two or more required inverters, intentionally made inoperable that renders the Condition being not applicable. 26 3.8.9 Distribution Systems - Operating This LCO is included in the RICT LAR supplement but has changes:

Condition A for one AC electrical power distribution subsystem being inoperable is being kept.

Condition B for one AC vital instrument bus being inoperable is being kept.

Condition C for one DC electrical power distribution subsystem is being kept

New Condition D for two or more electrical power distribution subsystems being inoperable is being kept in scope but is a loss of function condition and has the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent electrical power distribution subsystem, as opposed to two or more electrical power distribution subsystems, intentionally made inoperable that renders the Condition being not applicable. 27 5.5.20 Risk-Informed Completion Time Program The TS program for risk informed completion time is included with changes to coincide with the TS program language from the RICT lead plant with minor changes. Editorial changes were made on the pages for the Battery Monitoring Program of TS 5.5.19 to eliminate reference to the SFP Transition.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 12 3.0 REGULATORY SAFETY ANALYSIS APS has evaluated the proposed change to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.

APS requests adoption of the proposed changes to the TS and plant specific TS, to modify the TS requirements related to completion times for required actions to provide the option to calculate RICT based on risk levels a ssociated with equipment determined to be inoperable that are within the scope of the RICT program. The allowance is described in a new program in TS Section 5, Administrative Controls, entitled Risk Informed Completion Time Program. The proposed RICT program conforms to the NRC model safety evaluation, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, dated May 17, 2007 (References 4 and 6).

Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1.

As required by 10 CFR 50.91(a), Notice for Public Comment, an analysis of the issue of no significant hazards consideration was provided in the original license amendment request. This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR (Reference 1).

4.0 ENVIRONMENTAL CONSIDERATION

APS has reviewed the environmental evaluation included in the model safety evaluation published on March 15, 2012, as part of the Notice of Availability (77 FR 15399). APS has concluded that the NRC staff findings presented in that evaluation are applicable to PVNGS.

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, Standards for Protection Against Radiation, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review. Therefore, pursuant to 10 CFR 51.22, no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 13

References:

1. Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 (ADAMS Accession Number ML15218A300)

2. APS Letter 102-07227, Response to Request for Additional Information Regarding License Amendment Request to Adopt TSTF-505, dated April 11, 2016 (ADAMS Accession Number ML16102A463)

3. Vogtle Electric Generating Plant Units 1 and 2 - Issuance of Amendments Regarding implementation of Topical Report Nuclear Energy Institute NEI 06-09, " Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specification (RMTS) Guidelines," Revision 0-A, dated August 8, 2017 (ADAMS Accession Number ML15127A669)

4. Nuclear Energy Institute (NEI) 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines (NEI 06-09-A), dated November 13, 2006 (ADAMS Accession Number ML12286A322)

5. Issues with Technical Specification Task Force Traveler TSTF-505, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4 B, dated November 15, 2016 (ADAMS Accession Number ML16300A245)

6. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-informed Technical Specifications initiative 4B, Risk-Managed Technical Specifications (RMT) Guideline (TAC NO. MD4995), dated May 17, 2007 (ADAMS Accession Number ML071200238)

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 1 Proposed Technical Specification Changes TS Mark-up Pages 1.3-13 3.7.7-1 3.3.6-1 3.7.8-1 3.3.6-2 3.7.10-13.4.10-1 3.8.1-2 3.4.12-1 3.8.1-3 3.5.1-1 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.4-1 3.6.2-3 3.8.7-1 3.6.3-1 3.8.7-2 3.6.3-2 3.8.9-1 3.6.3-3 3.8.9-2 3.6.3-4 5.5-19 3.6.6-1 5.5-19a 3.7.2-2 3.7.3-1 3.7.4-1 3.7.5-1 3.7.5-2

Completion Times 1.3 1.3 Completion Times ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 1.3-13 AMENDMENT NO. 117 EXAMPLES EXAMPLE 1.3-7 (continued) The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time

Condition A was initially entered. If Required Action A.1

is met after Condition B is entered, Condition B is exited

and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired. ______________________________________________________________________________ IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a controlled manner.

Insert1 INSERT 1 (1.3-13) EXAMPLES EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem inoperable. A.1 Restore subsystem to OPERABLE status.

7 days OR In accordance with the Risk

Informed Completion Time

Program B. ------NOTES------

1. Not applicable when second

subsystem

intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. --------------

Two subsystems inoperable. B.1 Restore at least one subsystem to OPERABLE

status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program C. Required Action and associated

Completion Time not met. C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours When a subsystem is declared inoperable, Condition A is entered.

The 7 day Completion Time may be applied as discussed in Example

1.3-2. However, the licensee may elect to apply the Risk

Informed Completion Time Program which permits calculation of a

Risk Informed Completion Time (RICT) that may be used to

complete the Required Action beyond the 7 day Completion Time.

INSERT 1 (1.3-13 continued)

The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status

within the RICT or Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two Notes. The

first note states it is not applicable if the second subsystem

is intentionally made inoperable. The second Note provides

restrictions applicable to these "loss of function" Conditions.

The Required Actions of Condition B are not intended for

voluntary removal of redundant subsystems from service. The

Required Action is only applicable if one subsystem is

inoperable for any reason and the second subsystem is found to

be inoperable, or if both subsystems are found to be inoperable

at the same time. If Condition B is applicable, at least one

subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or

Condition C must also be entered. The licensee may be able to

apply a RICT or to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but

not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the requirements of the Risk

Informed Completion Time Program are met. If two subsystems are

inoperable and Condition B is not applicable (i.e., the second

subsystem was intentionally made inoperable), LCO 3.0.3 is

entered as there is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned

changes, the revised RICT must be determined prior to

implementation of the change in configuration. For emergent

conditions, the revised RICT must be determined within the time

limits of the Required Action Completion Time (i.e., not the

RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent

changes in plant conditions result in exiting the applicability

of the Risk Informed Completion Time Program without restoring

the inoperable subsystem to OPERABLE status, Condition C is also

entered and the Completion Time clocks for Required Actions C.1

and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable

subsystem has not been restored to OPERABLE status, Condition C

is also entered and the Completion Time clocks for Required

Actions C.1 and C.2 start. If the inoperable subsystems are

restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.

ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2,3 3.3.6-1 AMENDMENT NO. 117

3.3 INSTRUMENTATION

3.3.6 Engineered

Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four

channels of Manual Trip shall be OPERABLE for each Function

in Table 3.3.6-1. APPLICABILITY: According to Table 3.3.6-1.

ACTIONS ------------------------------------NOTE-------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one Matrix Logic

channel inoperable.

OR Three Matrix Logic channels are

inoperable due to a

common power source

failure de-energizing

three matrix power

supplies. A.1 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months B. One or more Functions with one Manual Trip

or Initiation Logic

channel inoperable. B.1 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months (continued)

Insert2 INSERT 2 OR In accordance with the Risk Informed Completion Time Program Reviewers Note:

The "Insert 2" is used repeatedly throughout this package. The insert will not be provided as a separate page every time it is

used. This will be the only time the insert page will follow the

marked-up TS page.

ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2,3 3.3.6-2 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions with two Initiation

Logic channels or

Manual Trip channels

affecting the same

trip leg inoperable. C.1 Open at least one contact in the

affected trip leg of

both ESFAS Actuation

Logics. AND Immediately C.2 Restore channels to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months D. One or more Functions with one Actuation

Logic channel

inoperable.

D.1 --------NOTE---------

One channel of

Actuation Logic may

be bypassed for up to

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for

Surveillances, provided the other

channel is OPERABLE.

Restore inoperable channel to OPERABLE

status. 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months E. Required Action and associated Completion

Time of Conditions for

Containment Spray

Actuation Signal, Main

Steam Isolation Signal

or Auxiliary Feedwater

Actuation Signal not

met. E.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (continued)

Insert2 Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10PALO VERDE UNITS 1,2,33.4.10-1AMENDMENT NO. 117

3.4 REACTOR

COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves - Modes 1, 2 and 3LCO 3.4.10Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.APPLICABILITY:MODES 1, 2, and 3,-----------------------------NOTE----------------------------

The lift settings are not required to be within LCO limits

during MODES 3 and 4 for the purpose of setting the

pressurizer safety valves under ambient (hot) conditions.

This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into

MODE 3 provided a preliminary cold setting was made prior to

heatup.

ACTIONSCONDITIONREQUIRED ACTIONCOMPLETION TIMEA.One p ressurizer safety valve inoperable.A.1Restore valve to OPERABLE status.

15 minutesB.1Be in MODE 3.

AND 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months sB.Required Action and associated Completion

Time not met.

OR Two or more pressurizer safety

valves inoperable.B.2Be in MODE 412 hour0.00477 days 0.114 hours 6.812169e-4 weeks 1.56766e-4 months sInsert2Insert3.

INSERT 3 (3.4.10-1)

NOTES------------------------------

1. Not applicable when pressurizer safety valve intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2,3 3.4.12-1 AMENDMENT NO. 117 , 188 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3.

MODE 4 with RCS pressure 385 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required pressurizer vent paths

inoperable. A.1 Restore required pressurizer vent

paths to OPERABLE status. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. All pressurizer vent paths inoperable. B.1 Restore one pressurizer vent path to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C. Required Action and associated Completion

Time of Condition A, or B not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 4 with RCS pressure < 385 psia.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Insert2Insert2Insert4 INSERT 4 (3.4.12-1)

NOTES------------------------------

1. Not applicable when last pressurizer vent path intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

SITs-Operating 3.5.1 PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 117 , 118 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

3.5.1 Safety

Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due to boron concentration

not within limits.

OR One SIT inoperable due to inability to verify level or pressure. A.1 Restore SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. One SIT inoperable for reasons other than Condition A. B.1 Restore SIT to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C. Required Action and associated Completion

Time of Condition A

or B not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Reduce pressurizer pressure to

< 1837 psia.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months D. Two or more SITs inoperable. D.1 Enter LCO 3.0.3. Immediately Insert5 D D D,B,orC INSERT 5 (3.5.1-1)

C. ----- NOTES -----

1. Not applicable when the second

or a subsequent

SIT intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for

reasons other than

Condition A.

C.1 Restore all but one SIT to OPERABLE

status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program ECCS - Operating 3.5.3 PALO VERDE UNITS 1,2,3 3.5.3-1 AMENDMENT NO. 117 , 124 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS - Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure 1837 psia or with RCS T c 485°F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem inoperable. A.1 Restore subsystem to OPERABLE status.

7 days B. One or more trains inoperable for reasons

other than Condition

A. AND At least 100% of the ECCS flow equivalent

to a single OPERABLE

ECCS train available. B.1 Restore train(s) to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Reduce pressurizer pressure to

< 1837 psia.

AND 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C.3 Reduce RCS T c to < 485°F. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Insert2Insert2 RWT 3.5.5 PALO VERDE UNITS 1,2,3 3.5.5-1 AMENDMENT NO. 117

3.5 EMERGENCY

CORE COOLING SYSTEMS (ECCS)

3.5.5 Refueling

Water Tank (RWT) LCO 3.5.5 The RWT shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron concentration not within limits.

OR RWT borated water temperature not within limits. A.1 Restore RWT to OPERABLE status.

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months B. RWT inoperable for reasons other than

Condition A. B.1 Restore RWT to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours Insert2Insert6 INSERT 6 (3.5.5-1)

NOTES------------------------------

1. Not applicable when RWT is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Containment Air Locks 3.6.2 PALO VERDE UNITS 1,2,3 3.6.2-3 AMENDMENT NO. 117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.1 Verify an OPERABLE door is closed in the

affected air lock.

AND 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months B.2 Lock an OPERABLE door closed in the

affected air lock.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B.3 --------NOTE---------

Air lock doors in

high radiation areas

may be verified

locked closed by

administrative means.

Verify an OPERABLE door is locked closed

in the affected air

lock. Once per 31 days C. One or more containment air locks

inoperable for reasons

other than Condition A

or B. C.1 Initiate action to evaluate overall

containment leakage

rate per LCO 3.6.1.

AND Immediately C.2 Verify a door is closed in the

affected air lock.

AND 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months C.3 Restore air lock to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (continued)Insert2 Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-1 AMENDMENT NO. 117 , 166 3.6 CONTAINMENT SYSTEMS

3.6.3 Containment

Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS -------------------------------------NOTES----------------------------------- 1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls. 2. Separate Condition entry is allowed for each penetration flow path. 3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves. 4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria. 5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in

accordance with SR 3.6.1.1.

CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE---------

Only applicable to

penetration flow paths

with two required

containment isolation

valves.

One or more penetration flow paths

with one required

containment isolation

valve inoperable

except for purge valve

leakage not within

limit. A.1 Isolate the affected penetration flow path

by use of at least

one closed and

de-activated

automatic valve, closed manual valve, blind flange, or

check valve with flow

through the valve

secured. AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (continued) Insert2 Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO. 117 , 166 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------NOTE---------

Isolation devices in

high radiation areas

may be verified by

use of administrative

means.

Verify the affected penetration flow path

is isolated.

Once per 31 days for isolation

devices outside

containment AND Prior to entering MODE 4

from MODE 5 if

not performed

within the

previous 92 days

for isolation

devices inside

containment B. ---------NOTE---------

Only applicable to

penetration flow paths

with two required

containment isolation

valves. ----------------------

One or more penetration flow paths

with two required

containment isolation

valves inoperable

except for purge valve

leakage not within

limit. B.1 Isolate the affected penetration flow path

by use of at least

one closed and

de-activated

automatic valve, closed manual valve, or blind flange.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued) following isolationInsert2 SInsert7 1.

INSERT 7 (3.6.3-2)

2. RICT is not applicable when the second containment isolation valve is intentionally made inoperable.

3. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-3 AMENDMENT NO. 117 , 166 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. ---------NOTE---------

Only applicable to

penetration flow paths

with only one required

containment isolation

valve and a closed

system.

One or more penetration flow paths

with one required

containment isolation

valve inoperable. C.1 Isolate the affected penetration flow path

by use of at least

one closed and

de-activated

automatic valve, closed manual valve, or blind flange.

AND C.2 --------NOTE---------

Isolation devices in

high radiation areas

may be verified by

use of administrative

means. ---------------------

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Verify the affected penetration flow path

is isolated.

Once per 31 days D. One or more penetration flow paths

with one or more

required containment

purge valves not

within purge valve

leakage limits. D.1 Isolate the affected penetration flow path

by use of at least

one closed and

de-activated

automatic valve with

resilient seals, or

blind flange.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (continued) following isolationInsert2Insert2Insert8 INSERT 8 (3.6.3-3)

NOTES------------------------------

1. RICT is not applicable when the second containment purge valve is intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-4 AMENDMENT NO. 117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 --------NOTE---------

Isolation devices in

high radiation areas

may be verified by

use of administrative

means.

Verify the affected penetration flow path

is isolated.

Once per 31 days for isolation

devices outside

containment AND Prior to entering MODE 4

from MODE 5 if

not performed

within the

previous 92 days

for isolation

devices inside

containment AND D.3 Perform SR 3.6.3.6 for the resilient

seal purge valves

closed to comply with

Required Action D.1.

Once per 92 days E. Required Action and associated Completion

Time not met. E.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months following isolation following isolation Containment Spray System 3.6.6 PALO VERDE UNITS 1,2,3 3.6.6-1 AMENDMENT NO. 117

3.6 CONTAINMENT

SYSTEMS

3.6.6 Containment

Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3.

MODE 4 when RCS pressure is 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray train inoperable. A.1 Restore containment spray train to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Required Action and associated Completion

Time of Condition A

not met. B.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 4 with RCS pressure < 385 psia.

84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months C. Two containment spray trains inoperable. C.1 Enter LCO 3.0.3. Immediately Insert2 MSIVs 3.7.2 PALO VERDE UNITS 1,2,3 3.7.2-2 AMENDMENT NO. 1 17 , 163 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV actuator trains

inoperable.

OR Required Action and associated Completion

Time of Condition A, B, or C not met. E.1 Declare each affected MSIV inoperable.

Immediately F. One MSIV inoperable in MODE 1. F.1 Restore MSIV to OPERABLE status.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months G. Required Action and Associated Completion

Time of Condition F

not met. G.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months H. ---------NOTE---------

Separate Condition

entry is allowed for

each MSIV.

One or more MSIVs inoperable in MODE 2, 3, or 4. H.1 Close MSIV.

AND H.2 Verify MSIV is closed. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Once per 7 days I. Required Action and associated Completion

Time of Condition H

not met. I.1 Be in MODE 3.

AND I.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours Insert9 H H I I I J J JInsert2orG I INSERT 9 (3.7.2-2)

G. ----- NOTES -----

1. Not applicable when the second

or a subsequent

MSIV intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two or more MSIVs inoperable in MODE

1.

G.1 Restore all but one MSIV to OPERABLE

status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program MFIVs 3.7.3 PALO VERDE UNITS 1,2,3 3.7.3-1 AMENDMENT NO. 117 158 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs) LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power

operated valve.

ACTIONS -------------------------------------NOTE------------------------------------

Separate Condition entry is allowed for each penetration flow path.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs inoperable. A.1 Close or isolate inoperable MFIV.

AND A.2 Verify inoperable MFIV is closed or

isolated.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Once per 7 days B. Two valves in the same flow path

inoperable. B.1 Isolate affected flow path. AND B.2 Verify inoperable MFIV is closed or

isolated.

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Once per 7 days (continued) Insert10 INSERT 10 (3.7.3-1) A.1 Restore MFIV(s) to OPERABLE status.

OR A.2.1 Close or isolate inoperable MFIV(s). AND A.2.2 Verify inoperable MFIV(s) is closed

or isolated.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Once per 7 days following Isolation B. ----- NOTES ------

1. RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable.

2. The following Section 5.5.20

constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.

Two valves in the same flow path

inoperable.

B.1 Restore one valve to OPERABLE status. OR

B.2.1 Isolate affected flow path.

AND B.2.2 Verify inoperable MFIV(s) is closed

or isolated.

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk Informed Completion Time Program 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Once per 7 days following Isolation

ADVs 3.7.4 PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 165 , 191 (CORRECTEDPAGE)

3.7 PLANT

SYSTEMS

3.7.4 Atmospheric

Dump Valves (ADVs) LCO 3.7.4 Four ADV lines shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------

Separate Condition

entry is allowed for

each SG. --------------------

One required ADV line inoperable. A.1 Restore ADV line to OPERABLE status.

7 days B. Two or more ADV lines inoperable with both

ADV lines inoperable

on one or more SGs. B.1 Restore one ADV line to OPERABLE status on

each SG. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND C.2 Be in MODE 4 without reliance on steam

generator for heat

removal. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 24 hours Insert2Insert11Insert2 INSERT 11 (3.7.4-1)

NOTES------------------------------

1. Not applicable when the last ADV intentionally made inoperable resulting in loss of safety function.

2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.

AFW System 3.7.5 PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. 165, 197

3.7 PLANT

SYSTEMS

3.7.5 Auxiliary

Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.

NOTE----------------------------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS ------------------------------------NOTE-------------------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to turbine driven AFW

pump inoperable.

OR ---------NOTE---------

Only applicable if MODE 2 has not been

entered following

refueling.

One turbine driven AFW pump inoperable in

MODE 3 following

refueling. A.1 Restore affected equipment to OPERABLE

status. 7 days B. One AFW train inoperable for reasons

other than Condition A

in MODE 1, 2, or 3.

B.1 Restore AFW train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (continued) Insert2Insert2 AFW System 3.7.5 PALO VERDE UNITS 1,2,3 3.7.5-2 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion

Time of Condition A

or B not met.

OR Two AFW trains inoperable in

MODE 1, 2, or 3 C.1 Be in MODE 3.

AND C.2 Be in MODE 4.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours D. Three AFW trains inoperable in MODE 1, 2, or 3. D.1 --------NOTE---------

LCO 3.0.3 and all other LCO Required

Actions requiring

MODE changes are

suspended until one

AFW train is restored

to OPERABLE status.

Initiate action to restore one AFW train

to OPERABLE status.

Immediately E. Required AFW train inoperable in MODE 4.

E.1 --------NOTE---------

LCO 3.0.3 and all

other LCO Required

Actions requiring

MODE changes are

suspended until one

AFW train is restored

to OPERABLE status.

Initiate action to restore one AFW train

to OPERABLE status.

Immediately Insert12 D D D,B,orC E E F F INSERT 12 (3.7.5-2)

C. ----- NOTES -----

1. Not applicable when second AFW

train intentionally

made inoperable

resulting in loss

of safety

function.

2. The following Section 5.5.20

constraints are

applicable when

there is a loss

of function:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two AFW trains inoperable in MODE

1, 2, or 3.

C.1 Restore at least one AFW train to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program EW System 3.7.7 PALO VERDE UNITS 1,2,3 3.7.7-1 AMENDMENT NO. 117

3.7 PLANT

SYSTEMS

3.7.7 Essential

Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train inoperable.

A.1 --------NOTE---------

Enter applicable

Conditions and

Required Actions of

LCO 3.4.6, "RCS

Loops - MODE 4" for

shutdown cooling made

inoperable by EW.

Restore EW train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Required Action and associated Completion

Time of Condition A

not met. B.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Insert2Insert13 C C C INSERT 13 (3.7.7-1)

B. ----- NOTES -----

1. Not applicable when second EW

train intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two EW trains inoperable.

B.1 Restore at least one EW train to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program ESPS 3.7.8 PALO VERDE UNITS 1,2,3 3.7.8-1 AMENDMENT NO. 117

3.7 PLANT

SYSTEMS

3.7.8 Essential

Spray Pond System (ESPS) LCO 3.7.8 Two ESPS trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train inoperable.

A.1 --------Notes-------- 1. Enter applicable Conditions and

Required Actions

of LCO 3.8.1.

"AC Sources Operating," for

emergency diesel

generator made

inoperable by

ESPS. 2. Enter applicable Conditions and

Required Actions

of LCO 3.4.6.

"RCS Loops MODE 4," for

shutdown cooling

made inoperable

by ESPS. ---------------------

Restore ESPS train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Required Action and associated Completion

Time of Condition A

not met. B.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C CInsert14 CInsert2 INSERT 14 (3.7.8-1)

B. ----- NOTES -----

1. Not applicable when second ESPS

train intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two ESPS trains inoperable.

B.1 Restore at least one ESPS train to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program EC 3.7.10 PALO VERDE UNITS 1,2,3 3.7.10-1 AMENDMENT NO. 117 , 188 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train inoperable. A.1 Restore EC train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Required Action and associated Completion

Time not met. B.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power operated, and automatic valve in the flow

path, that is not locked, sealed, or

otherwise secured in position, is in the

correct position.

In accordance with the Surveillance

Frequency

Control Program SR 3.7.10.2 Verify the proper actuation of each EC System component on an actual or simulated

actuation signal.

In accordance with the Surveillance

Frequency

Control Program Insert15 C C CInsert2 INSERT 15 (3.7.10-1)

B. ----- NOTES -----

1. Not applicable when second EC

train intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two EC trains inoperable.

B.1 Restore at least one EC train to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-2 AMENDMENT NO. 164, 197 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required offsite circuit to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. One DG inoperable. B.1 Perform SR 3.8.1.1 for the OPERABLE

required offsite

circuit(s).

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required feature(s) supported

by the inoperable DG

inoperable when its

redundant required

feature(s) is

inoperable.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from discovery of

Condition B

concurrent with

inoperability of

redundant

required feature(s) AND B.3.1 Determine OPERABLE DG is not

inoperable due to

common cause failure.

OR 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B.3.2 Perform SR 3.8.1.2 for OPERABLE DG.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months AND (continued) Insert2 AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO. 197, 200 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG to OPERABLE

status. -------NOTE------

For the Unit 3

Train B DG failure

on December 15, 2016, restore the

inoperable DG to

OPERABLE status

within 62 days.

10 days C. Two required offsite circuits inoperable. C.1 Declare required feature(s)

inoperable when

its redundant

required feature(s) is

inoperable.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from discovery of

Condition C

concurrent with

inoperability of

redundant required

feature(s) AND C.2 Restore one required offsite

circuit to

OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (continued)

Deleted NOTE fromLA 200Insert2Insert2 AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite circuit inoperable.

AND One DG inoperable.

NOTE-------------

Enter applicable Conditions

and Required Actions of

LCO 3.8.9, "Distribution

Systems Operating," when Condition D is entered with

no AC power source to a

train.

D.1 Restore required offsite circuits to

OPERABLE status.

OR 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months D.2 Restore DG to OPERABLE status.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. Two DGs inoperable. E.1 Restore one DG to OPERABLE status.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months F. One automatic load sequencer inoperable. F.1 Restore automatic load sequencer to

OPERABLE status.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months F.2 Declare required feature(s) supported

by the inoperable

sequencer inoperable

when its redundant

required feature(s)

is inoperable.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from discovery of

Condition F

concurrent with

inoperability of

redundant

required feature(s) (continued) Insert2Insert2Insert2Insert2Insert16 INSERT 16 (3.8.1-4)

NOTES------------------------------

1. Not applicable when second DG intentionally made inoperable.

2. The following Section 5.5.20 constraints are applicable:

parts b, c.2, c.3, d, e, f, g, and h.

AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-5 AMENDMENT NO. 123, 201 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME G. --------NOTE--------

Condition G is not

applicable for Class

1E bus(es) provided

with a two stage time

delay for the degraded

voltage relays and a

fixed time delay for

the loss of voltage

relays.

One or more required offsite circuit(s) do

not meet required

capability. G.1 Restore required capability of the

offsite circuit(s).

OR 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months -------------NOTE------------

Enter LCO 3.8.1 Condition A

or C for required offsite

circuit(s) inoperable.

G.2 Transfer the ESF bus(es) from the

offsite circuit(s) to

the EDG(s).

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months H. Required Action and Associated Completion

Time of Condition A, B, C, D, E, F,

or G not met. H.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months H.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months I. Three or more required AC sources

inoperable. I.1 Enter LCO 3.0.3. Immediately Insert17 I I IGorH INSERT 17 (3.8.1-5)

H. ----- NOTES -----

1. Not applicable when the third

or a subsequent

required AC

source intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Three or more required AC sources

inoperable.

H.1 Restore required AC source(s) to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program DC Sources - Operating 3.8.4 PALO VERDE UNITS 1,2,3 3.8.4-1 AMENDMENT NO. 117, 193

3.8 ELECTRICAL

POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on one subsystem

inoperable. A.1 Restore battery terminal voltage to

greater than or equal

to the minimum

established float

voltage. AND A.2 Verify battery float AND A.3 Restore battery charger to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 72 hours B. One DC electrical power subsystem

inoperable for reasons

other than

Condition A. B.1 Restore DC electrical power subsystem to

OPERABLE status 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours Insert2Insert2 D D DInsert18.

INSERT 18 (3.8.4-1)

C. ----- NOTES -----

1. Not applicable when second DC

electrical power

subsystem

intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two DC electrical power subsystems

inoperable.

C.1 Restore at least one DC electrical power

subsystem to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program Inverters Operating 3.8.7 PALO VERDE UNITS 1,2,3 3.8.7-1 AMENDMENT NO. 117 180 3.8 ELECTRICAL POWER SYSTEMS

3.8.7 Inverters

- Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.

NOTE----------------------------

One inverter may be disconnected from its associated DC bus

for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided: a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter inoperable.

A.1 ---------NOTE---------

Enter applicable

Conditions and

Required Actions of

LCO 3.8.9, "Distribution

Systems - Operating" with any vital

instrument bus

de-energized.

Restore inverter to OPERABLE status.

7 days (continued)Insert2 Inverters Operating 3.8.7 PALO VERDE UNITS 1,2,3 3.8.7-2 AMENDMENT NO. 117 , 188 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and associated Completion

Time not met. B.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, and alignment to required AC vital

instrument buses.

In accordance with the Surveillance

Frequency

Control Program Insert19 C C C INSERT 19 (3.8.7-2)

B. ----- NOTES -----

1. Not applicable when the second

or a subsequent

required inverter intentionally

made inoperable

resulting in

loss of safety

function.

2. The following Section 5.5.20

constraints are

applicable when

there is a loss

of function:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two or more required inverters

inoperable.

B.1 Restore all but one inverter to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program Distribution Systems Operating 3.8.9 PALO VERDE UNITS 1,2,3 3.8.9-1 AMENDMENT NO. 117 197

3.8 ELECTRICAL

POWER SYSTEMS

3.8.9 Distribution

Systems - Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical power distribution

subsystem inoperable. A.1 Restore AC electrical power distribution

subsystem to OPERABLE

status. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months B. One AC vital instrument bus

electrical power

distribution subsystem

inoperable. B.1 Restore AC vital instrument bus

electrical power

distribution

subsystem to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (continued)Insert2Insert2 Distribution Systems Operating 3.8.9 PALO VERDE UNITS 1,2,3 3.8.9-2 AMENDMENT NO. 188, 197 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. One DC electrical power distribution

subsystems inoperable. C.1 Restore DC electrical power distribution

subsystem to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months D. Required Action and associated Completion

Time not met. D.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months E. Two or more inoperable distribution

subsystems that result

in a loss of safety

function. E.1 Enter LCO 3.0.3. Immediately SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and voltage to required AC, DC, and AC vital

instrument bus electrical power

distribution subsystems.

In accordance with the Surveillance

Frequency

Control Program Insert20 E E EInsert2 INSERT 20 (3.8.9-2)

D. ----- NOTES -----

1. Not applicable when the second

or a subsequent

electrical power

distribution

subsystem

intentionally

made inoperable

resulting in

loss of safety

function.

2. The following Section 5.5.20

constraints are

applicable when

there is a loss

of function:

parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two or more electrical power

distribution

subsystems

inoperable.

D.1 Restore electrical power distribution

subsystem(s) to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) ______________________________________________________________________ (continued) ________________________________________________________________________ PALO VERDE UNITS 1,2,3 5.5-19 AMENDMENT NO. 193, 203 5.5.19 Battery Monitoring and Maintenance Program (continued) 4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following statements in

paragraph (d) may be omitted: "When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full

charge. These measurements shall be made after the initially

high charging current decreases sharply and the battery voltage

rises to approach the charger output voltage." 5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string." b. The program shall include the following provisions: 1. Actions to restore battery cells with float voltage < 2.13 V; 2. Actions to determine whether the float voltage of the battery cell has been found to be < 2.13 V; 3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates; 4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and 5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.

Delete After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) ______________________________________________________________________ ______________________________________________________________________ PALO VERDE UNITS 1,2,3 5.5-19a AMENDMENT NO. 193, 203 5.5.19 Battery Monitoring and Maintenance Program (continued) 4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following

statements in paragraph (d) may be omitted: "When it has been

recorded that the charging current has stabilized at the charging

voltage for three consecutive hourly measurements, the battery is

near full charge. These measurements shall be made after the

initially high charging current decreases sharply and the battery

voltage rises to approach the charger output voltage." 5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string." b. The program shall include the following provisions: 1. Actions to restore battery cells with float voltage < 2.13 V; 2. Actions to determine whether the float voltage of the remaining bat 13 V when the float voltage of a battery cell has been found to be < 2.13 V; 3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates; 4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and 5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer

recommendations. 5.5.20 Not UsedInsert21 INSERT 21 (5.5-20) 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in

accordance with NEI 06-09 (Revision 0) - A, "Risk-Managed

Technical Specifications (RMTS) Guidelines." The program

shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk

Management Program must be considered for the effect

on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in

configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required

Action Completion Time (i.e., not the RICT) or 12

hours after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and

would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a

specified safety function or inoperability of all

required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function

or inoperability of all required trains of a system

required to be OPERABLE if one or more of the trains

are considered "PRA functional" as defined in Section

2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for

these loss of function conditions may not exceed 24

hours.

INSERT 21 continued

f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function

or inoperability of all required trains of a system

required to be OPERABLE if one or more trains are

considered "PRA Functional" as defined in Section

2.3.1 of NEI 06-09 (Revision 0) - A. However, the

following additional constraints shall be applied to

the criteria for "PRA Functional." 1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to

perform the specified Technical Specifications safety

function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for

establishing PRA Functionality, during a Technical

Specifications loss of function condition, where a

RICT is applied.

g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be

addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure

mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor

probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the

redundant components, the RICT shall account for the

increased possibility of CC failure. Accounting for

the increased possibility of CC failure shall be

accomplished by one of two methods. If one of the two

methods listed below is not used, the Technical

Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section

A-1.3.2.1 of Appendix A of the RG. Specifically, when

a component fails, the CC failure probability for the

remaining redundant components shall be increased to

represent the conditional failure probability due to

CC failure of these components, in order to account

for the possibility the first failure was caused by a

CC mechanism.

OR INSERT 21 continued

2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be

implemented. These RMAs shall target the success of

the redundant and/or diverse structures, systems, or

components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call

upon the function(s) performed by the failed SSC.

Documentation of RMAs shall be available for NRC

review. h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss

of Function if a PRA Functionality determination that

reflects the plant configuration concludes that the

LCO cannot be restored without placing the TS

inoperable trains in an alignment which results in a

loss of functional level PRA success criteria.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 2 Revised Technical Specification Pages (Clean copy) 1.3-13 3.7.5-5 1.3-14 1.3-15 3.3.6-1 3.3.6-2 3.4.10-1 3.7.7-1 3.7.7-2 3.7.8-1 3.7.8-2 3.7.10-13.4.10-2 3.7.10-2 3.4.12-1 3.8.1-1 3.4.12-2 3.8.1-2 3.5.1-1 3.8.1-3 3.5.1-2 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.1-6 3.6.2-3 3.8.1-7 3.6.3-1 3.8.1-8 3.6.3-2 3.8.1-9 3.6.3-3 3.8.1-103.6.3-4 3.8.1-113.6.3-5 3.8.1-123.6.3-6 3.8.1-133.6.3-7 3.8.1-143.6.6-1 3.8.1-153.7.2-2 3.8.1-163.7.2-3 3.8.1-173.7.3-1 3.8.1-18 3.7.3-2 3.8.4-1 3.7.4-1 3.8.4-2 3.7.4-2 3.8.4-3 3.7.5-1 3.8.4-4 3.7.5-2 3.8.7-1 3.7.5-3 3.8.7-2 3.7.5-4 3.8.9-1 3.8.9-2 3.8.9-3 5.5-20 5.5-21 5.5-22 Completion Times 1.3 1.3 Completion Times

________________________________

______________

PALO VERDE UNITS 1,2

,3 1.3-13 AMENDMENT NO.

117 EXAMPLES EXAMPLE 1.3

-7 (continued

) The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A

was initially entered. If Required Action A.1 is met after

Condition B is entered, Condition B is exited and operation may

continue in accordance with Condition A, provided the

Completion Time for Required Action A.2 has not expired.

EXAMPLES EXAMPLE 1.3

-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem

inoperable.

A.1 Restore subsystem to

OPERABLE status. 7 days OR In accordance with the Risk Informed

Completion Time

Program B. --------NOTES------- 1. Not applicable when second

subsystem

intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Two subsystems

inoperable.

B.1 Restore at least one

subsystem to OPERABLE

status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed

Completion Time

Program Completion Times 1.3 1.3 Completion Times

________________________________

______________

PALO VERDE UNITS 1,2

,3 1.3-14 AMENDMENT NO.

EXAMPLES EXAMPLE 1.3

-8 (continued)

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion Time not met.

C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be appli ed as discussed in Example 1.3

-2. However, the

licensee may elect to apply the Risk Informed Completion Time Program which

permits calculation of a Risk Informed Completion Time (RICT) that may be

used to complete the Required Action beyond the 7 day Completion Time.

The RICT cannot exc eed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or

Condition C must also be entered.

If a second subsystem is declared inoperable, Condition B may also be entered. The Condition i s modified by two Notes. The first note states it is

not applicable if the second subsystem is intentionally made inoperable. The

second Note provides restrictions applicable to these "loss of function" Conditions. The Required Actions of Condition B are n ot intended for

voluntary removal of redundant subsystems from service. The Required Action

is only applicable if one subsystem is inoperable for any reason and the

second subsystem is found to be inoperable, or if both subsystems are found

to be inoperabl e at the same time. If Condition B is applicable, at least one

subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C

must also be entered. The licensee may be able to apply a RICT or to extend

the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , but not longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , if the

requirements of the Risk Informed Completion Time Program are met. If two

subsystems are inoperable and Condition B is not applicable (i.e., the second

subsystem was intentionally made inoperable), LCO 3.0.3 is entered as ther e

is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time

limits of the Required Action Completion Time (i.e., not the RICT) or

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

Completion Times 1.3 1.3 Completion Times

________________________________

______________

PALO VERDE UNITS 1,2

,3 1.3-15 AMENDMENT NO.

EXAMPLES EXAMPLE 1.3

-8 (continued)

I f the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant

conditions result in exiting the applicability of the Risk Informed

Completion Time Program without restoring t he inoperable subsystem to

OPERABLE status, Condition C is also entered and the Completion Time clocks

for Required Actions C.1 and C.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the i noperable subsystem has not been restored

to OPERABLE status, Condition C is also entered and the Completion Time

clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems

are restored to OPERABLE status after Condition C is entered, Cond itions A, B, and C are exited, and therefore, the Required Actions of Condition C may

be terminated.

________________________________

______________

IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a

controlled manner.

ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2

,3 3.3.6-1 AMENDMENT NO.

117 3.3 INSTRUMENTATION

3.3.6 Engineered

Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1. APPLICABILITY:

According to Table 3.3.6

-1. ACTIONS ------------------------------------------------------NOTE-----------------------------------------------------

Separate Condition entry is allowed for each Function.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one Matrix Logic channel inoperable.

OR Three Matrix Logic channels are inoperable due to a common power source failure de

-

energizing three matrix power supplies.

A.1 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months B. One or more Functions with one Manual Trip or Initiation Logic channel inoperable.

B.1 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OR In accordance with the Risk Informed Completion Time Program (continued)

ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2

,3 3.3.6-2 AMENDMENT NO.

117 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions with two Initiation Logic channels or Manual Trip channels affecting the same trip leg inoperable.

C.1 Open at least one contact in the affected trip leg of both ESFAS Actuation Logics.

AND Immediately C.2 Restore channels to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months D. One or more Functions with one Actuation Logic channel inoperable.

D.1 -------------NOTE---------- One channel of Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillances, provided the other channel is OPERABLE.

Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OR In accordance with the Risk Informed Completion Time Program E. Required Action and associated Completion Time of Conditions for Containment Spray Actuation Signal, Main Steam Isolation Signal or Auxiliary Feedwater Actuation Signal not met. E.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.2 Be in MODE 4.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (continued)

Pressurizer Safety Valves

-MODES 1, 2, and 3 3.4.10 PALO VERDE UNITS 1,2

,3 3.4.10-1 AMENDMENT NO.

117 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves

- Modes 1, 2 and 3 LCO 3.4.10 Four pressurizer safety valves shall be OPERABLE with lift settings ~ 2450.25 psia and 2549.25 psia.

APPLICABILITY:

MODES 1, 2, and 3, -----------------------------

NOTE----------------------------

The lift settings are not required to be within LCO limits

during MODES 3 and 4 for the purpose of setting the

pressurizer safety valves under ambient (hot) conditions.

This exception is allow ed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into

MODE 3 provided a preliminary cold setting was made prior to

heatup.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE S--------- 1. Not applicable when pressurizer safety

valve intentionally

made inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts b, c.2, c.3, d, e, f, g, and h. -------------------

--- One pressurizer safety valve inoperable.

A.1 Restore valve to OPERABLE status.

15 minutes OR In accordance with the Risk

Informed Completion Time

Program Pressurizer Safety Valves

-MODES 1, 2, and 3 3.4.10 PALO VERDE UNITS 1,2

,3 3.4.10-2 AMENDMENT NO.

117 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and associated Completion

Time not met.

OR Two or more pressurizer safety

valves inoperable.

B.1 Be in MODE 3

. AND B.2 Be in MODE 4. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is OPERABLE in accordance with the Inservice

Testing Program. Following testing, lift

settings shall be within +/- 1%.

In accordance

with the Inservice

Testing Program

Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2

,3 3.4.12-1 AMENDMENT NO.

188 , 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3.

MODE 4 with RCS pressure

~ 385 psia. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required pressurizer vent paths inoperable.

A.1 Restore required pressurizer vent

paths to OPERABLE status. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program B. --------NOTE S--------- 1. Not applicable when last pressurizer

vent path

intentionally made inoperable.

2. The following Section 5.5.20

constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------

- All pressurizer vent paths inoperable.

B.1 Restore one pressurizer vent path to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months OR In accordance with the Risk Informed Completion Time Program Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2

,3 3.4.12-2 AMENDMENT NO.

188 , ACTIONS (CONTINUED)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion

Time of Condition A, or B not met.

C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 4 with RCS

pressure < 385 psia.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.12.1 Perform a complete cycle of each

Pressurizer Vent Valve.

In accordance

with the Surveillance

Frequency

Control Program SR 3.4.12.2 Verify flow through each

pressurizer vent path.

In accordance

with the Surveillance

Frequency

Control Program

SITs-Operating 3.5.1 PALO VERDE UNITS 1,2

,3 3.5.1-1 AMENDMENT NO.

118 , 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

3.5.1 Safety

Injection Tanks (SITs)

- Operating LCO 3.5.1 Four SITs shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODES 3 and 4 with pressurizer pressure

~ 1837 psia.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due to boron concentration not within limits.

OR One SIT inoperable due to inability to verify level or pressure.

A.1 Restore SIT to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. One SIT inoperable for reasons other than

Condition A.

B.1 Restore SIT to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C. --------NOTE S-------- 1. Not applicable when the second or a subsequent SIT intentionally made

inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Two or more SITs inoperable for reasons

other than Condition A. C.1 Restore all but one SIT to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program SITs-Operating 3.5.1 PALO VERDE UNITS 1,2

,3 3.5.1-2 AMENDMENT NO.

188 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and associated Completion Time of Condition A , B , or C not met. D.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months D.2 Reduce pressurizer pressure to

< 1837 psia.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each SIT isolation valve is fully open. In accordance

with the Surveillance

Frequency

Control Program SR 3.5.1.2 Verify borated water volume in each SIT is

~ 28% narrow range and 72% narrow range.

In accordance with the Surveillance

Frequency

Control Program SR 3.5.1.3 Verify nitrogen cover pressure in each SIT is ~ 600 psig and 625 psig. In accordance with the Surveillance

Frequency

Control Program (continued)

ECCS - Operating 3.5.3 PALO VERDE UNITS 1,2

,3 3.5.3-1 AMENDMENT NO.

124 , 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS

- Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODE 3 with pressurizer pressure

~ 1837 psia or with RCS T c ~ 485°F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem inoperable.

A.1 Restore subsystem to

OPERABLE status.

7 days OR In accordance with the Risk

Informed Completion Time

Program B. One or more trains

inoperable for reasons

other than Condition A.

AND At least 100% of the ECCS flow equivalent to

a single OPERABLE ECCS

train available.

B.1 Restore train(s) to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program C. Required Action and

associated Completion

Time not met.

C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Reduce pressurizer

pressure to

< 1837 psia.

AND 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months C.3 Reduce RCS T c to < 485°F. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months RWT 3.5.5 PALO VERDE UNITS 1,2

,3 3.5.5-1 AMENDMENT NO.

117 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

3.5.5 Refueling

Water Tank (RWT)

LCO 3.5.5 The RWT shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron concentration not

within limits.

OR RWT borated water temperature not within

limits. A.1 Restore RWT to

OPERABLE status.

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months B. --------NOTE S--------- 1. Not applicable when RWT is

intentionally made inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

RWT inoperable for

reasons other than

Condition A.

B.1 Restore RWT to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program C. Required Action and

associated Completion

Time not met.

C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours Containment Air Locks 3.6.2 PALO VERDE UNITS 1,2

,3 3.6.2-3 AMENDMENT NO.

117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.1 Verify an OPERABLE door is closed in the

affected air lock.

AND 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months B.2 Lock an OPERABLE door closed in the

affected air lock.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B.3 --------NOTE--------- Air lock doors in

high radiation areas

may be verified

locked closed by

administrative means.

Verify an OPERABLE door is locked closed

in the affected air

lock. Once per 31 days C. One or more

containment air locks inoperable for reasons other than Condition A or B. C.1 Initiate action to

evaluate overall

containment leakage

rate per LCO 3.6.1.

AN D Immediately C.2 Verify a door is closed in the

affected air lock.

AND 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months C.3 Restore air lock to OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance

with the Risk

Informed Completion Time

Program (continued)

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-1 AMENDMENT NO.

166 , 3.6 CONTAINMENT SYSTEMS

3.6.3 Containment

Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS -------------------------------------

NOTES-----------------------------------

1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path.

3. Enter applicable Conditions and Requi red Actions for system(s) made

inoperable by containment isolation valves.

4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.

5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in

accordance with SR 3.6.1.1.

CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE---------

Only applicable to

penetration flow paths

with two required containment isolation

valves.

One or more penetration flow paths

with one required containment isolation

valve inoperable

except for purge valve

leakage not within limit. A.1 Isolate the affected

penetration flow path

by use of at least

one closed and

de-activated

automatic valve, closed manual valve, blind flange, or

check valve with flow

through the valve

sec ured. AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months OR In accordance with the Risk

Informed Completion Time

Program (continued)

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO.

166 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)

A.2 --------NOTE--------- Isolation devices in high radiation areas

may be verified by use

of administrative

means. ---------------------

Verify the affected penetration flow path

is isolated.

Once per 31 days following

isolation for isolation

devices outside

containment AND Prior to entering MODE 4

from MODE 5 if

not performed

within the

previous 92 days

for isolation

devices inside

containment B. --------NOTE S--------

1. Only applicable to

penetration flow

paths with two

required containment isolation valves.

2. RICT is not

applicable when the

second containment

isolation valve is

intentionally made

inoperable

. 3. The following

Section 5.5.20

constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------

B.1 Isolate the affected

penetration flow path

by use of at least one

closed and de

-activated

automatic valve, closed

manual valve, or blind

flange. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk

Informed Completion Time

Program (continued)

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-3 AMENDMENT NO.

166 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

One or more penetration flow paths

containment isolation

valves inoperable

except for purge valve

leakage not within

limit. C. ---------NOTE--------- Only applicable to penetration flow paths

with only one required containment isolation

valve and a closed

system.

One or more penetration flow paths

with one required containment isolation

valve inoperable.

C.1 Isolate the affected

penetration flow path

by use of at least one

closed and

de-activated automatic

valve, closed manual

valve, or blind flange.

AND C.2 --------NOTE--------- Isolation devices in

high radiation areas

may be verified by use

of administrative

means. ---------------------

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months OR In accordance with the Risk

Informed Completion Time

Program Verify the affected penetration flow path

is isolated.

Once per 31 days following

isolation Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-4 AMENDMENT NO.

117 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. ---------NOTE S--------- 1. RICT is not applicable when the

second containment

purge valve is

intentionally made

inoperable

. 2. The following

Section 5.5.20

constraints are

applicable when there is a loss of

function: parts b, c.2, c.3, d, e, f, g, and h. ----------------------

- One or more penetration flow paths with one or more

required containment

purge valves not

within purge valve

leakage limits.

D.1 Isolate the affected

penetration flow path

by use of at least

one closed and

de-activated

automatic valve with

resilient seals, or

blind flange.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk

Informed Completion Time

Program (continued)

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-5 AMENDMENT NO.

188 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued)

D.2 --------NOTE--------- Isolation devices in

high radiation areas

may be verified by

use of administrative

means.

Verify the affected penetration flow path

is isolated.

Once per 31 days following

isolation for isolation

devices outside

containment AND Prior to entering MODE 4 from MODE 5 if

not performed

within the

previous 92 days

for isolation

devices inside containment AND D.3 Perform SR 3.6.3.6 for the resilient

seal purge valves

closed to comply with

Required Action D.1.

Once per 92 days following

isolation E. Required Action and

associated Completion

Time not met.

E.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-6 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.3.1 Verify each required 42 inch purge valve is sealed closed except for one purge valve in a penetration flow path while in

Condition D of this LCO.

In accordance

with the Surveillance

Frequency

Control Program SR 3.6.3.2 Verify each 8 inch purge valve is closed

except when the 8 inch purge valves are

open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the

valves to be open.

In accordance

with the Surveilla nce Frequency

Control Program SR 3.6.3.3

NOTE--------------------

Valves and blind flanges in high radiation

areas may be verified by use of

administrative means.

Verify each containment isolation manual valve and blind flange that is located

outside containment and not locked, sealed

or otherwise secured and is required to be

closed during accident conditions is

closed, except for containment isolation

valves that are open under administr ative controls. In accordance with the Surveillance

Frequency

Control Program (continued)

Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2

,3 3.6.3-7 AMENDMENT NO.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.6.3.4 -------------------

NOTE--------------------

Valves and blind flanges in high radiation

areas may be verified by use of

administrative means.

Verify each containment isolation manual valve and blind flange that is located

inside containment and not locked, sealed

or otherwise secured and required to be

closed during accident conditions is

closed, except for containment isolation

valves that are open under administrative

controls. Prior to entering MOD E 4 from MODE 5

if not performed

within the previous

92 days SR 3.6.3.5 Verify the isolation time of each required automatic power operated containment

isolation valve is within limits.

In accordance

with the Inservice

Testing Program SR 3.6.3.6 Perform leakage rate testing for required containment purge valves with resilient

seals. In accordance with

the Surveillance

Frequency Control

Program AND Within 92 days after opening the valve SR 3.6.3.7 Verify each required automatic containment isolation valve that is not locked, sealed, or otherwise secured in position, actuates

to the isolation position on an actual or

simulated actuation signal.

In accordance with

the Surveillance

Frequency Control

Program Containment Spray System 3.6.6 PALO VERDE UNITS 1,2

,3 3.6.6-1 AMENDMENT NO.

117 3.6 CONTAINMENT SYSTEMS

3.6.6 Containment

Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3.

MODE 4 when RCS pressure is

~ 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray train inoperable.

A.1 Restore containment

spray train to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program B. Required Action and

associated Completion

Time of Condition A

not met. B.1 Be in MODE 3. AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months B.2 Be in MODE 4 with RCS pressure < 385 psia.

84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months C. Two containment spray

trains inoperable.

C.1 Enter LCO 3.0.3.

Immediately

MSIVs 3.7.2 PALO VERDE UNITS 1,2

,3 3.7.2-2 AMENDMENT NO.

163 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV

actuator trains

inoperable.

OR Required Action and

associated Completion

Time of Condition A, B, or C not met. E.1 Declare each affected

MSIV inoperable.

Immediately F. One MSIV inoperable in

MODE 1. F.1 Restore MSIV to OPERABLE status.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months OR In accordance with the Risk

Informed Completion Time Program G. --------NOTE S--------- 1. Not applicable when the second or a

subsequent MSIV

intentionally made

inoperable.

2. The following

Section 5.5.20

constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ----------------------

Two or more MSIVs inoperable in MODE 1.

G.1 Restore all but one MSIV to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program H. Required Action and Associated Completion

Time of Condition F or G not met. H.1 Be in MODE 2.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months MSIVs 3.7.2 PALO VERDE UNITS 1,2

,3 3.7.2-3 AMENDMENT NO.

181 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME I. ---------NOTE---------

Separate Condition

entry is allowed for

each MSIV.

One or more MSIVs inoperable in MODE 2, 3, or 4. I.1 Close MSIV.

AND I.2 Verify MSIV is

closed. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Once per 7 days J. Required Action and associated Completion

Time of Condition I

not met. J.1 Be in MODE 3.

AND J.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1

NOTE--------------------

Not required to be performed prior to entry into MODE 3.

Verify closure time of each MSIV is within limits with each actuator train on

an actual or simulated actuation signal.

In accordance with the Inservice

Testing Program

MFIVs 3.7.3 PALO VERDE UNITS 1,2

,3 3.7.3-1 AMENDMENT NO.

158 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)

LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE. APPLICABILITY:

MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power

operated valve.

ACTIONS -------------------------------------

NOTE------------------------------------

Separate Condition entry is allowed for each penetration flow path.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs inoperable.

A.1 Restore MFIV(s) to

OPERABLE status.

OR A.2.1 Close or isolate inoperable MFIV(s).

AND A.2.2 Verify inoperable MFIV(s) is closed or

isolated. 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time

Program 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Once per 7 days following Isolation MFIVs 3.7.3 PALO VERDE UNITS 1

,2,3 3.7.3-2 AMENDMENT NO. 181 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES----------

1. RICT is not

applicable when the

second valve in the

affect ed flow path

is intentionally

made inoperable

. 2. The following

Section 5.5.20 constraints are

applicable: parts b, c.2, c.3, d, e, f, g, and h. -----------------------

Two valves in the same flow path inoperable.

B.1 Restore one valve to OPERABLE status.

OR B.2.1 Isolate affected flow path. AND B.2.2 Verify inoperable

MFIV(s) is closed or

isolated. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk Informed Completion Time

Program 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Once per 7 days following Isolation.

C. Required Action and

associated Completion

Time not met.

C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.3.1 Verify the closure time of each MFIV is within limits on an actual or simulated

actuation signal.

In accordance

with the Inservice

Testing Program

ADVs 3.7.4 PALO VERDE UNITS 1,2

,3 3.7.4-1 AMENDMENT NO.

191 , (CORRECTED PAGE

) 3.7 PLANT SYSTEMS

3.7.4 Atmospheric

Dump Valves (ADVs)

LCO 3.7.4 Four ADV line s shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------

Separate Condition

entry is allowed for

each SG. --------------------

One required ADV line

in operable. A.1 Restore ADV line to

OPERABLE status.

7 days OR In accordance with the Risk

Informed Completion Time

Program B. --------NOTE S--------- 1. Not applicable when the last ADV intentionally made inoperable resulting in loss of safety

function. 2. The following Section 5.5.20

constraints are

applicable when there is a loss of

function: parts b, c.2, c.3, d, e, f, g, and h. -------------------

Two or more ADV lines

inoperable with both

ADV lines inoperable

on one or more SGs

. B.1 Restore one ADV line

to OPERABLE status on each SG. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk

Informed Completion Time

Program ADVs 3.7.4 PALO VERDE UNITS 1,2

,3 3.7.4-2 AMENDMENT NO.

188 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion

Time not met.

C.1 Be in MODE 3.

AND C.2 Be in MODE 4 without

reliance on steam

generator for heat

removal. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.4.1 Verify one complete cycle of each ADV.

In accordance with the Surveillance

Frequency

Control Program

AFW System 3.7.5 PALO VERDE UN ITS 1,2,3 3.7.5-1 AMENDMENT NO.

197 , 3.7 PLANT SYSTEMS

3.7.5 Auxiliary

Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.

NOTE----------------------------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.

APPLICABILITY:

MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.

ACTIONS

NOTE----------------------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to

turbine driven AFW

pump inoperable.

OR ---------NOTE--------- Only applicable if MODE 2 has not been entered following

refueling.

One turbine driven AFW pump inoperable in MODE 3 following

refueling.

A.1 Restore affected

equipment to OPERABLE status. 7 days OR In accordance with the Risk

Informed Completion Time

Program B. One AFW train

inoperable for reasons

other than Condition A

in MODE 1, 2, or 3.

B.1 Restore AFW train to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time

Program (continued)

AFW System 3.7.5 PALO VERDE UNITS 1,2

,3 3.7.5-2 AMENDMENT NO.

117 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. -------NOTES-------- 1. Not applicable when second AFW train intentionally made

inoperable resulting in loss of safety

function. 2. The following Section 5.5.20

constraints are

applicable when there is a loss of

function: parts b, c.2, c.3, d, e, f, g, and h. --------------

Two AFW trains

inoperable in MODE 1, 2, or 3. C.1 Restore at least one AFW

train to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program D. Required Action and

associated Completion

Time of Condition A , B or C not met. D.1 Be in MODE 3.

AND D.2 Be in MODE 4.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours AFW System 3.7.5 PALO VERDE UNITS 1,2

,3 3.7.5-3 AMENDMENT NO.

1 88 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three AFW trains inoperable in MODE 1, 2, or 3. E.1 --------NOTE--------- LCO 3.0.3 and all other LCO Required Actions

requiring MODE changes

are suspended until one

AFW train is restored

to OPERABLE status.

Initiate action to

restore one AFW train to OPERABLE status.

Immediately F. Required AFW train inoperable in MODE 4.

F.1 --------NOTE--------- LCO 3.0.3 and all other

LCO Required Actions

requiring MODE changes

are suspended until one AFW train is restored

to OPERABLE status.

Initiate action to restore one AFW train to

OPERABLE status.

Immediately

AFW System 3.7.5 PALO VERDE UNITS 1,2

,3 3.7.5-4 AMENDMENT NO.

1 88 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.5.1 Verify each AFW manual, power operated, and automatic valve in each water flow path and

in both steam supply flow paths to the

steam turbine driven pump, that is not

locked, sealed, or otherwise secured in

position, is in the correct position.

In accordance

with the Surveillance

Frequency

Control Program SR 3.7.5.2

NOTE--------------------

Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS

. -------------------------------------------

Verify the developed head of each AFW pump

at the flow test point is greater than or

equal to the required developed head.

In accordance

with the Inservice Test

Program SR 3.7.5.3

NOTES-------------------

1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

after reaching 532°F in the RCS.

2. Not applicable in MODE 4 when steam

generator is relied upon for heat

removal. -------------------------------------------

Verify each AFW automatic valve that is not

locked, sealed, or otherwise secured in

position, actuates to the correct position

on an actual or simulated actuation signal.

In accordance

with the Surveillance

Fre quency Control Program (continued)

AFW System 3.7.5 PALO VERDE UNITS 1,2

,3 3.7.5-5 AMENDMENT NO.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.7.5.4

NOTES-------------------

1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after reaching 532°F in the RCS.

2. Not applicable in MODE 4 when steam

generator is relied upon for heat

removal. -------------------------------------------

Verify each AFW pump starts automatically

on an actual or simulated actuation signal.

In accordance with the Surveillance

Frequency

Control Program SR 3.7.5.5 Verify the proper alignment of the required

AFW flow paths by verifying flow from the

condensate storage tank to each stea m

generator.

Prior to entering MODE 2

whenever unit

has been in

MODE 5 or 6 for

> 30 days EW System 3.7.7 PALO VERDE UNITS 1,2

,3 3.7.7-1 AMENDMENT NO.

117 3.7 PLANT SYSTEMS

3.7.7 Essential

Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train inoperable.

A.1 --------NOTE--------- Enter applicable Conditions and Required

Actions of LCO 3.4.6, "RCS Loops

- MODE 4" for shutdown cooling

made inoperable by EW.

Restore EW train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program B. --------NOTES-------- 1. Not applicable when second EW train intentionally made

inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------

Two EW trains

inoperable.

B.1 Restore at least one EW

train to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance

with the Risk Informed Completion Time

Program EW System 3.7.7 PALO VERDE UNITS 1,2

,3 3.7.7-2 AMENDMENT NO.

188 , ACTION (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1

NOTE--------------------

Isolation of EW flow to individual

components does not render the EW System

inoperable.

Verify each EW manual, power operated, and automatic valve in the flow path servicing

safety related equipment, that is not

locked, sealed, or otherwise secured in

position, is in the correct position.

In accordance with the Surveillance

Frequency

Control Program SR 3.7.7.2 Verify each EW automatic valve in the flow

path that is not locked, sealed, or

otherwise secured in position, actuates to

the correct position on an actual or

simulated actuation signal.

In accordance

with the Surveillance

Frequency Control Program SR 3.7.7.3 Verify ea ch EW pump starts automatically on an actual or simulated actuation signal.

In accordance with the Surveillance

Frequency

Control Program

ESPS 3.7.8 PALO VERDE UNITS 1,2

,3 3.7.8-1 AMENDMENT NO.

117 3.7 PLANT SYSTEMS

3.7.8 Essential

Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train inoperable.

A.1 --------Notes-------- 1. Enter applicable

Conditions and

Required Actions of

LCO 3.8.1. "AC

Sources ~ Operating," for

emergency diesel

generator made

inoperable by ESPS.

2. Enter applicable

Conditions and

Required Actions of

LCO 3.4.6. "RCS

Loops ~ MODE 4," for

shutdown cooling

made inoperable by

ESPS. ---------------------

Restore ESPS train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance

with the Risk

Informed Completion Time

Program ESPS 3.7.8 PALO VERDE UNITS 1,2

,3 3.7.8-2 AMENDMENT NO.

188 , ACTION (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. ---------NOTES--------- 1. Not applicable when second ESPS train

intentionally made

inoperable.

2. The following Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Two ESPS trains

inoperable.

B.1 Restore at least one

ESPS train to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program C. Required Action and associated Completion

Time not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1

Notes-------------------

Isolation of ESPS flow to individual

components does not render ESPS inoperable.

Verify each ESPS manual and power operated valve in the flow path servicing safety

related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.

In accordance with the Surveillance

Frequency

Control Program SR 3.7.8.2 Verify each ESPS pump starts automatically

on an actual or simulated actuation signal.

In accordance

with the Surveillance

Frequency

Control Program

EC 3.7.10 PALO VERDE UNITS 1,2

,3 3.7.10-1 AMENDMENT NO.

188 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train inoperable.

A.1 Restore EC train to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program B. --------NOTES--------- 1. Not applicable when second EC train intentionally made

inoperable.

2. The following Section 5.5.20

constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two EC trains

inoperable.

B.1 Restore at least one EC

train to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program C. Required Action and

associated Completion

Time not met. C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months EC 3.7.10 PALO VERDE UNITS 1,2

,3 3.7.10-2 AMENDMENT NO.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power operated, and automatic valve in the flow

path, that is not locked, sealed, or

otherwise secured in position, is in the

correct position.

In accordance

with the Surveillance

Frequency

Control Program SR 3.7.10.2 Verify the proper actuation of each EC

System component on an actual or simulated

actuation signal.

In accordance

with the Surveillance

Frequency

Control Program

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-2 AMENDMENT NO.

197 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)

A.3 Restore required offsite circuit to

OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk

Informed Completion Time

Program B. One DG inoperable.

B.1 Perform SR 3.8.1.1

for the OPERABLE

required offsite

circuit(s).

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required

feature(s)

supported by the

inoperable DG

inoperable when

its redundant

required feature(s) is

inoperable.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from

discovery of

Condition B

concurrent with

inoperability of

redundant

required feature(s)

AND B.3.1 Determine OPERABLE DG is not

inoperable due to

common cause

failure. OR 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months B.3.2 Perform SR 3.8.1.2

for OPERABLE DG.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months AND (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO.

200 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.4 Restore DG to OPERABLE status. 10 days OR In accordance with the Risk Informed

Completion Time

Program C. Two required offsite

circuits inoperable.

C.1 Declare required

feature(s)

inoperable when

its redundant

required feature(s) is

inoperable.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from

discovery of

Condition C

concurrent with

inoperability of

redundant required

feature(s)

AND C.2 Restore one

required offsite

circuit to

OPERABLE status.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed

Completion Time

Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO.

117 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite circuit inoperable.

AND One DG inoperable.

NOTE-----------

Enter applicable Conditions and Required Actions of

LCO 3.8.9, "Distribution

Systems ~ Operating," when Condition D is entered with no AC power source to a

train.

D.1 Restore required offsite circuits to OPERABLE status.

OR 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR In accordance with the Risk Informed

Completion Time

Program D.2 Restore DG

to OPERABLE status.

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR In accordance with the Risk Informed

Completion Time

Program ----------NOTE S--------- 1. Not applicable when

second DG

intentionally made inoperable.

2. The following

Section 5.5.20

constraints are

applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------

--- E. Two DGs inoperable.

E.1 Restore one DG to

OPERABLE status.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OR In accordance with the Risk Informed

Completion Time

Program AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-5 AMENDMENT NO.

201 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. One automatic load sequencer inoperable.

F.1 Restore automatic

load sequencer to

OPERABLE status.

AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OR In accordance with the Risk Informed

Completion Time

Program F.2 Declare required

feature(s) supported by the inoperable sequencer inoperable

when its redundant

required feature(s)

is inoperable.

4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from

discovery of Condition F concurrent with

inoperability of

r edundant required

feature(s)

G. --------NOTE--------

Condition G is not

applicable for Class

1E bus(es) provided

with a two stage time delay for the degraded voltage relays and a

fixed time delay for

the loss of voltage

relays.

One or more required offsite circuit(s) do

not meet required

capability.

G.1 Restore required

capability of the

offsite circuit(s).

OR 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ----------

--NOTE-----------

Enter LCO 3.8.1 Condition A or C for required offsite

circuit(s) inoperable.

G.2 Transfer the ESF

bus(es) from the

offsite circuit(s)

to the EDG(s).

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-6 AMENDMENT NO.

188 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H.---------NOTES-------- 1. Not applicable when the third or a

subsequent required AC source intentionally made

inoperable.

2. The following

Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Three or more required AC sources inoperable

. H.1 Restore required AC source(s) to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program I. Required Action and

Associated Completion

Time of Condition A, B, C, D, E, F, G, or H not met. I.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months I.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-7 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and indicated power availability for each

required offsite circuit.

In accordance

with the Surveillance

Frequency

Control Program SR 3.8.1.2

NOTES------------------

1. Performance of SR 3.8.1.7 satisfies

this SR. 2. All DG starts may be preceded by an

engine prelube period and followed by

a warmup period prior to loading.

3. A modified DG start involving idling

and gradual a cceleration to

synchronous speed may be used for

this SR as recommended by the

manufacturer. When modified start

procedures are not used, the time, voltage, and frequency tolerances

of SR 3.8.1.7 must be met.

4. The steady state voltage and

frequency lim its are analyzed values

and have not been adjusted for

instrument error.

Verify each DG starts from standby condition and achieves steady state

voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-8 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.3 -------------------

NOTES-------------------

1. DG loadings may include gradual loading as recommended by the

manufacturer.

2. Momentary transients outside the load

range do not invalidate this test.

3. This Surveillance shall be conducted

on only o ne DG at a time.

4. This SR shall be preceded by and

immediately follow without shutdown a

successful performance of SR 3.8.1.2

or SR 3.8.1.7.

Verify each DG is synchronized and loaded, and operates for 60 minutes at a load 4950 kW and 5500 kW. In accordance

with the Surveillance

Frequency

Control Program SR 3.8.1.4 Verify each day tank contains 550 gal of fuel oil (minimum level of 2.75 feet).

In accordance

with the Surveillance

Frequency

Control Program SR 3.8.1.5 Check for and remove accumulated water from

each day tank.

In accordance

with the Surveillance

Frequency

Control Program SR 3.8.1.6 Verify the fuel oil transfer system

operates to automatically transfer fuel

oil from the storage tank to the day tank.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-9 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7

NOTE--------------------

1. All DG starts may be preceded by an

engine prelube period followed by a

warmup period prior to loading.

2. The steady state voltage and frequency

limits are analyzed va lues and have not been adjusted for instrument error.

Verify each DG starts from standby

condition and achieves

a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and

b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance with the Surveillance

Frequency

Control Program SR 3.8.1.8

NOTE------------------

This Surveillance shall not normally be

performed in MODE 1 or 2. However, this Surveillance may be performed to

reestablish OPERABILITY provided an

assessment determines the safety of the

plant is maintained or enhanced.

Verify manual transfer of AC power sources from the normal offs ite circuit to each

alternate offsite circuit.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-10 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.9

NOTE------------------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, this Surveillance may be performed to

reestablish OPERABILITY provided an

assessment determines the safety of the

plant is maintained or enhanced.

Verify each DG rejects a load greater than

or equal to its associated single largest

post-accident load, and:

a. Following load rejection, the frequency is 64.5 Hz; b. Within 3 seconds following load

rejection, the voltage is 3740 V and 4580 V; and

c. Within 3 seconds following load

rejection, the frequency is

58.8 Hz and 61.2 Hz. In accordance

with the Surveillance Frequency

Control Program SR 3.8.1.10

NOTE-----------------

If performed with the DG synchronized with

offsite power, it shall be performed at a

power factor of 0.89. However, if grid conditions do not permit, the power factor

limit is not required to be met. Under

this condition the power factor shall be

maint ained as close to the limit as

practicable.

Verify each DG does not trip, and voltage

is maintained 6200 V during and following a load rejection of 4950 kW and 5500 kW. In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-11 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.11

NOTE--------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally

be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance

may be performed to reestablish

OPE RABILITY provided an assessment

determines the safety of the plant is

maintained or enhanced.

3. Momentary voltage and frequency transients induced by load changes do

not invalidate this test.

4. The steady state voltage and frequency

limits are analyzed values and have not been adjusted for instrument

error. -------------------------------------------

Verify on an actual or simulated loss of

offsite power signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. DG auto-starts and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto

-connected

emergency loads through automatic

load sequencer, 3. maintains steady state voltage

4000 V and 4377.2 V, 4. maintains steady state frequency

59.7 Hz and 60.7 Hz, and

5. supplies permanently connected

and auto-connected emergency

loads for 5 minutes.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-12 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.12

NOTES------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance

may be performed to reestablish

OPERABILITY provided an assessment

determines the safety of the plant is

maintained or enhanced.

3. The steady state voltage and frequency

limits are analyzed values and have not been adjusted for instrument

error. ------------------------------------------

Verify on an actual or simulated Engineered

Safety Feature (ESF) actuation signal (without a loss of offsite power) each

DG auto-starts and:

a. In 10 seconds, achieves voltage 3740 V and frequency 58.8 Hz; b. Achieves steady state voltage 4000 and 4377.2 V and frequency 59.7 Hz and 60.7 Hz; c. Operates for 5 minutes on standby (running unloaded);

d. Permanently connected loads remain

energized from the offsite power

system; and

e. Emergency loads are energized (auto

-

connected through the automatic load

sequencer) from the offsite power

system. In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-13 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.13 Verify each DG automatic trip is bypassed on actual or simulated loss of voltage signal on the emergency bus concurrent with

an actual or simulated ESF actuation

signal except:

a. Engine overspeed;

b. Generator differential current;

c. Engine low lube oil pressure; and

d. Manual emergency stop trip.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-14 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14

NOTES-------------------

1. Momentary transients outside the load range do not invalidate this test.

2. If performed with the DG synchronized with offsite power, it shall be

performed at a power factor of 0.89. However, if grid conditions do not

permit, the power factor limit is not

required to be met. Under this

condition the power factor shall be

maintained as close to the limit as

practicable.

3. All DG starts may be preceded by an

engine prelube period followed by a

warmup period prior to loading.

4. DG loading may include gradual loading

as recommended by the manufacturer.

Verify each DG operates for 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: a. For 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months loaded 4950 kW and 5500 kW; and

b. For the remaining hours ( 2) of the test loaded 5775 kW and 6050 kW. In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-15 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.15

NOTES-------------------

1. This Surveillance shall be performed within 5 minutes of shutting down the

DG after the DG, loaded 4950 kW and 5500 kW, has operated 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or until temperatures have stabilized.

Momentary transients outside of load

range do not invalidate this test

. 2. All DG starts may be preceded by an engine prelube period.

3. The steady state voltage and frequency

limits are analyzed values and have

not been adjusted for instrument

error. -------------------------------------------

Verify each DG starts and achieves

a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and

b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance

with the Surveillance

Frequency

Control Program SR 3.8.1.16

NOTE-------------------

This Surveillance shall not normally be

performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to

reestablish OPERABILITY provided an

assessment determines the safety of the

plant is maintai ned or enhanced.

Verify each DG:

a. Synchronizes with offsite power source while loaded with emergency loads upon

a simulated restoration of offsite

power; b. Transfers loads to offsite power

source; and

c. Returns to ready

-to-load operation.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-16 AMEND MENT NO. 188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.17

NOTE--------------------

This Surveillance shall not normally be

performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be

performed to reestablish OPERABILITY

provided an assessme nt determines the

safety of the plant is maintained or

enhanced.

Verify, with a DG operating in test mode and connected to its bus, an actual or

simulated ESF actuation signal overrides

the test mode by:

a. Returning DG to ready

-to-load operation; and

b. Automatically energizing the emergency

load from offsite power.

In accordance with the Surveillance

Frequency

Control Program SR 3.8.1.18

NOTE-------------------

This Surveillance shall not normally be

performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to

reestablish OPERABILITY provided an

assessment determines the safety of the

plant is maintained or enhanced.

Verify interval between each sequenced load

block is within +/- 1 second of design

interval for each automatic load sequencer.

In accordance

with the Surveillance

Frequency

Control Program (continued)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-17 AMENDMENT NO.

188 , SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.19

NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.

However, portions of the Surveillance

may be performed to reestablish

OPERABILITY provided an assessment

determines the safety of the plant is

maintained or enhanced.

3. The steady state voltage and frequency

limits are ana lyzed values and have

not been adjusted for instrument

error. -------------------------------------------

Verify on an actual or simulated loss of

offsite power signal in conjunction with an

actual or simulated ESF actuation signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto

-connected

emergency loads through load

sequencer, 3. achieves steady state vo ltage 4000 V and 4377.2 V, 4. achieves steady state frequency

59.7 Hz and 60.7 Hz, and

5. supplies permanently connected

and auto-connected emergency

loads for 5 minutes.

In accordance

with the Surveillance

Frequency

Control Program (continued

)

AC Sources

~ Operating 3.8.1 PALO VERDE UNITS 1,2

,3 3.8.1-18 AMENDMENT NO.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.20

NOTES-------------------

1. All DG starts may be preceded by an engine prelube period.

2. The steady state voltage and frequency

limits are analyzed values and have

not been adjusted for instrument

error. -------------------------------------------

Verify, when started simultaneously, each DG achieves

a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and

b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance with the Surveillance

Frequency

Control Program

DC Sources

- Operating 3.8.4 PALO VERDE UNITS 1,2

,3 3.8.4-1 AMENDMENT NO.

193 , 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources

- Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on one subsystem

inoperable

. A.1 Restore battery terminal voltage to

greater than or equal

to the minimum

established float

voltage. AND A.2 Verify battery float

AND A.3 Restore battery

charger to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 72 hours OR In accordance with the Risk

Informed Completion Time

Program B. One DC electrical

power subsystem

inoperable for reasons

othe r than Condition A. B.1 Restore DC electrical

power subsystem to OPERABLE status

. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OR In accordance with the Risk

Informed Completion Time

Program DC Sources

- Operating 3.8.4 PALO VERDE UNITS 1,2

,3 3.8.4-2 AMENDMENT NO.

193 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. --------NOTES-------- 1. Not applicable when second DC

electrical power

subsystem

inten tionally made

inoperable.

2. T he following

Section 5.5.20

constraints are

applicable: parts

b, c.2, c.3, d, e, f, g, and h.

Two DC electrical power subsystems inoperable

. C.1 Restore at least one DC

electrical power

subsystem to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program D. Required Action and associated Completion

Time not met. D.1 Be in MODE 3. AND D.2 Be in MODE 5.

6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months DC Sources

- Operating 3.8.4 PALO VERDE UNITS 1,2

,3 3.8.4-3 AMENDMENT NO.

193 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is greater than or equal to the minimum established

float voltage. In accordance

with the Surveillance

Frequency

Control Program SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 Deleted SR 3.8.4.5 Deleted SR 3.8.4.

6 Verify each battery charger supplies

~ 400 amps for Batteries A and B and ~ 300 amps for Batteries C and D at greater than or equal to the minimum

. OR Verify each battery charger can recharge

the battery to the fully charged state

within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying the largest

combined demands of the various continuous

steady state loads, after a battery

discharge to the bounding design basis

event discharge state.

In accordance

with the Surveillance

Frequency

Control Program (continued)

DC Sources

- Operating 3.8.4 PALO VERDE UNITS 1, 2,3 3.8.4-4 AMENDMENT NO.

SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.4.

7 -------------------

NOTES-------------------

1. The modified performance discharge test in SR 3.8.

6.9 may be performed in lieu of SR 3.8.4.7.

2. This Surveillance shall not be performed in MODE 1, 2, 3, or 4. -------------------------------------------

Verify battery capacity is adequate to

supply, and maintain in OPERABLE status, the required emergency loads for the design

duty cycle when subjected to a battery

service test.

In acco rdance with the Surveillance Frequency

Control Program SR 3.8.4.

8 Deleted Inverters

~ Operating 3.8.7 PALO VERDE UNITS 1,2

,3 3.8.7-1 AMENDMENT NO.

180 3.8 ELECTRICAL POWER SYSTEMS

3.8.7 Inverters

- Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE. ----------------------------

NOTE----------------------------

One inverter may be disconnected from its associated DC bus

for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided:

a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and

b. All other AC vital instrument buses are energized from

their associated OPERABLE inverters.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter

inoperable.

A.1 ---------NOTE---------

Enter applicable

Conditions and

Required Actions of

LCO 3.8.9, "Distribution

Systems - Operating" with any vital

instrument bus

de-energized.

Restore inverter to OPERABLE status. 7 days OR In accordance

with the Risk

Informed Completion Time

Program (continued)

Inverters

~ Operating 3.8.7 PALO VERDE UNITS 1,2

,3 3.8.7-2 AMENDMENT NO.

188 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES-------- 1. Not applicable when the second or a

subsequent required inverter intentionally made

inoperable resulting in loss of safety

function. 2. The following

Section 5.5.20

constraints are

applicable when there is a loss of

fu n ction: parts b, c.2, c.3, d, e, f, g, and h. ----------------

Two or more required

inverters inoperable

. B.1 Restore all but one

inverter to OPERABLE status. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time

Program C. Required Action and

associated Completion

Time not met.

C.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months C.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, and alignment to required AC vital

instrument buses.

In accordance

with the Surveillance

Frequency

Control Program

Distribution Systems

~ Operating 3.8.9 PALO VERDE UNITS 1,2

,3 3.8.9-1 AMENDMENT NO.

197 3.8 ELECTRICAL POWER SYSTEMS

3.8.9 Distribution

Systems

- Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical

power distribution

subsystem inoperable.

A.1 Restore AC electrical

power distribution

subsystem to OPERABLE

status. 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk

Informed Completion Time

Program B. One AC vital

instrument bus

electrical power distribution subsystem inoperable.

B.1 Restore AC vital

instrument bus

electrical power

distribution

subsystem to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OR In accordance with the Risk Informed Completion Time

Program C. One DC electrical

power distribution

subsystems inoperable.

C.1 Restore DC electrical

power distribution

subsystem to OPERABLE

status. 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OR In accordance with the Risk

Informed Completion Time

Program (continued)

Distribution Systems

~ Operating 3.8.9 PALO VERDE UNITS 1,2

,3 3.8.9-2 AMENDMENT NO.

197 , ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. --------NOTES-------- 1. Not applicable when the second or a subsequent

electrica l power distribution

subsystem

intentionally made

inoperable resulting in loss of safety

function. 2. The following Section 5.5.20

constraints are

applicable when there is a loss of

fu n ction: parts b, c.2, c.3, d, e, f, g, and h. ---------------

Two or more electrical

power distribution

subsystems inoperable

. D.1 Restore electrical

power distribution

subsystem(s) to

OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed

Completion Time

Program E. Required Action and

associated Completion

Time not met.

E.1 Be in MODE 3.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.2 Be in MODE 5.

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and

voltage to required AC, DC, and AC vital

instrument bus electrical power

distribution subsystems.

In accordance with the Surveillance

Frequency

Control Program

Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)

________________________________

______ ________________________________

________________________________

______ PALO VERDE UNITS 1,2

,3 5.5-20 AMENDMENT NO.

5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06

-09 (Revision 0)

- A, "Risk-Managed Technical Specifications (RMTS) Guidelines.

" The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1 and 2.

c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less. 3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.

e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional

" as defined in Section 2.3.1 of NEI 06

-09 (Revision 0)

- A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered

"PRA Functional

" as defined in Section 2.3.1 of NEI 06

-09 (Revision 0)

- A. However, the following additional constraints shall be applied to the criteria for "PRA Functional

."

Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)

________________________________

______ ________________________________

________________________________

______ PALO VERDE UNITS 1,2

,3 5.5-21 AMENDMENT NO.

1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.

2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied. g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.

If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.

If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.

1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A

-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.

OR 2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review. h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.

After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)

________________________________

______ ________________________________

________________________________

______ PALO VERDE UNITS 1,2

,3 5.5-22 AMENDMENT NO.

5.5.21 Spent Fuel Storage Rack Neutron Absorber Monitoring Program Certain storage cells in the spent fuel storage racks utilize neutro n absorbing material that is credited in the spent fuel storage rac k criticality safety analysis to ensure the limitations of Technica l Specifications 3.7.17 and 4.3.1.1 are maintained

. In order to ensure the reliability of the neutron absorber material, a monitoring program is provided to confirm the aassumptions in the spent fuel pool criticality safety analysis. The Spent Fuel Storage Rack Neutron Absorber Monitoring Program shall require periodic inspection and monitoring of spent fuel pool test coupons and neutron absorber inserts on a performance

-based frequency, not to exceed 10 years. Test coupons shall be inspected as part of the monitoring program. These inspections shall include visual, B

-10 areal density and corrosion rate. Visual in-situ inspections of inserts shall also be part of the program to monitor for signs of degradation. In addition, an insert shall be removed periodically for visual inspection, thickness measurements, and determination of retention force.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 3 Technical Specification Bases Changes TS Bases Mark-up Pages B 3.3.6-16 B 3.7.5-6 B 3.3.6-18 B 3.7.5-7 B 3.4.10-3 B 3.7.5-8 B 3.4.12-3 B 3.7.7-3 B 3.4.12-4 B 3.7.7-4 B 3.5.1-8 B 3.7.8-3 B 3.5.3-6 B 3.7.10-3 B 3.5.5-8 B 3.8.1-9 B 3.6.2-7 B 3.8.1-12 B 3.6.3-10 B 3.8.1-13 B 3.6.3-11 B 3.8.1-15 B 3.6.3-12 B 3.8.1-16 B 3.6.3-13 B 3.8.1-17 B 3.6.3-14 B 3.8.1-22 B 3.6.3-15 B 3.8.4-7 B 3.6.6-5 B 3.8.4-8 B 3.7.2-7 B 3.8.7-4 B 3.7.2-8 B 3.8.9-4 B 3.7.3-3 B 3.8.9-5 B 3.7.3-4 B 3.8.9-6 B 3.7.4-5 B 3.8.9-7 B 3.7.5-5

ESFAS Logic and Manual Trip B 3.3.6 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.3.6-16 REVISION 0 ACTIONS A.1 (continued) The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This provides the operator with time to take

appropriate actions and still ensures that any risk

involved in operating with a failed channel is acceptable.

Operating experience has demonstrated that the probability

of a random failure of a second Matrix Logic channel is low

during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. If the channel cannot be

restored to OPERABLE status with 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , Condition E is

entered. B.1 Condition B applies to one Manual Trip or Initiation Logic channel inoperable. The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Operating experience has demonstrated that the

probability of a random failure in a second channel is low

during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. Failure of a single Initiation Logic channel may open one contact affecting both Actuation Logic channels. For the

purposes of this Specification, the Actuation Logic is not

inoperable. This prevents the need to enter LCO 3.0.3 in

the event of an Initiation Logic channel failure. The

Actions differ from those involving one RPS manual channel

inoperable, because in the case of the RPS, opening RTCBs

can be easily performed and verified. Opening an

initiation relay contact is more difficult to verify, and

subsequent shorting of the contact is always possible. C.1 and C.2 Condition C applies to the failure of both Initiation Logic channels affecting the same trip leg. In this case, the Actuation Logic channels are not inoperable, since they are in one-out-of-two logic and

capable of performing as required. This obviates the need

to enter LCO 3.0.3 in the event of a matrix or vital bus

power failure.orinaccordancewiththeRisk

Informed CompletionTime

Program ESFAS Logic and Manual Trip B 3.3.6 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.3.6-18 REVISION 0 ACTIONS D.1 (continued) The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . Operating experience has demonstrated that the

probability of a random failure in the Actuation Logic of

the second train is low during a given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. Failure of a single Initiation Logic channel, matrix channel power supply, or vital instrument bus may open one

or both contacts in the same trip leg in both Actuation

Logic channels. For the purposes of this Specification, the Actuation Logic is not inoperable. This obviates the

need to enter LCO 3.0.3 in the event of a vital bus, matrix, or initiation channel failure. Each Actuation Logic channel has two sets of redundant power supplies. The power supplies in each set are powered

from different vital instrument buses. Failure of a single

power supply or a set of power supplies due to the loss of

a vital instrument bus, does not affect the operation of

the Actuation Logic because the redundant power supplies

can supply the full system load. For the purposes of this

specification, the Actuation Logic is not inoperable. Required Action D.1 is modified by a Note to indicate that one channel of Actuation Logic may be bypassed for up to

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillance, provided the other channel is

OPERABLE. This allows performance of a PPS CHANNEL FUNCTIONAL TEST on an OPERABLE ESFAS train without generating an ESFAS

actuation in the inoperable train. E.1 and E.2 If the Required Actions and associated Completion Times of Conditions for CSAS, MSIS or AFAS cannot be met, the plant

must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at

least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on

operating experience, to reach the required plant

conditions from full power conditions in an orderly manner

and without challenging plant systems.orinaccordancewiththeRisk

Informed CompletionTime

Program Pressurizer Safety Valves-MODES 1, 2, and 3 B 3.4.10 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.4.10-3 REVISION 0 APPLICABILITY The requirements for overpressure protection in other MODES (continued) are covered by LCO 3.4.11, "Pressurizer Safety Valves-MODE 4," and LCO 3.4.13, "LTOP System." The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and

examination of the safety valves at high pressure and

temperature near their normal operating range, but only

after the valves have had a preliminary cold setting. The

cold setting gives assurance that the valves are OPERABLE

near their design condition. Only one valve at a time will

be removed from service for testing. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months exception

is based on 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each of the four valves.

The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that

hot testing can be performed within this timeframe. ______________________________________________________________________________

ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of

15 minutes reflects the importance of maintaining the RCS

overpressure protection system. An inoperable safety valve

coincident with an RCS overpressure event could challenge

the integrity of the RCPB. B.1 and B.2 If the Required Action cannot be met within the required Completion Time or if two or more pressurizer safety valves

are inoperable, the plant must be brought to a MODE in which

the requirement does not apply. To achieve this status, the

plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and

to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed is

reasonable, based on operating experience, to reach MODE 3

from full power without challenging plant systems.

Similarly, the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed is reasonable, based on

operating experience, to reach MODE 4 without challenging

plant systems.orinaccordancewiththeRiskInformedCompletionTimeProgramInsert1 Insert 1: B 3.4.10-3 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when pressurizer safety valve is intentionally made inoperable. This

Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable

constraints are located in TS section 5.5.20.

Pressurizer Vents B 3.4.12 BASES ______________________________________________________________________________ (continued) _______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.4.12-3 REVISION 48 LCO A vent path is flow capability from the pressurizer to the (continued) RDT or from the pressurizer to containment atmosphere.

Loss of any single valve in the pressurizer vent system will

cause two flow paths to become inoperable. A pressurizer

vent path is required to depressurize the RCS in a SGTR

design basis event which assumes LOP and APSS unavailable. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the four pressurizer vent paths are required to be OPERABLE.

The safety analysis for the SGTR with LOP and a Single

Failure (loss of APSS) credits a pressurizer vent path to

reduce RCS pressure. In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the SGs are the primary means of heat removal in the RCS, until shutdown cooling can be initiated. In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia, assuming the APSS is not available, the pressurizer vent paths are the

credited means to depressurize the RCS to Shutdown Cooling

System entry conditions. Further depressurization into MODE

5 requires use of the pressurizer vent paths. In MODE 5 with

the reactor vessel head in place, temperature requirements

of MODE 5 (< 210°F) ensure the RCS remains depressurized.

In MODE 6 the RCS is depressurized. ______________________________________________________________________________

ACTIONS A.1 If two or three pressurizer vent paths are inoperable, they must be restored to OPERABLE status. Loss of any single

valve in the pressurizer vent system will cause two flow

paths to become inoperable. Any vent path that provides

flow capability from the pressurizer to the RDT or to the

containment atmosphere, independent of which train is

powering the valves in the flow path, can be considered an

operable vent path. The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is

reasonable because there is at least one pressurizer vent

path that remains OPERABLE.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.

Pressurizer Vents B 3.4.12 BASES _______________________________________________________________________________

________________________________________________________________________________ (continued) PALO VERDE UNITS 1,2,3 B 3.4.12-4 REVISION 56 ACTIONS B.1 (continued) If all pressurizer vent paths are inoperable, then restore at least one pressurizer vent path to OPERABLE status. The

Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to allow time to

correct the situation, yet emphasize the importance of

restoring at least one pressurizer vent path. If at least

one pressurizer vent path is not restored to OPERABLE within

the Completion Time, then Action C is entered. C.1 If the required Actions, A and B, cannot be met within the associated Completion Times, the plant must be brought to a

MODE in which the requirement does not apply. To achieve

this status, the plant must be brought to at least MODE 3

within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and to MODE 4 with RCS pressure < 385 psia

within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are

reasonable, based on operating experience, to reach the

required plant conditions from full power conditions in an

orderly manner without challenging plant systems.

_______________________________________________________________________________

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS SR 3.4.12.1 requires complete cycling of each pressurizer vent path valve. The vent valves must be cycled from the

control room to demonstrate their operability. Pressurizer

vent path valve cycling demonstrates its function. The

Surveillance Frequency is controlled under the Surveillance

Frequency Control Program. This surveillance test must be

performed in Mode 5 or Mode 6. In any Mode, partial

surveillance tests can be performed for post-maintenance

testing under site procedural controls that ensure the valve

being tested is isolated from RCS pressure. SR 3.4.12.2 SR 3.4.12.2 requires verification of flow through each pressurizer vent path. Verification of pressurizer vent

path flow demonstrates its function. The Surveillance

Frequency is controlled under the Surveillance Frequency

Control Program. This surveillance test must be performed

in Mode 5 or Mode 6.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.Insert2 Insert 2: B 3.4.12-4 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the last pressurizer vent path is intentionally made inoperable. This

Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if three pressurizer

vent paths are inoperable for any reason and the last vent path is found to be inoperable, or if all pressurizer vent paths are found to be inoperable at the same time.

Note 2 provides constraints for this condition, the applicable constraints are located in

TS section 5.5.20.

SITs-Operating B 3.5.1 BASES _______________________________________________________________________________

(continued)

______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.5.1-8 REVISION 1 ACTIONS B.1 If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

In this Condition, the required contents of three SITs

cannot be assumed to reach the core during a LOCA. CE NPSD-994 (Ref. 6) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either "risk beneficial" or "risk neutral" in comparison to shorter

periods for restoring the SIT to OPERABLE status. CE

NPSD-994 (Ref. 6) discusses best-estimate analysis for a

typical PWR that confirmed that, during large-break LOCA

scenarios, core melt can be prevented by either operation of

one low pressure safety injection (LPSI) pump or the

operation of one high pressure safety injection (HPSI) pump

and a single SIT. CE NPSD-994 (Ref. 6) also discusses

plant-specific probabilistic analysis that evaluated the

risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to

shorter recovery periods. ACTIONS C.1 and C.2 If the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a

MODE in which the LCO does not apply. To achieve this

status, the plant must be brought to at least MODE 3 within

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 1837 psia

within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are

reasonable, based on operating experience, to reach the

required plant conditions from full power conditions in an

orderly manner and without challenging plant systems. Specification 3.5.2, "SITs - Shutdown", further requires the plant to be in Mode 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the SIT

inoperability was discovered but not restored while in the

applicability of Specification 3.5.1, "SITs - Operating". D.1 If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore,

LCO 3.0.3 must be entered immediately. Insert3 D D SIT (s)

Insert 3: B 3.5.1-8 C.1 With two or more SITs inoperable, the Required Action is to restore all but one SIT to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain this safety function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of

sufficient SITs to regain safety function. Alternately, a Completion Time can be

determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent SIT is intentionally made inoperable. The

Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one SIT is inoperable for any reason and additional SITs are found to be inoperable, or if two or more SITs are found to be inoperable at the same time. Note 2 provides constraints for

this condition, the applicable constraints are located in TS section 5.5.20.

ECCS - Operating B 3.5.3 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.5.3-6 REVISION 2 ACTIONS A.1 Condition A addresses the specific condition where the only affected ECCS subsystem is a single LPSI subsystem. The

availability of at least 100% of the ECCS flow equivalent to

a single OPERABLE ECCS train is implicit in the definition

of Condition A.

If LCO 3.5.3 requirements are not met due only to the existence of Condition A, then the inoperable LPSI subsystem

components must be returned to OPERABLE status within 7 days

of discovery of Condition A. This 7 day Completion Time is

based on the findings of the deterministic and probabilistic

analysis that are discussed in Reference 6. Seven days is a

reasonable amount of time to perform many corrective and

preventative maintenance items on the affected LPSI

subsystem. Reference 6 concluded that the overall risk

impact of this Completion Time was either risk-beneficial or

risk-neutral.

The Configuration Risk Management Program (CRMP) in TRM Section 5.0.500.19 applies when Condition A is entered. B.1 If one or more ECCS trains are inoperable, except for reasons other than Condition A (one LPSI subsystem

inoperable), and at least 100% of the ECCS flow equivalent

to a single OPERABLE ECCS train is available, the inoperable

components must be returned to OPERABLE status within

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC

study (Ref. 4) using a reliability evaluation and is a

reasonable amount of time to effect many repairs. An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS. The individual

components are inoperable if they are not capable of

performing their design function, or if supporting systems

are not available.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.

RWT B 3.5.5 BASES _______________________________________________________________________________

(continued)

______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.5.5-8 REVISION 56 ACTIONS B.1 (continued)

With RWT borated water volume not within limits, it must be returned to within limits within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, neither the ECCS nor Containment Spray System can perform

their design functions; therefore, prompt action must be

taken to restore the tank to OPERABLE status or to place the

unit in a MODE in which these systems are not required. The

allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWT to

OPERABLE status is based on this condition since the

contents of the tank are not available for injection and

core cooling.

C.1 and C.2 If the RWT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a

MODE in which the LCO does not apply. To achieve this

status, the plant must be brought to at least MODE 3 within

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed

Completion Times are reasonable, based on operating

experience, to reach the required plant conditions from full

power conditions in an orderly manner and without

challenging plant systems.

_______________________________________________________________________________

SURVEILLANCE SR 3.5.5.1 REQUIREMENTS RWT borated water temperature shall be verified to be within

the limits assumed in the accident analysis. The

Surveillance Frequency is controlled under the Surveillance

Frequency Control Program.

The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures

are within the operating temperature limits of the RWT. With

ambient temperatures within this range, the RWT temperature

should not exceed the limits.

orinaccordancewiththeRiskInformedCompletionTimeProgramInsert4 Insert 4: B 3.5.5-8 The Condition is modified by two Notes. Note 1 states that this condition is not

applicable when RWT is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. The

Required Action is only applicable if RWT is inoperable for any reason other than

Condition A. Note 2 provides constraints for this condition, the applicable constraints are

located in TS section 5.5.20.

Containment Air Locks B 3.6.2 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.2-7 REVISION 0 ACTIONS C.1, C.2, and C.3 (continued) Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This

action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time.

This specified time period is consistent with the ACTIONS of

LCO 3.6.1, which requires that containment be restored to

OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The

specified time period is considered reasonable for restoring

an inoperable air lock to OPERABLE status, assuming that at

least one door is maintained closed in each affected air

lock. D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the

plant must be brought to a MODE in which the LCO does not

apply. To achieve this status, the plant must be brought to

at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant

conditions from full power conditions in an orderly manner

and without challenging plant systems. ______________________________________________________________________________ SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the

Containment Leakage Rate Testing Program. This SR reflects

the leakage rate testing requirements with regard to air

lock leakage (Type B leakage tests). The acceptance

criteria were established during initial air lock and

containment OPERABILITY testing. The periodic testing

requirements verify that the air lock leakage does not

exceed the allowed fraction of the overall containment

leakage rate. The Frequency is required by the Containment

Leakage Rate Testing Program and includes testing of the

airlock doors following each closing, as specified.orinaccordancewiththeRiskInformedCompletionTimeProgram Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-10 REVISION 64 ACTIONS A.1 and A.2 (continued)

In the event one required containment isolation valve in one or

more penetration flow paths is inoperable except for purge valve leakage not within limit (refer to Action D),the affected penetration flow path must be isolated. The method of isolation must include

the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed

manual valve (including a de-activated non-automatic valve),

a blind flange, and a check valve with flow through the valve secured. Compliance with this Action is established via:

1) Administrative controls on the de-activated automatic valve, closed manual valve, blind flange, or check valve, and

2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e., flow/pressure transmitters) located within the penetration that

are not removed from service for maintenance nor open to the

atmosphere are considered a closed loop portion of the associated

penetration; therefore, isolation valves associated with instruments

meeting this criteria need not be isolated nor otherwise

administratively controlled to comply with the requirements of this

Action. For penetrations isolated in accordance with Required

Action A.1, the device used to isolate the penetration should be the

closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting

containment OPERABILITY during MODES 1, 2, 3, and 4. For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and

that have been isolated in accordance with Required Action

A.1, the affected penetration flow paths must be verified to

be isolated on a periodic basis. This is necessary to ensure

that containment penetrations required to be isolated

following an accident and no longer capable of being automatically isolated will be in the isolation position orinaccordancewiththeRiskInformedCompletionTimeProgram Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-11 REVISION 43 ACTIONS A.1 and A.2 (continued) should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside

containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact

that the devices are operated under administrative controls and

the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the

previous 92 days" is based on engineering judgment and is

considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility. Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with

two containment isolation valves. For penetration flow paths with

only one containment isolation valve and a closed system, Condition C provides appropriate actions. Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing

verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the

probability of misalignment of these devices, once they have been

verified to be in the proper position, is small.followingisolation Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-12 REVISION 64 ACTIONS B.1 (continued) With two required containment isolation valves in one or more penetration flow paths inoperable except for purge valve leakage not within limit (refer to Action D), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must

include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that

meet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic

valve), and a blind flange. Compliance with this Action is established via: 1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange, and

2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e.,

flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the

atmosphere are considered a closed loop portion of the associated

penetration; therefore, isolation valves associated with instruments

meeting this criteria need not be isolated nor otherwise

administratively controlled to comply with the requirements of this

Action. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the

ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected

penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under

administrative controls and the probability of their misalignment is low. Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration

flow path.orinaccordancewiththeRiskInformedCompletionTimeProgramNotes.Note1isInsert5 Insert 5: B 3.6.3-12 Note 2 states that RICT is not applicable when the second containment isolation valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 3 provides constraints

for this condition, the applicable constraints are located in TS section 5.5.20.

Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-13 REVISION 64 ACTIONS C.1 and C.2 (continued) With one or more required penetration flow paths with one containment isolation valve inoperable, the inoperable valve must

be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the

use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this

criterion are a closed and de-activated automatic valve, a closed

manual valve (including a de-activated non-automatic valve), and

a blind flange. Compliance with this Action is established via:

1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange and 2) Administrative controls on vents, drains, and test connections located within the

containment penetration. Instruments (i.e., flow/pressure

transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are

considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this

criteria need not be isolated nor otherwise administratively

controlled to comply with the requirements of this Action. A check

valve may not be used to isolate the affected penetration.

Required Action C.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY

during MODES 1, 2, 3, and 4. In the event the affected penetration

is isolated in accordance with Required Action C.1, the affected

penetration flow path must be verified to be isolated on a periodic

basis. This is necessary to assure leak tightness of containment

and that containment penetrations requiring isolation following an

accident are isolated. The Completion Time of once per 31 days

for verifying that each affected penetration flow path is isolated is

appropriate considering the valves are operated under

administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths

with only one containment isolation valve and a closed system. The only credited closed systems are the Steam Generating and the Containment Pressure Monitoring

Systems. This Note is necessary since this Condition is Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime

Program.followingisolation Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-14 REVISION 64 ACTIONS C.1 and C.2 (continued) written to specifically address those penetration flow paths which are neither part of the reactor coolant pressure boundary nor

connected directly to the containment atmosphere (10 CFR 50, APP. A, GDC 57). Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows these

devices to be verified closed by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment of these valves, once

they have been verified to be in the proper position, is small. D.1, D.2, and D.3 In the event one or more required containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within

limits, or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation

barriers that meet this criterion are a closed and de-activated

automatic valve with resilient seals, or a blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.1

must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. Compliance with this Action is established via:

1) Administrative controls on the de-activated automatic valve with resilient seals or blind flange, and 2) Administrative controls on vents, drains, and test connections located within the containment

penetration. Instruments (i.e., flow/pressure transmitters) located

within the penetration that are not removed from service for

maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not

be isolated nor otherwise administratively controlled to comply with the requirements of this Action. The specified Completion Time is reasonable, considering that one containment purge valve remains

closed so that a gross breach of containment does not exist.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.

Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-15 REVISION 43 ACTIONS D.1, D.2 and D.3 (continued) In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The

periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which

are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required

Action does not require any testing or valve manipulation.

Rather, it involves verification, through a system walkdown, that those isolation devices outside containment capable of being mispositioned are in the correct position. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not

performed within the previous 92 days" is based on engineering

judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility. For the required containment purge valve with a resilient seal that is isolated in accordance with Required Action D.1, SR 3.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase

during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6, 184 days, is based on an NRC initiative, Generic

Issue B-20 (Ref. 3). Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more

often. Therefore, a Frequency of once per 92 days was chosen

and has been shown to be acceptable based on operating

experience. E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at

least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions

from full power conditions in an orderly manner and without

challenging plant systems.followingisolationfollowingisolationfollowingisolationInsert6 Insert 6: B 3.6.3-15 Note 1 states that RICT is not applicable when the second containment purge valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints

for this condition, the applicable constraints are located in TS section 5.5.20.

Containment Spray System B 3.6.6 BASES ______________________________________________________________________________ (continued) _____________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.6.6-5 REVISION 1 LCO containment spray actuation signal and automatically (continued) transferring suction to the containment sump on a recirculation actuation signal. Each spray train flow path

from the containment sump shall be via an OPERABLE shutdown

cooling heat exchanger. Therefore, in the event of an accident, the minimum requirements are met, assuming that the worst case single

active failure occurs. Each Containment Spray System typically includes a spray pump, a shutdown cooling heat exchanger, spray headers, nozzles, valves, piping, instruments, and controls to ensure

an OPERABLE flow path capable of taking suction from the RWT

upon an ESF actuation signal and automatically transferring

suction to the containment sump. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, and 3, and Mode 4 with RCS pressure 385 psia, a DBA could cause a release of radioactive material to

containment and an increase in containment pressure and

temperature, requiring the operation of the containment

spray trains. In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6, the probability and consequences of these events are reduced

due to the pressure and temperature limitations of these

MODES. Thus, the Containment Spray System is not required

to be OPERABLE in these MODES. ______________________________________________________________________________

ACTIONS A.1 With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status

within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE

spray train is adequate to perform the iodine removal, hydrogen mixing, and containment cooling functions. The

72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundant

heat removal capability afforded by the Containment Spray

System, reasonable time for repairs, and the low probability

of a DBA occurring during this period.orinaccordancewiththeRiskInformedCompletionTimeProgram MSIVs B 3.7.2 BASES (continued) ______________________________________________________________________________ (continued) ______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.2-7 REVISION 59 ACTIONS E.1 (continued)

(continued) or more MSIVs inoperable while in MODE 1 requires entry

into LCO 3.0.3.

F.1 With one MSIV inoperable in MODE 1, time is allowed to restore the component to OPERABLE status. Some repairs can

be made to the MSIV with the unit hot. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Completion Time is reasonable, considering the probability

of an accident occurring during the time period that would

require closure of the MSIVs.

Condition F is entered when one MSIV is inoperable in MODE 1, including when both actuator trains for one MSIV

are inoperable. When only one actuator train is inoperable

on one MSIV, Condition A applies.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that normally allowed for containment isolation valves that isolate a

closed system penetrating containment. These valves differ

from other containment isolation valves in that the closed

system provides an additional means for containment

isolation.

G.1 If the MSIV cannot be restored to OPERABLE within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the unit must be placed in a MODE in which the LCO does not

apply. To achieve this status, the unit must be placed in

MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition H would be entered. The

Completion Time is reasonable, based on operating

experience, to reach MODE 2, and close the MSIVs in an

orderly manner and without challenging unit systems.

H.1 and H.2 Condition H is modified by a Note indicating that separate Condition entry is allowed for each MSIV.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to

OPERABLE status or closed. When closed, the MSIVs are

already in the position required by the assumptions in the

safety analysis.

Alternately,theCompletionTimecanbe determinedinaccordance withtheRiskInformed CompletionTimeProgram.Insert7 H I I I I Insert 7: B 3.7.2-7 G.1 With two or more MSIVs inoperable, the Required Action is to restore all but one MSIV

to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of main steam line isolation. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for

restoration of sufficient required MSIVs. Alternately, a Completion Time can be

determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not

applicable when the second or a subsequent MSIV is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one MSIV is

inoperable for any reason and additional MSIVs are found to be inoperable, or if two or more MSIVs are found to be inoperable at the same time. Note 2 provides constraints

for this condition, the applicable constraints are located in TS section 5.5.20.

MSIVs B 3.7.2 BASES (continued)

_______________________________________________________________________________

(continued)

______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.2-8 REVISION 54 ACTIONS H.1 and H.2 (continued)

(continued)

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that allowed

in Condition F.

Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must

be verified on a periodic basis to be closed. This is

necessary to ensure that the assumptions in the safety

analysis remain valid. The 7 day Completion Time is

reasonable, based on engineering judgment, MSIV status

indications available in the control room, and other

administrative controls, to ensure these valves are in the

closed position.

I.1 and I.2 If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must

be placed in a MODE in which the LCO does not apply. To

achieve this status, the unit must be placed in at least

MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions

from MODE 2 conditions in an orderly manner and without

challenging unit systems.

_______________________________________________________________________________

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is

within the limit given in Reference 5 with each actuator

train on an actual or simulated actuation signal and is

within that assumed in the accident and containment

analyses. This SR also verifies the valve closure time is

in accordance with the Inservice Testing Program. This SR

is normally performed upon returning the unit to operation

following a refueling outage. The MSIVs should not be full

stroke tested at power.

The Frequency for this SR is in accordance with the Inservice Testing Program. This Frequency demonstrates the

valve closure time at least once per refueling cycle.

I I J J MFIVs B 3.7.3 BASES (continued) ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.3-3 REVISION 37 APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam

generators. This ensures that, in the event of an HELB, a

single failure cannot result in the blowdown of more than

one steam generator. In MODES 1, 2, 3, and 4, the MFIVs are required to be OPERABLE, except when they are closed and deactivated or

isolated by a deactivated and closed power operated valve, in order to limit the amount of available fluid that could

be added to containment in the case of a secondary system

pipe break inside containment. When the valves are closed

or isolated by a closed power operated valve, they are

already performing their safety function. In MODES 5 and 6, steam generator energy is low. Therefore, the MFIVs are not required. ______________________________________________________________________________ ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each penetration

flow path. A.1 and A.2 With one MFIV inoperable, action must be taken to close or isolate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these

valves are closed or isolated, they are performing their

required safety function (e.g., to isolate the line). The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and

the low probability of an event occurring during this time

period that would require isolation of the MFW flow paths. Inoperable MFIVs that are closed to comply with Required Action A.1 must be verified on a periodic basis to be

closed. This is necessary to ensure that the assumptions in

the safety analysis remain valid. The seven day completion

time is responsible, based on engineering judgement, MFIV

status indications available in the control room, and other

administrative controls, to ensure these valves are in the

closed position.

With one or more MFIV s inoperable, action must be taken to restore the MFIV(s) to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance

with the Risk Informed Completion Time Program OR to close or isolate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

A.1, A.2.1, and A.2.2 A.2.1 reasonable (editorial)followingisolation7(editorial)

MFIVs B 3.7.3 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.3-4 REVISION 0 ACTIONS B.1 and B.2 (continued)

If more than one MFIV in the same flow path cannot be

restored to OPERABLE status, then there may be no system to

operate automatically and perform the required safety

function. Under these conditions, valves in each flow path

must be restored to OPERABLE status, closed, or the flow

path isolated within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This action returns the

system to the condition where at least one valve in each

flow path is performing the required safety function. The

8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable to close an MFIV or

otherwise isolate the affected flow path. Inoperable MFIVs that cannot be restored to OPERABLE status within the Completion Time, but are closed or isolated, must

be verified on a periodic basis that they are closed or

isolated. This is necessary to ensure that the assumptions

in the safety analysis remain valid. The 7 day Completion

Time is reasonable, based on engineering judgment, in view

of valve status indications available in the control room, and other administrative controls to ensure that these

valves are closed or isolated. C.1 and C.2 If the MFIVs cannot be restored to OPERABLE status, closed, or isolated in the associated Completion Time, the unit must

be placed in a MODE in which the LCO does not apply. To

achieve this status, the unit must be placed in at least

MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions

from full power conditions in an orderly manner and without

challenging unit systems.

With two valves in the same flow path

inoperable, action

must be taken to

restore one valve to

OPERABLE status

within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in

accordance with the

Risk Informed

Completion Time

Program OR isolate

the affected flow

path.restore an MFIV to OPERABLE status, or to B.1, B.2.1, and B.2.2 Insert 8 Insert 8: B 3.7.3-4 The Condition is modified by two Notes. Note 1 states that RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable. This

Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable

constraints are located in TS section 5.5.20.

ADVs B 3.7.4 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.4-5 REVISION 58 ACTIONS A.1 The condition for this ACTION is modified by a Note that states separate Condition entry is allowed for each SG.

This is acceptable because only one SG is required for RCS

heat removal after a design basis accident, and because

this Condition provides the appropriate Required Action and

Completion Time for one inoperable ADV line on each SG. With one ADV line on a SG inoperable, action must be taken to restore that ADV line to OPERABLE status within 7 days

to meet the LCO for each SG that has entered this

Condition. The 7-day Completion Time takes into

consideration the redundant capability afforded by the

remaining OPERABLE ADV lines, the safety grade MSSVs, and

the non-safety grade backup of the SBCS. B.1 With two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs, action must be taken to

restore one ADV line on each SG to OPERABLE status within 24

hours. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair

inoperable ADV lines, based on the availability of the Steam

Bypass Control System and MSSVs, and the low probability of

an event occurring during this period that requires the ADV

lines. NOTE: Entry into Condition B for all four ADV lines simultaneously inoperable is not intended for voluntary removal of

redundant systems or components from service in lieu of

other alternatives that would not result in redundant

systems or components being inoperable.

Alternately,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTime

Pro g ram.Alternately,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCom pletionTimePro g ram.Insert9 Insert 9: B 3.7.4-5 The Condition is modified by two Notes. Note 1 states that this condition is not

applicable when the last ADV intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The

Required Action is only applicable if two or more ADV lines are found inoperable with both ADV lines inoperable on one or more SGs and the last ADV line is found to be inoperable, or if all ADV lines are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS

section 5.5.20.

AFW System B 3.7.5 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.5-5 REVISION 42 APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE and to function in the event that the MFW System is

lost. In addition, the AFW System is required to supply

enough makeup water to replace steam generator secondary

inventory, lost as the unit cools to MODE 4 conditions. In MODE 4, the AFW System may be used for heat removal via the steam generator. In MODES 5 and 6, the steam generators are not normally used for decay heat removal, and the AFW System is not required. ______________________________________________________________________________ A note prohibits the application of LCO 3.0.4.b to an inoperable AFW Train. There is an increased risk associated

with entering a MODE or other specified condition in the

applicability with an AFW train inoperable and the

provisions of LCO 3.0.4.b which allows entry into a MODE or

other specified condition in the Applicability with the LCO

not met after performance of a risk assessment addressing

inoperable systems and components, should not be applied in

this circumstance.

ACTIONS A.1 If one of the two steam supplies to the turbine driven AFW pumps is inoperable, or if a turbine driven pump is

inoperable while in MODE 3 immediately following refueling (prior to MODE 2), action must be taken to restore OPERABLE

status within 7 days. The 7 day Completion Time is

reasonable based on the following reasons: a. For the inoperability of a steam supply to the turbine-driven AFW pump, the 7 day Completion time is

reasonable since there is a redundant steam supply

line for the turbine driven pump. b. For the inoperability of a turbine-driven AFW pump while in MODE 3 immediately subsequent to a refueling

outage, the 7 day Completion time is reasonable due to

the minimal decay heat levels in this situation. c. For both the inoperability of a steam supply line to the turbine-driven pump and an inoperable turbine-

driven AFW pump while in MODE 3 immediately following

a refueling outage, the 7 day Completion time is

reasonable due to the availability of redundant

OPERABLE motor driven AFW pumps. orinaccordancewiththeRiskInformedCompletionTimeProgram AFW System B 3.7.5 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 63 ACTIONS A.1 (continued) Condition A is modified by a Note which limits the applicability of the Condition to when the unit has not entered MODE 2 following a refueling. Condition A allows

the turbine-driven AFW pump to be inoperable for 7 days vice

the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time in Condition B. This longer

Completion Time is based on the reduced decay heat following

refueling and prior to the reactor being critical. It should be noted that when in this Condition with one steam supply to the turbine driven AFW pump inoperable, that

the AFA train of AFW is considered to be inoperable. B.1 With one of the required AFW trains (pump or flow path) inoperable, action must be taken to restore OPERABLE status

within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condition includes the loss of two

steam supply lines to the turbine driven AFW pump. The

72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on the

redundant capabilities afforded by the AFW System, the time

needed for repairs, and the low probability of a DBA event

occurring during this period. Two AFW pumps and flow paths

remain to supply feedwater to the steam generators.

C.1 and C.2 When either Required Action A.1 or B.1 cannot be completed

within the required Completion Time, or if two AFW trains

are inoperable in MODES 1, 2, and 3, the unit must be placed

in a MODE in which the LCO does not apply.

To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply

to the turbine driven AFW pump is inoperable, coincident

with another ("B" or "N") AFW train inoperable. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full

power conditions in an orderly manner and without challenging

unit systems. orinaccordancewiththeRiskInformed Com pletionTimePro g ramInsert10 D D,B.1,orC.1 Insert 10: B 3.7.5-6 C.1 With two AFW trains inoperable in MODE 1, 2, or 3, the Required Action is to restore at

least one AFW train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of decay heat removal. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one AFW train. Alternately, a Completion

Time can be determined in accordance with the Risk Informed Completion Time

Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second AFW train is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable

if one AFW train is inoperable for any reason and a second AFW train is found to be inoperable, or if two AFW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS

section 5.5.20.

In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO. Although it is not required, the unit may continue to cool down and start the Shutdown Cooling System.

AFW System B 3.7.5 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.5-7 REVISION 63 ACTIONS C.1 and C.2 (continued) In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required

in accordance with the Note that modifies the LCO. Although

it is not required, the unit may continue to cool down and

start the SDC. D.1 Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended

until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the

conditions is entered. The Completion Time is resumed with

the time remaining when the Condition was entered upon

restoration of one AFW train to OPERABLE status. With all three AFW trains inoperable in MODES 1, 2, and 3, the unit is in a seriously degraded condition with no TS

related means for conducting a cooldown, and only limited

means for conducting a cooldown with nonsafety grade

equipment. In such a condition, the unit should not be

perturbed by any action, including a power change, that

might result in a trip. The seriousness of this condition

requires that action be started immediately to restore one

AFW train to OPERABLE status. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition. E.1 Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended

until one AFW train is restored to OPERABLE status.

Completion Times are also suspended at the time the

Condition is entered. The Completion Time is resumed with

the time remaining when the Condition was entered upon

restoration of one AFW train to OPERABLE status.

With one AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status

or to immediately verify, by administrative means, the

OPERABILITY of a second train. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.Includedaslastparagraphinnew"C.1" above.(Insert8)

E E F F AFW System B 3.7.5 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.5-8 REVISION 63 ACTIONS E.1 (continued) In MODE 4, either the reactor coolant pumps or the SDC loops can be used to provide forced circulation as discussed in

LCO 3.4.6, "RCS Loops - MODE 4." _______________________________________________________________________________

SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW water and steam supply flow

paths provides assurance that the proper flow paths exist

for AFW operation. This SR does not apply to valves that

are locked, sealed, or otherwise secured in position, since

these valves are verified to be in the correct position

prior to locking, sealing, or securing. This SR also does

not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require

any testing or valve manipulations; rather, it involves

verification that those valves capable of potentially being

mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required

developed head ensures that AFW pump performance has not

degraded during the cycle. Flow and differential head are

normal tests of pump performance required by the ASME OM

Code (Ref. 2). Because it is undesirable to introduce cold

AFW into the steam generators while they are operating, this

testing may be performed on recirculation flow. This test

confirms one point on the pump design curve and can be

indicative of overall performance. Such inservice tests

confirm component OPERABILITY, trend performance, and detect

incipient failures by indicating abnormal performance.

Performance of inservice testing, discussed in the ASME OM

Code, (Ref. 2), at 3 month intervals satisfies this

requirement.

F EW System B 3.7.7 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.7-3 REVISION 1 LCO (continued) not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable

in this situation because it is operating outside of the

acceptable limits of the system. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, 3, and 4, the EW System must be prepared to perform its post accident safety functions, primarily RCS

heat removal by cooling the SDC heat exchanger.

When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EW System shall be consistent with the

definition of OPERABILITY which requires (support) equipment

to be capable of performing its related support function(s). ______________________________________________________________________________

ACTIONS A.1 Required Action A.1 is modified by a Note indicating the requirement of entry into the applicable Conditions and

Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," for SDC

made inoperable by EW. This note is only applicable in Mode

4. This is an exception to LCO 3.0.6 and ensures the proper

actions are taken for these components.

With one EW train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE EW train is adequate to perform the

heat removal function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based

on the redundant capabilities afforded by the OPERABLE

train, and the low probability of a DBA occurring during

this period.

B.1 and B.2 If the EW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a

MODE in which the LCO does not apply. To achieve this

status, the unit must be placed in at least MODE 3 within

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . orinaccordancewiththeRiskInformedCompletionTimeProgramInsert11 C C train(s)

Insert 11: B 3.7.7-3 B.1 With two EW trains inoperable, the Required Action is to restore at least one of the

required EW trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety

related components. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion

Time can be determined in accordance with the Risk Informed Completion Time

Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second EW train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from

service. The Required Action is only applicable if one EW train is inoperable for any reason and a second EW train is found to be inoperable, or if two EW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the

applicable constraints are located in TS section 5.5.20.

EW System B 3.7.7 BASES _______________________________________________________________________________

(continued)

______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.7-4 REVISION 56 ACTIONS B.1 and B.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions

from full power conditions in an orderly manner and without

challenging unit systems.

_______________________________________________________________________________

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EW flow path provides assurance

that the proper flow paths exist for EW operation. This SR

does not apply to valves that are locked, sealed, or

otherwise secured in position, since these valves are

verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves

that cannot be inadvertently misaligned, such as check

valves. This Surveillance does not require any testing or

valve manipulation; rather, it involves verification that

those valves capable of potentially being mispositioned are

in their correct position.

This SR is modified by a Note indicating that the isolation of the EW components or systems renders those components or

systems inoperable but does not necessarily affect the

OPERABILITY of the EW System. Isolation of the EW System to

the Essential Chiller, while rendering the Essential Chiller

inoperable, is acceptable and does not impact the

OPERABILITY of the EW System. Isolation of the EW System to

the SDC system heat exchanger is not acceptable and would

render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation

because it is operating outside of the acceptable limits of

the system.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.2 This SR verifies proper automatic operation of the EW valves on an actual or simulated actuation signal. This

Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under C

ESPS B 3.7.8 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION 1 ACTIONS A.1 With one ESPS train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE ESPS train is adequate to perform the

heat removal function. However, the overall reliability is

reduced because a single failure in the ESPS train could

result in loss of ESPS function. Required Action A.1 is

modified by two Notes. The first Note indicates that the

applicable Conditions of LCO 3.8.1, "AC Sources - Operating,"

must be entered when the inoperable ESPS train results in an

inoperable emergency diesel generator. The second Note

indicates that the applicable Conditions and Required

Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered

if an inoperable ESPS train results in an inoperable SDC

System. This note is only applicable in MODE 4. The

72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant

capabilities afforded by the OPERABLE train, and the low

probability of a DBA occurring during this time period.

B.1 and B.2 If the ESPS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be

placed in a MODE in which the LCO does not apply. To

achieve this status, the unit must be placed in at least

MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions

from full power conditions in an orderly manner and without

challenging unit systems. ______________________________________________________________________________ SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual and power

operated, valves in the ESPS flow path ensures that the

proper flow paths exist for ESPS operation. This SR does

not apply to valves that are locked, sealed, or otherwise

secured in position, since they are verified to be in the

correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be

inadvertently misaligned, such as check valves. This orinaccordancewiththeRiskInformedCompletionTimeProgramInsert12 train(s)C C Insert 12: B 3.7.8-3 B.1 With two ESPS trains inoperable, the Required Action is to restore at least one of the required ESPS trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety

related components. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion

Time can be determined in accordance with the Risk Informed Completion Time

Program.

The Condition is modified by two Notes. Note 1 states that this condition is not

applicable when the second ESPS train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from

service. The Required Action is only applicable if one ESPS train is inoperable for any reason and a second ESPS train is found to be inoperable, or if two ESPS trains are

found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.

EC System B 3.7.10 BASES ______________________________________________________________________________ (continued) _____________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.7.10-3 REVISION 1 APPLICABILITY (continued) When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EC System shall be consistent with the

definition of OPERABILITY which requires (support) equipment

to be capable of performing its related support function(s). ______________________________________________________________________________

ACTIONS A.1 If one EC train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, one OPERABLE ECW train is adequate to perform the cooling

function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based

on the low probability of an event occurring during this

time and the 100% capacity OPERABLE EC train. B.1 and B.2 If the EC train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a

MODE in which the LCO does not apply. To achieve this

status, the unit must be placed in at least MODE 3 within

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed

Completion Times are reasonable, based on operating

experience, to reach the required unit conditions from full

power conditions in an orderly manner and without

challenging unit systems. ______________________________________________________________________________ SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EC flow path provides assurance

that the proper flow paths exist for EC operation. This SR

does not apply to valves that are locked, sealed, or

otherwise secured in position, since they are verified to be

in the correct position prior to locking, sealing, or

securing. This SR also does not apply to valves that cannot

be inadvertently misaligned, such as check valves. This

Surveillance does not require any testing or valve

manipulation; rather, it involves verification that those

valves capable of potentially being mispositioned are in the

correct position.orinaccordancewiththeRiskInformedCompletion TimeProgrameditorialchangeInsert13 train(s)C C Insert 13: B 3.7.10-3 B.1 With two EC trains inoperable, the Required Action is to restore at least one train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety-related air handling systems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be

determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not

applicable when the second EC train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from

service. The Required Action is only applicable if one EC train is inoperable for any reason and a second EC train is found to be inoperable, or if two EC trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the

applicable constraints are located in TS section 5.5.20.

AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-9 REVISION 63 ACTIONS A.2 (continued) Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable

time for repairs, and the low probability of a DBA occurring during

this period. A.3 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is

increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE

offsite circuit and DGs are adequate to supply electrical power to

the onsite Class 1E Distribution System. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for

repairs, and the low probability of a DBA occurring during this

period. B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite

circuits on a more frequent basis. Since the Required Action only

specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if an offsite circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit

inoperability, additional Conditions and Required Actions must then

be entered. B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of redundant required

features. These features require Class 1E power from PBA-S03 or PBB-S04 ESF buses to be OPERABLE, and are identical to those

specified in ACTION A.2. Mode applicability is as specified in each appropriate TS section. Redundant required feature failures consist

of Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.

AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-12 REVISION 63 ACTIONS B.4 (continued) In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E

Distribution System. The 10 day Completion Time takes into

account the capacity and capability of the remaining AC sources, a

reasonable time for repairs, and the low probability of a DBA

occurring during this period. When utilizing an extended DG Completion Time (a Completion Time greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and less than or equal to 10 days), the

compensatory measures listed below shall be implemented. For planned maintenance utilizing an extended Completion Time, the compensatory measures shall be implemented prior to entering Condition B. For an unplanned entry into an extended Completion

Time, the compensatory measures shall be implemented without delay. 1. The redundant DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified OPERABLE (as required by TS) and no discretionary maintenance activities will be scheduled on the redundant (OPERABLE) DG. 2. No discretionary maintenance activities will be scheduled on the station blackout generators (SBOGs). 3. No discretionary maintenance activities will be scheduled on the startup transformers. 4. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and

transformers which could cause a line outage or challenge

offsite power availability to the unit utilizing the extended DG

Completion Time. 5. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled.

Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded

approach according to risk significance. 6. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.

AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-13 REVISION 63 ACTIONS B.4 (continued) 7. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

Additionally, DG outages will not be scheduled when severe

weather conditions and/or unstable grid conditions are

predicted or present. 8. All maintenance activities associated with the unit that is utilizing the extended DG Completion Time will be assessed and

managed per 10 CFR 50.65 (Maintenance Rule). 9. The functionality of the SBOGs will be verified by ensuring that the monthly start test has been successfully completed within

the previous four weeks before entering the extended DG

Completion Time. 10. The OPERABILITY of the steam driven auxiliary feedwater pump will be verified before entering the extended DG

Completion Time. 11. The system dispatcher will be contacted once per day and informed of the DG status, along with the power needs of the

facility. 12. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply

during the extended DG Completion Time, an operator will be

available locally at the SBOG should local operation of the

SBOG be required as a result of on-site weather related

damage. 13. No discretionary maintenance will be allowed on the main and unit auxiliary transformers associated with the unit. If one or more of the above compensatory measures is not met while in the extended completion time, the corrective action program shall be entered, the risk managed in accordance with the Maintenance Rule, and the compensatory measure(s) restored

without delay.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTime

Program.

AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-15 REVISION 64 CORRECTED ACTIONS C.1 and C.2 (continued) Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more

DGs inoperable. However, two factors tend to decrease the severity of

this level of degradation: a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or

switching failure; and b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source. With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of

offsite AC sources, a LOCA, and a worst case single failure were

postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect

restoration of one of the offsite circuits commensurate with the

importance of maintaining an AC electrical power system capable of

meeting its design criteria. According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources, two less than required by the LCO, operation may

continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24

hours, unrestricted operation may continue. If only one offsite source

is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance

with Condition A.

Condition C applies only when the offsite circuits are unavailable to commence automatic load sequencing in the event of a design basis accident (DBA). In cases where the offsite circuits are available for sequencing, but a DBA could cause actuation of the Degraded Voltage Relays, Condition G applies for Class 1E bus(es) with single stage time delay DVRs and inverse time delay LVRs.

Alternatively,aCompletionTimecanbedeterminedin accordancewiththeRisk InformedCompletionTime

Program.

AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-16 REVISION 63 CORRECTED ACTIONS D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered

with no AC source to a train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train. According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12

hours. In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system.

Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this

Condition may appear higher than that in Condition C (loss of both

required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or

switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account

the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA

occurring during this period. E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite

electrical power, insufficient standby AC sources are available to

power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level

of degradation, the risk associated with continued operation for a

short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid

instability, which could result in a total loss of AC Alternatively,aCompletionTimecan bedeterminedin accordancewiththe RiskInformed CompletionTime

Program.Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCom pletionTimePro g ram.

AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-17 REVISION 64 CORRECTED ACTIONS E.1 (continued) power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued

operation is severely restricted. The intent here is to avoid the risk

associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation. According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, operation may continue for a period that should not

exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated

ESF bus. Therefore, loss of an ESF bus sequencer affects every major ESF system in the load group. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to correct the problem commensurate with

the importance of maintaining sequencer OPERABILITY. This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the

sequencer is inoperable is minimal. Required Action F.2 is intended

to provide assurance that a single failure of a DG Sequencer will not result in a complete loss of safety function of critical redundant

required features. G.1 and G.2 A Note indicates that Condition G is not applicable for Class 1E bus(es) provided with a two stage time delay for the Degraded Voltage Relays (DVR) and a fixed time delay Loss of Voltage Relays (LVR). The DVRs are being modified to install a two stage time delay design: one short stage time delay for when a SIAS is present and a second long stage time delay when no SIAS is present. The LVRs are being modified to replace the existing mechanical inverse time delay relays with fixed time delay relays. Condition G is not applicable to Class 1E bus DVRs and LVRs that have been modified. The installation of the two stage time delays ensures automatic actuation of the DVRs within the assumptions of the accident analysis should the offsite source post-trip voltage be degraded. Conditions A and C remain applicable to Class 1E buses that have been modified. The more restrictive requirements of Condition G reflect the single stage time delay DVR design not being consistent with the time delay assumptions of the accident analysis.

Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformed CompletionTimeProgram.Insert14 Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.

Insert 14: B 3.8.1-17 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DG train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from

service. The Required Action is only applicable if one DG train is inoperable for any reason and a second DG train is found to be inoperable, or if two DG trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the

applicable constraints are located in TS section 5.5.20.

AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-22 REVISION 41 ACTIONS H.1 and H.2 (continued) If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To

achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed

Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. I.1 Condition I corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At

this severely degraded level, any further losses in the AC electrical

power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by

LCO 3.0.3 to commence a controlled shutdown. _______________________________________________________________________ SURVEILLANCE The AC sources are designed to permit inspection and testing REQUIREMENTS of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated

accident conditions).

The SR for demonstrating OPERABILITY of the DGs are based on the recommendations of Regulatory Guide 1.9 (Ref. 3), unless otherwise noted in the Updated FSAR Section 1.8.

The DG capabilities (starting and loading) are required to be met from a variety of initial conditions such as DG in standby condition

with the engine hot (SR 3.8.1.15) and DG in standby condition with

the engine at normal keep-warm conditions (SR 3.8.1.2, SR 3.8.1.7 and SR 3.8.1.19). Although it is expected that most DG starts will

be performed from normal keep-warm conditions, DG starts should

be performed with the jacket water cooling and lube oil temperatures within the lower to upper limits of DG OPERABILITY, except as noted above. Rapid cooling of the DG down to normal keep-warm conditions should be minimized. Insert15 I I Insert 15: B 3.8.1-22 H.1 With three or more required AC sources inoperable, the Required Action is to restore the required AC source(s) to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain some level of redundancy in the AC electrical power supplies. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of required AC sources. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the third or a subsequent required AC source is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two

required AC sources are inoperable for any reason and additional required AC sources are found to be inoperable, or if three or more required AC sources are found to be

inoperable at the same time. Note 2 provides constraints for this condition, the

applicable constraints are located in TS section 5.5.20.

DC Sources - Operating B 3.8.4 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.8.4-7 REVISION 61 ACTIONS Required Action A.3 limits the restoration time for the (continued) inoperable battery charger to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used. The backup class 1E charger is used to restore OPERABILITY as no balance of plant non-class 1E battery charger exists. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status. B.1 Condition B represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. This

condition is exclusive of the status of one battery charger.

It is therefore, imperative that the operator's attention

focus on stabilizing the unit, minimizing the potential for

complete loss of DC power to the affected subsystem. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an

inoperable DC distribution subsystem.

If one of the required DC electrical power subsystems is

inoperable for reasons other than Condition A, the remaining DC electrical power subsystem has the capacity to support a

safe shutdown and to mitigate an accident condition. Since a

subsequent worst case single failure would, however, result

in the complete loss of the remaining 125 VDC electrical

power subsystem with attendant loss of ESF functions, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The

2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit

status as a function of the inoperable DC electrical power

subsystem and, if the DC electrical power subsystem is not

restored to OPERABLE status, to prepare to effect an orderly

and safe unit shutdown.orinaccordancewiththeRiskInformedCompletionTimeProgram DC Sources - Operating B 3.8.4 BASES _______________________________________________________________________________

(continued)

______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.8.4-8 REVISION 61 ACTIONS C.1 and C.2 (continued)

If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be

brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5

within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the

required unit conditions from full power conditions in an

orderly manner and without challenging unit systems. The

Completion Time to bring the unit to MODE 5 is consistent

with the time required in Regulatory Guide 1.93 (Ref. 8).

_______________________________________________________________________________

SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the

battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous

charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.17 volts per cell (Vpc) times the number of connected cells or 130.2 V for a 60 cell battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 and SR 3.8.4.5 Deleted Insert16 D D Insert 16: B 3.8.4-8 C.1 With two DC electrical power subsystems inoperable, the Required Action is to restore

at least one DC electrical power subsystem to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain control power for the AC emergency power system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required DC electrical power subsystem. Alternately, a Completion Time can be

determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DC electrical power subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one DC electrical power subsystem is inoperable for any reason and a second DC electrical power subsystem is found to be inoperable, or if two DC electrical power subsystem are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS

section 5.5.20.

Inverters Operating 4 ______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.8.7-4 REVISION 63 BASES _______________________________________________________________________________

ACTIONS A.1 (continued)

Required Action A.1 allows 7 days to fix the inoperable inverter and return it to service. The 7 day limit is a

risk informed Completion Time based on a plant specific risk

analysis, taking into consideration the time required to

repair an inverter and the additional risk to which the unit

is exposed because of the inverter inoperability. This has

to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a

shutdown might entail. When the AC vital instrument bus is

powered from its constant voltage source, it is relying upon

interruptible AC electrical power sources (offsite and

onsite). The uninterruptible inverter source to the AC

vital instrument buses is the preferred source for powering

instrumentation trip setpoint devices.

Planned inverter maintenance or other activities that require entry into Required Action A.1 will not be

undertaken concurrent with the following:

a. Planned maintenance on the associated train Diesel Generator (DG): or

b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.

These actions are taken because it is recognized that with a required inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated DG

following a loss of offsite power event. B.1 and B.2 If the required inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO

does not apply. To achieve this status, the unit must be

brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5

within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are

reasonable, based on operating experience, to reach the

required unit conditions from full power conditions in an

orderly manner and without challenging unit systems. basedonacombinationof deterministicdefense-in-depthandsafety margininherentinthe electricaldistribution systemwithrisk insightsfromthe station'sinternal eventsPRAmodel.

Alternatively,aCompletionTimecan bedeterminedin accordancewiththe RiskInformed CompletionTime

Program.Insert17 C CB3.8.7 Insert 17: B 3.8.7-4 B.1 With two or more required inverters inoperable, the Required Action is to restore all but

one required inverter to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain AC electrical power to the vital buses. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required inverter. Alternately, a

Completion Time can be determined in accordance with the Risk Informed Completion

Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent required inverter is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one required inverter is inoperable for any reason and additional required inverters are found to be inoperable, or if two or more required

inverters are found to be inoperable at the same time. Note 2 provides constraints for

this condition, the applicable constraints are located in TS section 5.5.20.

Distribution Systems - Operating B 3.8.9 BASES (continued)

_______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.8.9-4 REVISION 63 ACTIONS A.1 With one or more required AC buses, load centers, or motor control centers (see Table B 3.8.9.-1), except AC vital

instrument buses, in one subsystem inoperable, the remaining

AC electrical power distribution subsystem in the other

train is capable of supporting the minimum safety functions

necessary to shut down the reactor and maintain it in a safe

shutdown condition, assuming no single failure. The overall

reliability is reduced, however, because a single failure in

the remaining power distribution subsystems could result in

the minimum required ESF functions not being supported.

Therefore, the required AC buses, load centers and motor

control centers must be restored to OPERABLE status within

8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Condition A worst scenario is one train (PBA or PBB) without AC power (i.e., no offsite power to the train and the

associated DG inoperable). In this condition, the unit is

more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be

focused on minimizing the potential for loss of power to the

remaining train by stabilizing the unit, and on restoring

power to the affected train. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before

requiring a unit shutdown in this condition is acceptable

because of: a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations

and actions necessary to restore power to the affected

train, to the actions associated with taking the unit

to shutdown within this time limit; and b. The potential for an event in conjunction with a single failure of a redundant component in the train

with AC power. B.1 With AC vital instrument bus(es) (Channels A or C, or Channels B or D) (see Table B 3.8.9-1) in one train

inoperable, the remaining OPERABLE AC vital bus electrical

power distribution subsystem is capable of supporting the

minimum safety functions necessary to shut down the unit

and maintain it in the safe shutdown condition. OverallorinaccordancewiththeRiskInformed CompletionTime

Program Distribution Systems - Operating B 3.8.9 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.9-5 REVISION 63 ACTIONS B.1 (continued) reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions

not being supported. Therefore, the required AC vital

instrument buses must be restored to OPERABLE status within

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated inverter via

inverted DC voltage or the Class 1E constant voltage

regulator. Condition B represents one train without adequate AC vital instrument bus power; potentially both the DC source and the

associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss

of all noninterruptible power. It is, therefore, imperative

that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of OPERABILITY to the

remaining vital instrument buses, and restoring power to the

affected electrical power distribution subsystem.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components that are without

adequate AC vital instrument power. Taking exception to

LCO 3.0.2 for components without adequate AC vital

instrument power, which would have the Required Action

Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared

inoperable, is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)

and not allowing stable operations to continue; b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required

Actions for components without adequate AC vital

instrument power and not providing sufficient time for

the operators to perform the necessary evaluations and

actions for restoring power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time takes into account the importance to safety of restoring the AC vital instrument bus to

OPERABLE status, the redundant capability afforded by the

other OPERABLE vital instrument buses, and the low

probability of a DBA occurring during this period.

Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime

Program.

Distribution Systems - Operating B 3.8.9 BASES _______________________________________________________________________________

(continued)

_______________________________________________________________________________

PALO VERDE UNITS 1,2,3 B 3.8.9-6 REVISION 63 ACTIONS C.1 With DC bus(es) in one train (see Table B 3.8.9-1) inoperable, the remaining DC electrical power distribution

subsystem is capable of supporting the minimum safety

functions necessary to shut down the reactor and maintain it

in a safe shutdown condition, assuming no single failure.

The overall reliability is reduced, however, because a

single failure in the remaining DC electrical power

distribution subsystem could result in the minimum required

ESF functions not being supported. Therefore, the required

DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months

by powering the bus from the associated battery or battery

charger. Condition C represents one train without adequate DC power; potentially both with the battery significantly degraded and

the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss

of all DC power. It is, therefore, imperative that the

operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining

DC buses and restoring power to the affected DC electrical

power distribution subsystem.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components which would be

without power. Taking exception to LCO 3.0.2 for components

without adequate DC power, which would have Required Action

Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because

of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)

while allowing stable operations to continue; b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required

Actions for components without DC power and not

providing sufficient time for the operators to perform

the necessary evaluations and actions for restoring

power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).

Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime

Program.

Distribution Systems - Operating B 3.8.9 BASES ______________________________________________________________________________ ______________________________________________________________________________ (continued) PALO VERDE UNITS 1,2,3 B 3.8.9-7 REVISION 63 ACTIONS D.1 and D.2 (continued) If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the

unit must be brought to a MODE in which the LCO does not

apply. To achieve this status, the unit must be brought to

at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within

36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit

conditions from full power conditions in an orderly manner

and without challenging unit systems. E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety

function to be lost. When more than one Condition is

entered, and this results in the loss of a required safety

function, the plant is in a condition outside the accident

analysis. Therefore, no additional time is justified for

continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown. ______________________________________________________________________________ SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital instrument bus electrical power distribution systems are

functioning properly, with the required circuit breakers

closed and the buses energized. The correct breaker

alignment ensures the appropriate separation and

independence of the electrical divisions is maintained, and

the appropriate voltage is available to each required bus.

The verification of proper voltage availability on the buses

ensures that the required voltage is readily available for

motive as well as control functions for critical system

loads connected to these buses. The Surveillance Frequency

is controlled under the Surveillance Frequency Control

Program. Insert18 E E Insert 18: B 3.8.9-7 D.1 With two or more electrical power distribution subsystems inoperable, the Required Action is to restore electrical power distribution subsystem(s) to OPERABLE status

within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent electrical power distribution subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service.

The Required Action is only applicable if one electrical power distribution subsystem is inoperable for any reason and a second electrical power distribution subsystem is found to be inoperable, or if two or more electrical power distribution subsystems are found to be inoperable at the same time. Note 2 provides constraints for this condition, the

applicable constraints are located in TS section 5.5.20.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 4 License Conditions and Regulatory Commitment Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 4 4-1 License Conditions and Regulatory Commitment License Conditions APS proposes the following change to the license conditions:

1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.

2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.

Additionally, APS requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.

Regulatory Commitment

The commitment contained in this Attachment 4 supersedes the commitments provided in the original LAR (ADAMS Accession Number ML15218A300).

1. APS will resolve the eight not closed finding level facts and observations (F&O) listed in Attachment 6 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (ADAMS Accession Number ML17079A427). The not closed finding level F&O will be closed prior to utilizing the PRA models for use in the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 5

List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-1 List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions Section 4.0, item 2 of the NRC final safety evaluation (reference 1 of this attachment) for NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 2 of this attachment) identifies the following needed content:

The license amendment request (LAR) will provide identification of the technical specifications TS limiting conditions of operation (LCO) and action requirements to which the RMTS will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSC) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions [i.e., 50.46 emergency core cooling system (ECCS) flow rates] for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This attachment provides confirmation that the Palo Verde Nuclear Generating Station (PVNGS) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the risk-informed completion times (RICT) program to the proposed scope TS LCO conditions, and provides the information requested for Section 4.0, item 2 of the NRC final safety evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The PVNGS PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.

Table A5-1, In Scope TS/LCO Conditions to Corresponding PRA Functions, lists each TS LCO Condition to which the RICT program is proposed to be applied, and documents the following information regarding the TS with the associated safety analyses, the analogous PRA functions, and the re sults of the comparison:

Column "TS LCO/Condition": Lists all of the LCOs and condition statements within the scope of the submittal.

Column "SSCs Covered by TS LCO/Condition": Lists the SSCs addressed by each action requirement.

Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO/conditions are included in the PRA.

Column "Function Covered by TS LCO/Condition": Contains a summary of the required functions from the design basis analyses.

Column "Design Success Criteria": Lists a summary of the success criteria from the design basis analyses.

Column "PRA Success Criteria": Lists the function success criteria modeled in the PRA.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-2

Column "Disposition": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A.

The corresponding SSCs for each TS LCO and th e associated TS functi ons are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than overly conservative, whereas design ba sis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to Capability Category II of the PRA standard as required by NEI 06-09-A.

Examples of calculated RICTs are provided for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable) in this Attachment under Table A5-2, Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate. Actual RICT values will be calculated based on the actual plant configuration using a current revision of the PRA model which represents the as-built/as-operated condition of the plant, as required by NEI 06-09-A and the NRC final safety evaluation, and may differ from the RICTs presented.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-3 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.3.6 ESFAS Logic and Manual Trip

Condition B - One or more Functions with one Manual Trip or Initiation Logic channel inoperable.

4 Manual Trip Channels

4 Initiating Logic Channels

Yes Yes Initiate safety systems to protect against violating core design limits and RCS pressure boundary, and to mitigate accidents. 2 of 4 channels

2 of 4 channels Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

3.3.6 ESFAS

Logic and Manual Trip

Condition D - One or more Functions with one Actuation Logic channel inoperable.

2 Actuation Logic Channels

Yes

Initiate safety systems to protect against violating core design limits and RCS pressure boundary, and to mitigate accidents. 1 of 2 channels

Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

3.4.10 Pressurizer Safety Valves

Condition A - One pressurizer safety valve inoperable.

4 Pressurizer Safety Valves Yes Prevent RCS pressure from exceeding safety limit. 4 of 4 Pressurizer Safety Valves 4 of 4 Pressurizer Safety Valves (PSV) for limiting anticipated transient without scram (ATWS); 1 of 4 PSVs for non ATWS scenarios SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

3.4.12 Pressurizer Vents

Condition A - Two or three required pressurizer vent paths inoperable. 4 Pressurizer Vent Paths Yes Depressurize the RCS during a steam generator tube rupture (SGTR) with loss of offsite power (LOP). 1 of 4 Pressurizer Vent Paths Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.4.12 Pressurizer Vents

Condition B - All pressurizer vent paths inoperable. See LCO Condition 3.4.12.A

3.5.1 SITs

Condition C - Two or more SITs inoperable for reasons other than Condition A. 4 Safety Injection Tanks (SITs) Yes Emergency core cooling system (ECCS) injection during a large loss-of-coolant accident (LOCA). 3 of 4 SITs 2 of 3 intact cold legs (assumed one SIT lost out break) for large LOCA; 4 of 4 SITs for small LOCA during a failure of both HPSI trains SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

Two SITs are required to inject borated water into the RCS for large LOCAs. The UFSAR requirement of 3 SITs is based on the extremely conservative 10CFR50 App. K analysis criteria. Best estimate analysis in WCAP-15701 [see Table 6.1-6] (Reference 3 of this Attachment) by Combustion Engineering has shown that 1 SIT with either one train of HPSI or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited for large LOCAs in the PRA model.

Note that for small LOCAs with failure of both high pressure safety Injection (HPSI) trains, the PRA credits operator manual depressurization and requires 4 of 4 SITs to inject. This scenario is beyond design basis due to failure of both HPSI trains, which is assumed to be available in the design basis small LOCA scenarios.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-4 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.5.3 ECCS Operating

Condition A - One LPSI subsystem inoperable. 2 Low Pressure Safety Injection (LPSI) subsystems (Train A and Train B)

Associated flowpaths (piping, valves, instruments and controls) Yes The Emergency Core Cooling System (comprised of the LPSI and HPSI subsystems) provides core cooling and negative reactivity to ensure the reactor core is protected after design basis accidents during both phases of ECCS Operation (injection and recirculation).

1 of 2 LPSI subsystems

Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.5.3 ECCS Operating

Condition B - One or more trains inoperable for reasons other than Condition A.

A ND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available. 2 High Pressure Safety Injection (HPSI) trains (Train A and Train B)

2 Low Pressure Safety Injection (LPSI) trains (Train A and Train B)

Associated flowpaths (piping, valves, instruments and controls) Yes The Emergency Core Cooling System (comprised of the LPSI and HPSI subsystems) provides core cooling and negative reactivity to ensure the reactor core is protected after design basis accidents during both phases of ECCS Operation (injection and recirculation).

1 of 2 HPSI trains

1 of 2 ECCS trains (HPSI and LPSI)

Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.5.5 Refueling Water Tank (RWT)

Condition B - RWT inoperable for reasons other than Condition A. RWT Yes Supply borated water to ECCS and CS system during LOCA injection phase for:

(a) containment cooling and depressurization

(b) core cooling and replacement inventory

(c) negative reactivity for reactor shutdown 1 of 1 RWT Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.6.2 Containment Air Locks

Condition C - One or more containment air locks inoperable for reasons other than Condition A or B. 2 air locks (personnel and emergency), each with interlock mechanisms No Airlock leakage within limits. 2 of 2 air locks isolable Not modeled SSCs for the containment air locks can be evaluated by a bounding assessment as permitted by NEI 06-09-A. In this case containment is conservatively considered failed and LERF is set to the base CDF value.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.6.3 Containment Isolation Valves

Condition A - One or more penetration flow paths with one required containment isolation valve inoperable except for purge valve leakage not within limit. 2 containment isolation valves on each penetration Yes Each containment penetration isolated within the limits assumed in the safety analysis. 1 of 2 containment isolation valves or isolation devices per penetration 1 of 2 containment isolation valves per penetration for:

containment purge; radwaste drain; charging; letdown; reactor drain tank (RDT) discharge; RDT Makeup; RDT vent; nitrogen supply; instrument air and reactor coolant pump (RCP) seal bleedoff

The PRA does not explicitly model the impact of excessive stroke time. This condition can be addressed for the RICT Program by removing the inoperable containment isolation valve from service if it is open.

Therefore, this LCO condition can be evaluated using the CRMP tool model.

Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.

The success criteria in the PRA are consistent with the design basis criteria. 3.6.3 Containment Isolation Valves

Condition B - One or more penetration flow paths with two required containment isolation valves inoperable except for purge valve leakage not within limit. See LCO Condition 3.6.3.A

3.6.3 Containment

Isolation Valves

Condition C - One or more penetration flow paths with one required containment isolation valve inoperable. 1 containment isolation valve on each penetration line with a closed system Yes Each containment penetration isolated within the limits assumed in the safety analysis. Redundant function also performed by closed system inside containment. 1 of 2 containment isolation barriers per penetration Same The PRA does not explicitly model the impact of excessive stroke time.

Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-6 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.6.3 Containment Isolation Valves

Condition D - One or more penetration flow paths with one or more containment purge valves not within leakage limits. 4 containment purge penetrations (56, 57, 78 and 79), each with 2 valves in series. Two penetrations are 8 inch diameter and two penetrations are 42 inch diameter.

Blind Flange can be used as an alternate containment isolation device for penetrations 56 and 57 per TS 3.6.3 note 5. Yes Purge valve and blind flange leakage rates within limits for each penetration. 1 of 2 purge valves per penetration within purge valve leakage limit.

Blind flange within purge valve leakage limits when the blind flange is used in place of purge valve. Same Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.6.6 Containment Spray (CS)

System

Condition A - One containment spray train inoperable. 2 CS trains Yes Containment atmosphere cooling to limit post-accident pressure and temperature.

Iodine removal to reduce the release of fission product radioactivity from containment to the environment. 1 of 2 CS trains

Same

CS is credited in PRA for containment heat removal. However, iodine removal is not a mitigating function to prevent core damage or large early release.

The success criteria in the PRA are consistent with the design basis criteria. 3.7.2 Main Steam Isolation Valves (MSIVs)

Condition F - One MSIV inoperable in MODE 1. 4 MSIVs Yes Isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). 1 of 4 MSIVs fail to close Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

3.7.2 MSIVs

Condition G - Two or more MSIVs inoperable in MODE 1. See LCO Condition 3.7.2.A

3.7.3 Main Feedwater Isolation Valves (MFIVs)

Condition A - One or more MFIVs inoperable. 4 economizer MFIVs and 4 downcomer MFIVs. There are a total of 8 MFIVs, with 2 redundant MFIVs on each of the 4 piping segments. No Isolate Main Feedwater (MFW) flow to the secondary side of the steam generators following a High Energy Line Break (HELB). 1 of 4 MFIVs fail to close Not modeled The PRA models the failure of the two downcomer paths (each path with 2 MFIVs) to provide sufficient flow of feedwater to the steam generators.

The closure of the MFIVs to prevent Containment failure or RCS overcooling is not explicitly modeled in the current PRA due to the redundancy of the MFIVs and low likelihood of the applicable initiating events. However, to address this condition for a RICT, the PRA will be adjusted to explicitly model the risk significance of a MFIV failure to close on Containment integrity and RCS overcooling. Failure of both MFIVs to close for the affected initiating events will be assumed to result in core damage and Containment failure. 3.7.3 MFIVs

Condition B - Two valves in the same flow path inoperable. See LCO Condition 3.7.3.A Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-7 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.7.4 Atmospheric Dump Valves (ADVs)

Condition A - One required ADV line inoperable. 4 ADV lines (two per SG, each with ADV and block valve) Yes Cool unit to Shutdown Cooling (SDC) entry conditions.

1 of 4 ADVs Same except for rapid depressurization of RCS to SDC conditions, then 2 of 4 ADVs The success criteria in the PRA is consistent with the design basis criteria, and more conservative for mitigation of rapid depressurization of RCS to SDC conditions scenarios.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

3.7.4 ADVs

Condition B - Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs. See LCO Condition 3.7.4.A

3.7.5 Auxiliary

Feedwater (AFW)

System

Condition A - One steam supply to turbine driven AFW pump inoperable. 2 steam lines with associated supply valves for the turbine driven AFW pump Yes Provide steam to turbine-driven AFW pump. 1 of 2 steam lines Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.7.5 AFW System

Condition B - One AFW train inoperable for reasons other than Condition A. 1 safety related (SR) motor-driven train 1SR turbine-driven train 1 non SR motor driven train

Associated flow paths (piping, valves, instruments and controls) Yes Supply feedwater to the SGs to remove RCS decay heat. 1 SR motor-driven train or 1 SR turbine-driven train 1 of 3 trains (1 SR motor-driven train, 1 SR turbine-driven train, or 1 non SR motor driven train)

The operability of the non-safety related (SR) motor driven AFW pump is important from a risk perspective; this pump is not credited in the PVNGS Accident Analyses. The difference between the Design Success Criteria and PRA Success Criteria is due to the design basis being highly conservative whereas the PRA is realistic.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

3.7.5 AFW System

Condition C - Two AFW trains inoperable. See LCO Condition 3.7.5.A and 3.7.5.B

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-8 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.7.7 Essential Cooling Water (EW)

System

Condition A - One EW train inoperable. 2 trains, each with 1 pump, 1 surge tank , 1 heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. 1 of 2 trains Same The PRA also credits EW to Nuclear Cooling as a backup for cooling RCP seals.

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.7.7 Essential Cooling Water (EW)

System

Condition B - Two EW trains inoperable. See LCO Condition 3.7.7.A

3.7.8 Essential

Spray Pond System

Condition A - One ESPS train inoperable. 2 trains, each with 1 pump, 1 EW heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat sink for removal of process and operating heat from the EW system. 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.7.8 Essential Spray Pond System

Condition B - Two ESPS trains inoperable. See LCO Condition 3.7.8.A

3.7.10 Essential Chilled Water System

Condition A - One EC train inoperable. 2 trains, each with 1 pump, 1 surge tank , 1 heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat transfer system to the Ultimate Heat Sink for the removal of process and operating heat from selected safety related air handling systems during a Design Basis Accident (DBA) or transient. 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.7.10 Essential Chilled Water System

Condition B - Two EC trains inoperable. See LCO Condition 3.7.10.A

3.8.1 AC Sources - Operating

Condition A - One required offsite circuit inoperable. 2 offsite circuits, each with breakers, transformers, switches, interrupting devices, cabling and controls Yes Supply power from the transmission network to the 4.16 kV Class 1E buses. 1 of 2 offsite circuits Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

3.8.1 AC Sources - Operating

Condition B - One Diesel Generator (DG) inoperable. 2 diesel generators (DGs) Yes Upon loss of preferred power, supply the ESF loads in sufficient time to mitigate the consequences of a DBA. 1 of 2 DG Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

Two Station Blackout Generators (SBOG) are also credited in the PRA model.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-9 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.8.1 AC Sources - Operating

Condition C - Two required offsite circuits inoperable. See LCO Condition 3.8.1.A

3.8.1 AC Sources - Operating

Condition D - One required offsite circuit inoperable.

A ND One DG inoperable. See LCO Condition 3.8.1.A and 3.8.1.B

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

Two Station Blackout Generators (SBOG) are also credited in the PRA model. 3.8.1 AC Sources - Operating

Condition E - Two DGs inoperable. See LCO Condition 3.8.1.B

3.8.1 AC Sources - Operating

Condition F - One automatic load sequencer inoperable. 2 automatic load sequencers Yes Return loads to service within time limits after initiating signal, in predetermined sequence to prevent over-loading the power source by automatic load application. 1 of 2 automatic load sequencers Same

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

3.8.1 AC Sources - Operating

Condition H - Three or more required AC sources inoperable. See LCO Condition 3.8.1.A and 3.8.1.B

SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

Two Station Blackout Generators (SBOG) are also credited in the PRA model. 3.8.4 DC Sources - Operating

Condition A - One battery charger on one subsystem inoperable. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 DC batteries, a battery charger for each battery, associated control equipment and interconnecting cabling Yes Provide control power to AC emergency power system, motive and control power to selected safety related equipment and preferred AC vital instrument bus power (via inverters). 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.8.4 DC Sources - Operating

Condition B - One DC electrical power subsystem inoperable for reasons other than Condition A. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 DC batteries, a battery charger for each battery, associated control equipment and interconnecting cabling Yes Provide control power to AC emergency power system, motive and control power to selected safety related equipment and preferred AC vital instrument bus power (via inverters). 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-10 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/

Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.8.4 DC Sources - Operating

Condition C - Two DC electrical power subsystems inoperable. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 channels per subsystems See LCO Condition 3.8.4.A and 3.8.4.B

3.8.7 Inverters

- Operating

Condition A - One required inverter inoperable.

2 Inverters per Train (A and B) Yes Provide the preferred source of power for the AC vital buses. This is an uninterruptible power for the instrumentation and controls of the reactor protection system (RPS) and ESFAS. 1 of 2 inverter trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.8.7 Inverters - Operating

Condition B - Two or more required inverters inoperable. 2 inverters per Train (A and B), each with 2 channels per train

See LCO Condition 3.8.7.A

3.8.9 Distribution

Systems -

Operating

Condition A - One AC electrical power distribution subsystem inoperable. 2 subsystems [4.16 kV Engineered Safety Feature (ESF) buses, secondary AC electrical power distribution panels, load centers and motor control centers] Yes Provide necessary power to ESF systems. 1 of 2 AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -

Operating

Condition B - One AC vital instrument bus electrical power distribution subsystem inoperable. 2 subsystems (Train A and Train B), each with 2 channels per subsystems Yes Provide necessary power to ESF systems. 1 of 2 vital AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -

Operating

Condition C - One DC electrical power distribution subsystems inoperable. 2 subsystems (Train A and Train B), each with 2 channels per subsystems Yes Provide necessary power to ESF systems. 1 of 2 vital DC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.

The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -

Operating

Condition D - Two or more electrical power subsystems inoperable. See LCO Condition 3.8.9.A through 3.8.9.C

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-11 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -

Low Estimate 1 RICT Calculated -

High Estimate 1 Loss of Function (Yes/No/Maybe) 3.3.6 ESFAS Logic and Manual Trip Condition B - One or more Functions with one

Manual Trip or Initiation

Logic channel

inoperable. 30 day backstop 10 30 day backstop No Condition D - One or more Functions with one

Actuation Logic channel

inoperable.

2 days8,9,11 30 day backstop No 3.4.10 Pressurizer Safety Valves Condition A - One pressurizer safety valve

inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.4.12 Pressurizer Vents Condition A - Two or three required

pressurizer vent paths

inoperable. 30 day backstop 30 day backstop No Condition B - All pressurizer vent paths inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.5.1 SITs Condition C - Two or more SITs inoperable for

reasons other than Condition A. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.5.3 ECCS Operating Condition A - One LPSI subsystem inoperable. 30 day backstop 30 day backstop No Condition B - One or more trains inoperable for reasons other than Condition A.

AND At least 100% of the ECCS flow equivalent to

a single OPERABLE ECCS train available. 27 days 30 day backstop No 3.5.5 RWT Condition B - RWT inoperable for reasons other than Condition A. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.6.2 Containment Air Locks Condition C - One or more containment air locks inoperable for reasons other than Condition A or B.

9 days 9 30 day backstop No Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-12 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -

Low Estimate 1 RICT Calculated -

High Estimate 1 Loss of Function (Yes/No/Maybe) 3.6.3 Containment Isolation Valves Condition A - One or more penetration flow paths with one required containment isolation valve inoperable except for purge valve leakage not within limit.

10 days 9 30 day backstop No Condition B - One or more penetration flow paths with two required containment isolation valves inoperable except

for purge valve leakage not within limit. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 Condition C - One or more penetration flow paths with one required containment isolation valve inoperable.

9 days 9 30 day backstop No Condition D - One or more penetration flow paths with one or more containment purge valves not within leakage limits. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 9 days 9 Maybe 12 3.6.6 Containment Spray System Condition A - One containment spray train

inoperable. 30 day backstop 30 day backstop No 3.7.2 MSIVs Condition F - One MSIV inoperable in MODE 1. 30 day backstop 30 day backstop No Condition G - Two or more MSIVs inoperable in MODE 1. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.7.3 MFIVs Condition A - One or more MFIVs inoperable.

9 days 9 9 days 9 No Condition B - Two valves in the same flow

path inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.7.4 ADVs Condition A - One required ADV line

inoperable. 30 day backstop 30 day backstop No Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-13 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -

Low Estimate 1 RICT Calculated -

High Estimate 1 Loss of Function (Yes/No/Maybe) Condition B - Two or more ADV lines inoperable with both ADV lines inoperable on

one or more SGs. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 30 day backstop Maybe 3 3.7.5 AFW System Condition A - One steam supply to turbine driven AFW pump

inoperable. 30 day backstop 30 day backstop No Condition B - One AFW train inoperable for

reasons other than Condition A. 23 days 30 day backstop No Condition C - Two AFW trains inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 2 days Maybe 13 3.7.7 Essential Cooling Water (EW) System Condition A - One EW train inoperable. 30 day backstop 30 day backstop No Condition B - Two EW trains inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.7.8 Essential Spray Pond System Condition A - One ESPS train inoperable. 30 day backstop 30 day backstop No Condition B - Two ESPS trains inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.7.10 Essential Chilled Water System Condition A - One EC train inoperable. 30 day backstop 30 day backstop No Condition B - Two EC trains inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.8.1 AC Sources -

Operating Condition A - One required offsite circuit

inoperable. 30 day backstop 30 day backstop No Condition B - One Diesel Generator (DG)

inoperable. 30 day backstop 30 day backstop No Condition C - Two required offsite circuits

inoperable. 30 day backstop 30 day backstop No Condition D - One required offsite circuit

inoperable AND one DG inoperable. 30 day backstop 30 day backstop No Condition E - Two DGs inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-14 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -

Low Estimate 1 RICT Calculated -

High Estimate 1 Loss of Function (Yes/No/Maybe) Condition F - One automatic load sequencer inoperable. 19 days 30 day backstop No Condition H - Three or more required AC sources inoperable.

11 hrs 5 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2 3.8.4 DC Sources -

Operating Condition A - One battery charger on one subsystem inoperable. 30 day backstop 30 day backstop No Condition B - One DC electrical power subsystem inoperable

for reasons other than Condition A. 3 days 6 days No Condition C - Two DC electrical power subsystems inoperable.

less than 1 hr 6 less than 1 hr 6 Yes 2 3.8.7 Inverters -

Operating Condition A - One required inverter

inoperable. 30 day backstop 30 day backstop No Condition B - Two or more required inverters

inoperable. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop 30 day backstop Maybe 4 3.8.9 Distribution Systems - Operating Condition A - One AC electrical power distribution subsystem

inoperable. 6 days 22 days 9 No Condition B - One AC vital instrument bus electrical power distribution subsystem

inoperable. 30 day backstop 30 day backstop No Condition C - One DC electrical power distribution subsystems

inoperable. 3 days 6 days No Condition D - Two or more electrical power subsystems inoperable.

less than 1 hr 7 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop Yes 2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-15 Notes: 1. RICTs are based on the internal events, internal flood, internal fire and seismic PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest number of days for illustrative purposes.

2. This is considered a loss of specified safety function. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in section 2.3.1 of NEI 06-09-A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. This is considered a loss of specified safety function only if all four ADVs are inoperable. Therefore if all four ADVs are inoperable then the RICT for this loss of function conditions may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. If two inverters on the same train remain operable, there is NOT a loss of safety function. However, when there is a loss of safety function the RICT for a loss of function condition may not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

5. This was evaluated with both Diesel Generators and sour ces of offsite power being impacted to account for the "or more" condition of the LCO.

6. This was evaluated with both Class 1E DC electrical power subsystems [Train A and Train B - (all four channels)] being impacted.

7. This was evaluated with all AC Safety, DC and AC vital instrument buses being impacted to account for the "or more" condition of the LCO.

8. This was evaluated with all Train A engin eered safety features actuation system (ESFAS) signals being impacted to account for the "or more" condition with one Actuation Logic channel of the LCO and thus is a bounding value.

9. The limiting RICT for this TS was from the LERF calculation.

10. The ESFAS is made up of 4 quality class input channels, 6 channels of Matrix Logic, 4 channels of Initiation Logic, 2 channels of Actuation Logic, and 4 channels of Manual Trip for 7 Functions; Safety Injection Actuation Signal (SIAS), Containment Isolation Actuation Signal (CIAS), Recirculation Actuation Signal (RAS), Containment Spray Actuation Signal (CSAS), Main Steam Isolation Signal (MSIS), Auxiliary Feedwater Actuation Signal to SG-1 (AFAS-1), and Auxiliary Feedwater Actuation Signal to SG-2 (AFAS-2). This was evaluated with both trains of SIAS, CIAS, CSAS, AFAS, MSIS, and RAS being impacted (increased failure probabilities) to account for the "or more" condition of the LCO.

11. For one actuation logic channel inoperable, the initiated equipment for one train of SIAS, CIAS, CSAS, or MSIS are assumed failed, and the initiation relay for one train of AFAS and RAS is failed.

12. This is considered a loss of function condition if more than one purge valve is inoperable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-16 13. This is considered a loss of function condition when two class (i.e. safety related)

AFW pumps are inoperable. If one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function.

References:

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No. ML071200238) dated May 17, 2007

2. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)

3. WCAP-15701, Determination of Realistic LOCA Success Criteria and Selected LOCA Based HRAs for PSA Applications, Revision 0, dated June 2002

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 6 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-1 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Introduction NEI 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 1 of this attachment), section 2.3.4 states that the probabilistic risk assessment (PRA) shall be reviewed to the guidance of regulatory guide (RG) 1.200, Revision 2 (reference 2 of this attachment), for a PRA which meets Capability Category II for the supporting requirements (SRs) of the internal events at power PRA st andard, and that deviations from these capability standards shall be justified and documented. APS has performed its review of the PRA to the guidance in RG 1.200, Revision 2. Section 4.0, item 3 of the NRC final safety evaluation (reference 3 of this attachment), for NEI 06-09-A requires the license amendment request (LAR) to include a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RMTS, including the resolution or disposition of any identified deficiencies (i.e., findings and observations from peer reviews). The scope of this information includes the internal events PRA model, and other models for which additional standards have been endorsed by a revision to RG 1.200.

The following sections demonstrate that the quality and level of detail of the processes used in the risk-informed completion times (RIC Ts) are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models described within this LAR are the same as those described within the APS submittal of the LAR dated July 31, 2015, to revise the PVNGS TS to allow RICT (reference 29 of this attachment), with routine maintenance updates applied. Changes and plant modifications previously identified in reference 29 that were required to achieve an overall core damage frequency (CDF) and large early release frequency (LERF) consistent with NRC RG 1.174 (reference 31 of this attachment) have been completed.

Internal Events and Internal Flooding PRA The PVNGS RICT process for the internal events and internal flooding hazards will use peer reviewed plant-specific Internal Events and Internal Flooding PRA models in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA models used in this application reflects the as-built and as operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the Internal Events and Internal Flooding PRA models. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Events and Internal Flooding PRA models.

Seismic PRA The PVNGS RICT process for seismic hazards will use a peer reviewed plant specific Seismic PRA model in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the seismic hazards for the seismic PRA. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Seismic PRA model.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-2 Fire PRA The PVNGS RICT process for fire hazards will use a peer reviewed plant specific Internal Fire PRA model in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Industry consensus methods were utilized in the development of the Internal Fire PRA model. While APS was not an applicant to implement national fire protection association standard (NFPA) 805 in accordance with 10 CFR 50.48, the Internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes NRC approved methods. As part of the ongoing PRA maintenance and update process described in Attachment 11 of this enclosure, APS will address Internal Fire PRA methods approved by the NRC since the development of the Internal Fire PRA. Note that APS does not credit incipient fire detection systems in the Internal Fire PRA model. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Fire PRA model.

Other External Hazards PRA The PVNGS RICT process for the external hazards will use a peer reviewed plant-specific screening in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). Each external hazard was evaluated with respect to applicability and/or risk. The ASME PRA Standard RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (reference 4 of this attachment) outlines preliminary and progressive screening approaches that are acceptable for this task. The screening started with the top approach and progressed downward until the hazard in question screened with respect to risk. If none of the screening approaches were successful, then the hazard was analyzed using a detailed PRA approach that meets applicable requirements in the ASME PRA Standard RA-Sa-2009. Implicit in these screening criteria (ones that do not present a quantitative measure) is the assumption that successfully meeting a criterion for screening indicates that the bounding CDF from that hazard is considered to be lower than 1E-6 per year. Attachment 8 of this enclosure provides a summary of the other external hazards scr eening results and the progressive screening approach for addressing external hazards.

PRA Review Process Results The PRA models described above with the exception of the seismic PRA have been peer reviewed per NEI guidance endorsed in RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities , Revision 2 (Reference 2 of this Attachment) consistent with NRC RIS 2007-06, Regulatory Guide 1.200 Implementation (reference 32 of this attachment). The Seismic PRA was peer reviewed per NEI 12-13 (reference 27 of this attachment) since RG 1.200 Revision 2 did not endorse an y seismic PRA peer review guidance (since NEI 12-13 was issued after RG 1.200 Revision 2)

The Internal Events PRA model was peer reviewed in July 1999 by the combustion engineering owners group (CEOG) prior to the issuance of Regulatory Guide 1.200 (reference 7 of this attachment). As a result, a self-assessment of the Internal Events PRA model was conducted by APS in March 2011 (reference 6 of this attachment) in accordance with Appendix B of RG 1.200, Revision 2 (reference 2 of this attachment), to address the PRA quality requirements not considered in the CEOG peer review. APS conducted a full scope Internal Flooding PRA model peer review (reference 8 of this attachment) in November 2010, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-3 The Internal Events PRA quality (including the CEOG peer review and self-assessment results) has previously been reviewed by the NRC in requests to extend the Inverter Technical Specification Completion Time dated September 29, 2010 (reference 33 of this attachment), and to implement TSTF-425, Relocate Surveillance Fr equencies to Licensee Control RITSTF Initiative 5b, December 15, 2011 (reference 5 of this attachment). All PRA upgrades [as defined by the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment)] implemented since conduct of the CEOG peer review in 1999 have been peer reviewed.

APS conducted a full scope Internal Fire PRA model peer review (reference 10 of this attachment) in December 2012 in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). APS conducted a second focused scope peer review of the Internal Fire PRA in December 2014 (reference 11 of this attachment), to address ASME PRA Standard (reference 4 of this attachment) supporting requirements determined not met to Capability Category II in the first peer review, not just the associated facts and observations (F&Os) from the first peer review. Thus, the second peer review generated new F&Os which replaced in their entirety the finding level F&Os fr om the first peer review.

APS conducted a full scope Seismic PRA model peer review (reference 34 of this attachment) in February 2013, in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). APS conducted a full scope External Hazards screening peer review (reference 35 of this attachment) in December 2011, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).

An F&O closure peer review was performed in June 2017, in accordance with NRC letter dated May 3, 2017 (reference 12 of this attachment) to assess the closure of all PRA Model finding level F&Os from these peer reviews (reference 13 of this attachment) that were not otherwise addressed by focused scope peer reviews that re-reviewe d the associated ASME PRA supporting requirements in their entirety. The F&O closure review was conducted to ensure the findings had been satisfactorily resolved to meet the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment) to Capability Category II, the sub-element criteria for the CEOG from Internal Events PRA peer review (reference 7 of this attachment), and RG 1.200, Revision 2 (reference 2 of this attachment).

The F&O closure peer review assessed the sixty finding level F&Os from the prior peer reviews and concluded that all we re closed with the exception of eight findings. Of the eight not closed findings, six were assessed as partially closed, and two were assessed as open. The eight not closed findings and their dispositions are described in Table A6-1, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Clos ure Review Process. During the closure review, a concurrent focused scope peer review was also performed for two separate F&O resolutions that were considered an upgrade per ASME PRA Standard (reference 4 of this attachment). The two F&O resolutions that were considered:

HR-03, common cause miscalibration errors modeled in HRA calculator using Techniques for Human Error Rate Prediction (THERP) approach

SHA-E1-01, use of site specific data collected as part of Near Term Task Force (NTTF) 2.1 analysis Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-4 No new F&Os were identified for the two F&Os for which a concurrent focus scope peer review was performed.

APS has committed in Attachment 4 of this enclosure to resolve the eight not closed finding level F&Os listed in Table A6-1 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (Reference 12 of this Attachment). These not closed finding level F&Os will be closed prior to utilizing the PRA models for RICT. Resolution of the not closed finding level F&Os is not expected to have a significant impact on overall CDF or LERF based on the dispositions described in Table A6-1.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-5 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition IE-07 (B) / IE-12 Internal Events The Interfacing Systems Loss of Coolant Accident (ISLOCA) treatment for the shutdown cooling suction line appears to have some questionable assumptions. First, it is assumed that the Low Temperature Over Pressure (LTOP) valve would always open. While this is the most likely scenario, the LTOP valve can fail to open. Qualitative arguments were made that should this happen, the resulting LOCA would be inside containment (primarily based on relative pipe lengths). This ignores the fact that the high stress points and stress concentration points are outside containment.

Furthermore, the shutdown cooling warmup crossover piping was not considered. Status: Partially Closed. Basis: Insufficient justification is provided in "Impact 200- 84.pdf" to demonstrate that the frequency of the scenario in question is negligible. The resolution of this finding only provides qualitative argument that this ISLOCA scenario will require failure of two MOVs, failure to open of the LTOP valve, and failure of the warmup piping or the bypass valve. No quantitative values and LTOP valve capacity were provided to demonstrate that the frequency of this scenario is negligible. Note that the likelihood of failure of the piping outside containment is relatively high.

Furthermore, it is not clear if the capacity of the LTOP valve is sufficient to relieve the relatively large flow that may result from the catastrophic ruptures of the two upstream MOVs. Finally, ISLOCA may also result from leakage of both of the two upstream MOVs, or a combination of leakage and rupture of the two upstream MOVs, in conjunction with failure of the LTOP valve to open and failure of the downstream piping.

This scenario would have a greater frequency than catastrophic ruptures of both MOVs because the frequency of MOV leakage is significantly greater than its catastrophic rupture. Recommendation: Provide additional justifications (including the capacity of the LTOP valve, all of the possible failure mode combinations and their probabilities of occurrence, LERF value, etc.) to demonstrate that the frequency of the scenario in question is indeed negligible compared to the LERF. The Closure Review Team recommendation will be addressed by evaluating all ISLOCA failure modes of the shutdown cooling system piping.

Justification for screening out any negligible scenarios will be provided.

Leakage, spurious operation, and catastrophic failure modes of valves will be considered, as well as the LTOP relief valve failure to open or exceedance of the relief capacity. These changes are not expected to have a significant impact on total CDF or LERF since the current internal events contribution to total CDF and LERF is less than 2% and 0.5%, respectively. While the resulting LERF contribution from these scenarios may not be negligible, they are expected to be minimal based on industry operating experience. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition AS-03 (B) / AS-24 Internal Events There are some differences between treatment of a small LOCA associated with a pipe break and an induced small LOCA (pressurizer safety valve reclosure) in the transient event trees. For example:

In the small LOCA event tree, successful high pressure injection and recirculation lead to questioning whether containment heat removal is successful. In the Transient Type 2 and Transient Type 3 event trees, RCS integrity can be lost if pressurizer safety valves do not reset after lifting. In the sequences from these event trees where high pressure injection and recirculation are successful, the question relating to containment heat removal is not asked. Status: Open. Basis: Containment heat removal (CHR) is only asked in the small LOCA event tree when the success path is relying on high pressure sump recirculation (HPSR) with a failure of the operators to depressurize and cooldown with successful SG heat removal. In this case the RCS remains at temperature so that there is substantial heat transfer to the containment. Table 4 of 13-NS-B065 R007 (Reference 14 of this Attachment) presents MAAP results for LOCA cases with failure of CHR from spray recirculation. Based on a reply to the reviewer's question, Table 4 indicates that <2" diameter breaks may just require CHR because s1_2_1a with SG cooling and failure of SG depressurization exceeds a containment pressure of 50 psig at just 6.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Smaller holes as represented by case s1_1_1a for a 1" break do not exceed even 50 psig until 22.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The ultimate containment failure pressure is 141 psig (i.e. 50% chance of failure) so assuming failure at 50 psig as a basis for success is conservative. It is therefore also conservative to assume that all small LOCA sizes (3/8" to 2.35") require CHR under these circumstances. The small LOCA event tree may also need to ask CHR in cases where the SGs are not depressurized; i.e. sequences 1 and 3. For a loss of main feedwater pumps (Type2), containment heat removal is not asked for any sequences. Either SG cooling prevents the PSV from lifting at all so there is no LOCA or the operators depressurize the RCS for alternate AFW (at low pressure) though the PSVs are assumed to lift and may fail to reseat. Failure of at least one PSV to reseat (equivalent hole size of 2.3") requires HPSI but the SGs are at low temperature in this scenario so CHR is currently assumed not required for the first 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Consideration should be given to containment failure at later times which may lead to subsequent core damage due to failure of sump recirculation at the time of containment failure. The Closure Review Team recommendation will be addressed by modeling CHR in the small LOCA event tree, and event scenarios with failure of the PSV to reseat. MAAP analyses will be performed to include PSV failure to reseat in the small break sizes and determine the necessity of CHR for long-term stable end-state. These changes are not expected to have a significant impact on total CDF or LERF since the current internal events contribution to total CDF and LERF is less than 2% and 0.5%, respectively. The likelihood of a small LOCA with a loss of CHR for longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is very small. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-7 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition AS-03 (B) / AS-24 Internal Events (cont.)

In the small LOCA event tree, RCS depressurization and use of low pressure injection and recirculation are considered if high pressure injection or recirculation fail. In the Transient Type 2 and Transient Type 3 event trees, consideration of RCS depressurization and use of low pressure systems is not included because the likelihood of high pressure injection or high pressure recirculation are small. It would seem that this assumption should apply to both cases, or not. For a loss of condenser vacuum (Type3), it's similar to the type2 event tree. Therefore, for LOCA scenarios with a hole size no larger than 2.3" equivalent in diameter, with or without SG depressurization, further justification is needed to not require CHR to protect the containment. The following information is useful in reviewing the documents associated with this F&O. Page 337, Figure 3.27.4 of 13-NS-B061, Revision 5 (Reference 15 of this Attachment) is the small LOCA event tree. Type 2 initiators with RT before turbine trip only challenge the PSVs if all SG cooling is lost. Event tree for loss of main feedwater pumps in 3.9.4 on Page 130 shows that containment heat removal is not asked because if secondary heat removal is lost, core damage is assumed. Type 3 initiators are where turbine trips first and may challenge the PSVs. Figure 3.6.4 on page 102 shows the loss of condenser vacuum ET which is type 3 initiator. Containment heat removal is not asked. Type 2 and type 3 initiators presently have about the same contribution to CDF for internal events, as does small LOCA; i.e. around 12%. Recommendation: Perform a set of MAAP sensitivity analyses assuming a stuck open PSV with equivalent hole diameter of 2.3" to investigate the possibility of success without CHR. Expand the discussions in the MAAP report to better describe the basis for the 2" hole size as the critical break size. Further, the assumed mission time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months may be too short for consideration of containment failure. A loss of CHR that results in an exceedance of the pressure capacity at 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is not a stable state at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and is still of concern. In other words, breaks with sizes smaller than 2" may also require CHR under the circumstances postulated in this F&O. One possibility is to add the events asking for CHR to the event trees for small LOCA, type2, and type3 initiators to see if the change in assumed success criteria makes any difference to CDF. The saturation temperatures corresponding to 50 psig is approximately 300°F.

If it can be shown that SG cooldown limits the exiting RCS coolant temperature to less than these values prior to reaching 50 psig, then containment integrity should be assured.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-8 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition 1-1/ IFSO-B2 Internal Flooding As noted in SRs IFSO-A1, IFSO-A3, and IFSO-A5, some areas of the documentation do not provide sufficient detail about the process used. Specific items for which improved documentation is needed include:

a. Documentation of sources in the Turbine Building.

b. The basis for screening sources in the Fuel, Radwaste, and Turbine Buildings (i.e., the way in which the specified criteria are met for each source is not documented). For example, a walkdown during the peer review revealed that there is section of the wet pipe fire protection (FP) system running above the turbine cooling water (TC) pumps that could potentially spray both pumps. It is not clear based on 13-NS-C093 (Reference 16 of this Attachment) and 13-NS-C094 (Reference 17 of this Attachment) that this impact was considered and dispositioned. Likewise, feedline breaks in the turbine building are assumed to be bounded by the loss of main feedwater initiating event, but may have different impacts such as loss of instrument air due to humidity impacts.

c. The temperature and pressure of flood sources. Status: Partially Closed. Basis: The documentation (Sections 4.2.5 and 4.2.6 of Study 13- NS-C094, Revision 1, and footnote in Table C.1 of 13-NS-C093 Revision 1) have been revised to address the Findings. Section 4.2.6 of Study 13- NS-C094 (Reference 17 of this Attachment), Revision 1 discusses the flood sources in the TB and the impact of these flood sources, if any, on equipment in TB that are modeled in the PRA. The rationale for not including the temperature and pressure of fluid systems based on Assumption 2 of PRA Study 13-NS-C096 Revision 2 (Reference 18 of this Attachment) must be supported by the fact that there will be no propagation of steam (due to HELB) from the location of the piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s). Also, for feedwater line break in the TB, it must be verified that this event will not impact other PRA equipment such as the instrument air system due to steam and humidity. Recommendation: Verify and document the fact that propagation of steam (due to a HELB) will not occur from the location of piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s) and that a feedwater line break in the TB will not impact other PRA equipment such as the instrument air system due to steam and humidity. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. Preliminary review indicates that steam propagation will have minimal impact on impacted PRA equipment in adjacent locations. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-9 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition 1-2/ IFEV-A7 Internal Flooding Potential flooding mechanisms are primarily limited to failures of components. Human-induced flooding is screened based on plant maintenance practices (see 13 NS-C093 (Reference 16 of this Attachment), Section 3.2, Item 4 and 13-NS-C097 (Reference 19 of this Attachment), Section 3.5). This does not indicate that there was any search of plant operating experience and plant maintenance procedures to verify no potential for human-induced flood mechanisms. Status: Partially Closed. Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) addressed the finding with the discussion of the potential for human and maintenance induced flooding events. Maintenance activities/procedures were reviewed and a search of plant operating experience (APS PVAR/CRDR database, plat trip history and LERs) using flood-related keywords for flooding events was performed as documented in this section (4.1) of the System Study. It is stated in Section 3.5 of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) that maintenance activities, which involve the replacement of pumps or cleaning of heat exchangers, have the potential to induce a significant flooding event are not performed on-line at the plant. However, there was a PVNGS event that involved the plugging of the condenser tubes during plant operation. There is also a potential for on-line heat exchanger tube plugging if a heat exchanger tube leak is detected. Such events were not considered in the discussion of maintenance/human induced flooding in Section 3.5 of Study 13-NS-C097 Revision 2 (Reference 19 of this Attachment). Recommendation: To be consistent with the state of the industry practice, identify and evaluate human-induced floods during plant operation for scenarios that may result from risk-significant maintenance activities (e.g., plugging of the condenser tubes and heat exchanger tubes), and include applicable maintenance-induced failure modes in the next update of the internal flooding PRA to incorporate the revised system pipe break frequency values from EPRI Report 3002000079, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment", Revision 3 (Reference 20 of this Attachment). The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. There have been a very limited number of human induced flood events that were screened out. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-10 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition 1-3/ IFSN-A6 Internal Flooding RG 1.200 Revision 2 (Reference 2 of this Attachment) documents a qualified acceptance of this supporting requirement (SR). The NRC resolution states that to meet Capability Category II, the impacts of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement) must be qualitatively assessed using conservative assumptions. Status: Partially Closed. Basis: Assumption 2 in Section 3.1.3 of 13-NS-C096 (Reference 18 of this Attachment) states that "All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., water-proofing), spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect." This assumption is appropriate and effectively bounds the potential impacts from jet impingement, pipe whip, spray, submergence, etc. However, this assumption of susceptible equipment failure in the flood originating room does not always bound the impact of humidity, condensation, and temperature concerns because of the potential propagation of the flooding effects (e.g., steam). From this consideration, the assumption is nonconservative. Recommendation: For the applicable flood scenarios in relevant locations, evaluate the effects of humidity, condensation, and temperature by considering the possible propagation from the initiating room to all connecting rooms. Also see F&O 1-1. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-11 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition 1-4/ IFEV-A6 Internal Flooding There is no evidence in 13-NS-C097 (Reference 19 of this Attachment) that a search was made for plant-specific operating experience, plant design features, and conditions that may impact flood likelihood and no Bayesian updating was performed.

However, adjustments are made to some initiating event frequencies based on system run times to account for differences between impacts when the pumps are running or in standby. Status: Partially Closed. Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) addressed the finding on "lack of search for plant-specific operating experience, plant design features, and conditions that may impact flood likelihood" with a discussion of the search of flood type events in the PVNGS Site Work Management System database and License Event Reports. It also discusses the review of the PVNGS maintenance procedures on flood prevention guidelines and the potential of maintenance induced flooding. No Bayesian update was performed on the flood initiating event frequency due to insufficient flood data at PVNGS. However there were a few events associated with leaks/flooding that were screened based on the impact of those events on safety-related or PRA equipment. The criteria for screening of flooding events based on impact may not be applicable to the screening of flood events performed for the purpose of evaluating the likelihood of flooding. Recommendation: Develop criteria for screening of flood events for the purpose of evaluating the likelihood of flooding or flooding frequency. The criteria may be in terms of potential spatial impact of the flood event. Use the criteria to re-evaluate the flooding events at PVNGS for the purpose of flood frequency update. Unscreened flooding events should then be used for updating the applicable flooding frequency. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. There have been a very limited number of flood events that were screened out. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-12 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition SHA-E2-01 / SHA-E2 Seismic The evaluation and incorporation of uncertainties in the site response velocity profile may not be properly incorporated because of insufficient or unreviewable site-specific data and/or its documentation. Also, the site response evaluation was completed using a Senior Seismic Hazard Analysis Committee (SSHAC) Level 1 (L1) process which does not meet the ASME general

Capability Category II guidelines (Reference 4 of this Attachment). Status: Open. Basis: Finding SHA-E2 is considered as Open. The technical basis for this conclusion is summarized below and is supported by the documentation as found in LCI Report 2211-PR-07-Rev. 4 (Reference 21 of this Attachment),

Seismic Hazard Evaluation for Palo Verde Nuclear Generating Station, dated 8/27/2013 (referred to as LCI, 2013), and LCI Report PC No. PV-001-PC-05, Rev. 0 (Reference 22 of this Attachment), Soil Hazard and GMRS/FIRS Calculation for Palo Verde Nuclear Generating Station, dated 2/27/2015 (referred to as LCI, 2015b). LCI (2013) provides a set of soil hazard curves fractiles and for peak ground acceleration (pga) a set of 96 aggregate pga hazard curves. It is assumed that the aggregate pga hazard curves were derived for use as part of the seismic risk quantification. LCI (2013) provides an adequate summary of how the aggregate pga hazard curves were developed and compared to the pga hazard curve fractiles. LCI (2015b) provides an updated set of soil hazard curves in part based on the updated site response evaluation completed at the Palo Verde site. LCI (2015b) provides sufficient technical material to understand how the site response results were combined with the soil hazard curves for rock site conditions to produce and updated set of soil hazard curves for the Palo Verde site. Finding SHA-E2 is related to the assessment of aleatory and epistemic uncertainties in site response, and their subsequent impact on the derivation of soil hazard curves. The disposition to this finding states, "A SSHAC L3 analysis was performed subsequent to the seismic PRA development as part of the NTTF response to the NRC 50.54f letter on Fukushima. The SSHAC L3 analysis produced a site hazard curve which is bounded by the SSHAC L1 hazard curve developed and used in the Seismic PRA model. Therefore, the issue is resolved by the updated SSH AC L3 hazard analysis". While the updated probabilistic seismic hazard analysis completed for the Palo Verde site included SSHAC L3 seismic source characterization and ground motion characterization models, the site response analysis was not completed using an explicit SSHAC process. It is important to note that there is no mandate to complete the site response analysis following the SSHAC guidance; the approach and method documented in LCI [2015a and 2015b (References 23 and 22 of this Attachment)] is consistent with expectation documented as part of EPRI guidance (SPID) which has been endorsed by the NRC. The updated seismic hazard curves provided by LCI (2015b) and associated impacts on fragilities will be incorporated into the seismic PRA. These changes are not expected to have a significant impact on CDF or LERF based on the NRC review of the updated seismic hazard curves LCI (2015b) which found the updated seismic hazard is bounded by the current design-basis safe shutdown earthquake at most frequencies above 1 Hertz and minor exceedances above 1 Hertz to be considered "de minimis" ,ADAMS Accession No. ML16221A604 (Reference 24 of this Attachment) These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-13 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition SHA-E2-01 / SHA-E2 Seismic (cont.) However, the seismic hazard curves provided by LCI (2015b) (Reference 22 of this Attachment) were not explicitly compared to those derived in LCI (2013)

(Reference 21 of this Attachment) to corroborate the disposition provided. LCI (2015b) (Reference 22 of this Attachment) does not include updated hazard curve fractiles for pga that can be compared to either the pga fractiles or the aggregate pga hazard curves as found in LCI (2013) (Reference 21 of this Attachment). Comparison of the mean pga hazard curves [Table 7.1 from LCI (2013) (Reference 21 of this Attachment) to Table 2 from LCI (2015b)]

indicates that the updated pga hazard has increased, thus it is not clear if the seismic risk quantification using the pga hazard curves form LCI (2013) (Reference 21 of this Attachment) is appropriate. For example at a pga = 0.5g the mean hazard has increased from 1.72E-6 [Table 7.1 from LCI (2013) (Reference 21 of this Attachment)] to 6.53E-6 Table 2 from LCI (2015b)

(Reference 22 of this Attachment)]. In summary, insufficient information has been provided to demonstrate that the updated pga soil seismic hazard curves is bounded by the pga soil hazard curve used in the Seismic PRA model. Recommendation: Demonstrate that the updated set of soil pga hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil pga hazard curves used in the Seismic PGA model. If the updated set of soil pga hazard curves is greater than those used in the Seismic PRA model, the impact on Seismic risk quantification should be assessed.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-14 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition SFR-F3-01 / SFR-F3 Seismic The draft report LTR-RAM-II-12-074 indicates that the draft relay assessment uses the IPEEE relay assessment as the starting point but accounts for the updated seismic hazard curve at the site. However, the report includes the following statement in Section 2.3 (Unaddressed Relays): This list (unaddressed relays) included 69 such relays. Of the relays that have been included in the SPRA, their seismic fragility events are found in many of the dominant CDF cutsets. Status: Partially Closed. Basis: In response to F&O SFR-F3-01, two documents were provided: 1) Westinghouse Letter LTR-RAM-II-12-074 R002 - PV SPRA - Relay Assessment.pdf (Reference 25 of this Attachment), and 2) 11c4043-cal-028 rev0 (Reference 26 of this Attachment) Seis Frag for Sel Relays.pdf. These two documents were reviewed to support the conclusion that the previously unaddressed relays have been addressed and are included in the SPRA model and quantification. The following paragraphs provide the basis for the conclusion that the reported fragilities are reasonable, and provide recommendations for completeness of documentation. Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) - PV SPRA incorporates into the existing relay database 288 additional relays including the 69 previously unaddressed in the IPEEE. This document develops the first round relay fragilities based on the relay analysis performed as part of the plant IPEEE. Several relays, including some of the 69 relays that were not addressed in IPEEE, are screened because they are not chatter sensitive. The relays for which chatter is not acceptable are assigned initial HCLPF values based on the IPEEE review level earthquake (RLE) PGA of

0.5 scaled

in accordance with the location specific spectral acceleration ratios of the IPEEE ISRS and the SPRA ISRS. These initial HCLPF values are substantiated with walkdowns of host components. The reported initial quantification using these HCLPF and generic betas identified the dominant relay contributors. Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) - PV SPRA describes the modelling of the relays in the SPRA. S&A Calculation 11c4043-cal-028 (Reference 26 of this Attachment) documents the detailed fragility analysis using separation of variable for 13 relays selected from the top contributors. The median capacity is based on the in-cabinet seismic demand on the relays associated with the SPRA ISRS, and EPRI relay GERS. The associated uncertainty parameters are obtained by using the separation of variables method. The resulting fragility parameters are scaled to conform to the revised seismic hazard and the revised GMRS. We concur with the analysis and feel that the resulting fragilities are sufficiently realistic. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have any impact on CDF or LERF since the recommendations are associated with documentation changes to better explain modeling rationale. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-15 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)

Disposition SFR-F3-01 / SFR-F3 Seismic (cont.) Finding SFR-F3-01 could be resolved on the basis that APS will take actions to implement the recommendations provided below and update WEC Document LTRRAM-II-12-074 Rev. 2 (Reference 25 of this Attachment), and S&A Calculation 11c4043-cal-028 Rev. 0 (Reference 26 of this Attachment). Recommendation: The detailed fragility evaluation for dominant relay contributors should demonstrate that the seismic demand is an appropriate median based response, and that the important uncertainties are included in obtaining log standard deviations. We recommend that the following be incorporated into the Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) for completeness: 1. During the closure review, the following information was communicated to the reviewers regarding the unaddressed relays via an e-mail: "The initial fragilities for relays were estimated based on the IPEEE analysis for 0.5g RLE. The 69 relays that were not addressed in Rev. 1 of the Relay Fragility Assessment were subsequently incorporated into the Relay Fragility Assessment Rev. 2. Twenty-nine of the 69 relays were screened out from modeling. However, 40 relays were modeled. They were assigned simplified fragilities based on walkdowns that were already performed on the parent cabinets." The above information in the e-mail communication should be documented in WEC Document LTR-RAM-II-12-074 Rev. 2." 2. In Table 34: Detailed Fragility Candidates, document the source of the factor SFbldg. We also recommend that the following be incorporated into the S&A Calculation 11c4043-cal-028 rev0 (Reference 26 of this Attachment) for completeness of documentation: 1. Justify the use of Best Estimate ISRS as the median. In our opinion, the SSI analysis using BE soil properties, best estimate structure stiffness and a conservative estimate of best estimate structure damping results in a 84th percentile response. 2. The u associated with SSI is obtained using the BE, UB and LB envelop as the 84th and the BE alone as the median. Please explain the rationale that this results for the same building (Control Building) a wide range of SSI c from 0.09 to 0.22. 3. Explain why the uncertainties associated with structure stiffness and damping, time history simulation and earthquake component combination are ignored in the SOV calculations.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-16

References:

1. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activi ties, Revision 2, March 2009

3. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071200238) dated May 17, 2007

4. ASME/ANS RA-Sa-2009, Standard for Level I/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009

5. NRC Letter Palo Verde Nuclear Generating Station, Units 1,2, And 3 Issuance of Amendments Re: Adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b" (ADAMS Accession No., ML112620293), dated December 15, 2011

6. Palo Verde Engineering Evaluation 3579223 Revision 1, PRA Input to the Risk-Informed Task Force (RITS) 5b License Amendment, dated March 10, 2011

7. ABB Combustion Engineering letter to APS ST-99-542, Probabilistic Safety Assessment Peer Review for Palo Verde Nu clear Generating Station, dated July 12, 1999 8. Westinghouse Letter LTR-RAM-II-10-082, Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Palo Verde Nuclear Generating Station Probabilistic Risk Assessment, dated November 5, 2010

9. Not used.

10. Westinghouse Letter LTR-RAM-12-13, Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS PRA Standard for the Palo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment, dated January 2, 2013

11. Hughes Associates Report 001014-RPT-01, Palo Verde Nuclear Generating Station Fire PRA Focused-Scope Peer Review Report, Revision 0, dated January 22, 2015

12. NRC Letter U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-out of Facts and Observations (F&Os) (ADAMS Accession No., ML17079A427), dated May 3, 2017

13. ABS Consulting Report R-3882824-2037, Palo Verde Gen erating Stations PRA Finding Level Fact and Observation Closure Review, June 23, 2017.

14. 13-NS-B065, At-Power PRA MAAP 4.0.4 Analysis, Revision 7.

15. 13-NS-B061, At-Power PRA Event and Success Criteria, Revision 5.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-17 16. 13-NS-C093, Internal Flooding PRA - Input Data and Walkdown Validation , Revision 1.

17. 13-NS-C094, Internal Flooding PRA - Qualitative Screening Evaluation , Revision 1.

18. 13-NS-C096, Internal Flooding PRA - Characterization of Flood Scenarios , Revision

2. 19. 13-NS-C097, Internal Flooding PRA - Estimation of Initiating Event Frequencies , Revision 2.

20. EPRI Report 3002000079, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment, Revision 3.

21. LCI Report 2211-PR-07 (LCI 2013), Seismic Hazard Evaluation for Palo Verde Nuclear Generating Stating, Revision 4, dated August 2013.

22. LCI Report PC No. PV-001-PC-05 (LCI 2015b), Soil Hazard and GMRS/FIRS Calculation for Palo Verde Generating Station, Revision 0, dated February 2015.

23. LCI Report PC No. PV-001-PC-04 (LCI 2015a), Development of Site Profile and Amplification for Palo Verde Nuclear Generating Station, Revision 0, dated February 2015. 24. NRC Letter Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Staff Assessment of Information Provided Under Title 10 of the Code of Federal Regulations Part 50, Section 50.54(f), Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force review of Insights from the Fukushima Dai-ichi Accident and Staff Closure of Activities Associated with recommendation 2.1, "Seismic" (CAC NOS. MF5277, MF5278 and MF5279) (ADAMS Access Number ML16221A604), dated September 13, 2016.

25. LTR-RAM-II-12-074, PV SPRA - Relay Assessment, Revision 2.

26. 11C4043-CAL-028, Seismic Fragility for Selected Relays, Revision 0.

27. NEI 12-13, External Hazards PRA Peer Review Process Guidelines , August 2012.

28. NRC Letter U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, "External Hazards PRA Peer Review Process Guidelines" (ADAMS Accession No., ML12321A280), dated November 16, 2012.

29. License Amendment Request to Revise Technical Specifications to implement Risk-Informed Completion Times (ADAMS Accession Number ML15218A300), dated July 31, 2015.

30. NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, dated September 2005.

31. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated April 2015.

32. NRC Regulatory Issue Summary 2007-06 Regulatory Guide 1.200 Implementation, (ADAMS Accession No. ML070650428) dated March 22, 2007.

33. Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments Re: Changes To Technical Specification 3.8.7, Inverters-Operating (ADAMS Accession Number ML102670352), dated September 29, 2010.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-18 34. Westinghouse Letter to APS CVER-13-028, Transmittal of Palo Verde Seismic PRA - Final Peer Review Report, February 14, 2013.

35. Palo Verde Nuclear Generating Station Other External Hazards PRA Peer Review Report, December 2011

.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 7 7-1 ATTACHMENT 7 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This attachment is not applicable to the PVNG S submittal. APS' proposal solely uses PRA models in its Risk-Informed Completion Ti me Program for which there are standards endorsed by the NRC in Regulatory Guide 1.200, Revision 2.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 8 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-1 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models Introduction Section 5.0, Item 5 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a justification for excluding any risk sources determined to be insignificant to the calculation of configuration-specific risk, and provide a discussion of any conservative or bounding analyses to be applied to the calculation of risk-informed completion times (RICTs) fo r sources of risk not addressed by the PRA models.

Scope NEI 06-09-A and the associated Pressurized Water Reactor Owners Group (PWROG) guidance (Reference 2 of this Attachment) do not provide a specific list of hazards to be considered in an RICT Program. However, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (Reference 3 of this Attachment), provides guidance on how to trea t uncertainties associated with PRA in risk-informed decision making relative to hazards that are not considered in the PRA model. Specifically, Section 6.3.3.1 of NUREG-1855 provides the following list of external hazards that should be addressed either via a bounding analysis or included in a PRA calculation:

Aircraft impacts

External flooding

Extreme winds and tornados (including generated missiles)

External fires (addressed in Table A8-1, Screening Summary of External Hazards

, by the following two External Hazards: Forest or Range Fire and Industrial or Military Facility Accident)

Accidents from nearby facilities

Pipeline accidents (e.g., natural gas)

Release of chemicals stored at the site

Seismic events

Transportation accidents

Turbine-generated missiles The scope of this Attachment considers the above hazards for PVNGS, except for seismic events which are addressed by the PRA model.

Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of risk-managed TSs. Consistent with NUREG-1855, the process includes the ability to address external hazards by:

Screening the hazard based on a low frequency of occurrence Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-2

Bounding the potential impact and including it in the decision-making

Developing a PRA model to be used to calculate RICTs and associated Risk Management Action Times (RMATs)

ASME/ANS PRA Standard RS-S-2008 (Reference 4 of this Attachment) has endorsed the following set of five external hazard screening criteria:

1) The hazard would result in equal or lesser damage than the events for which the plant has been designed. This requires an evaluation of plant design bases to estimate the resistance of plant structures and systems to a particular external hazard. 2) The hazard has a significantly lower mean frequency of occurrence than another event (taking into account the uncertainties in the estimates of both frequencies), and the hazard could not result in wors e consequences than the other event.

3) The hazard cannot occur close enough to the plant to affect it. Application of this criterion needs to take into account the range of magnitudes of the hazard for the recurrence frequencies of interest.

4) The hazard is included in the definition of another event.

5) The hazard is slow in developing, and it can be demonstrated that sufficient time exists to eliminate the source of the threat or to provide an adequate response.

The review of external hazards considers two aspects of the cont ribution to risk. The first is the contribution from the occurrence of beyond design basis conditions (i.e., winds greater than design). These beyond-design-basis conditions challenge the functionality of the systems, structures, and components (SSCs) to support safe shutdown of the plant. The second aspect addressed are the challenges caus ed by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (i.e., high winds causing loss of offsite power). While the plant design basis assures that the safety-related equipment necessary to respond to th ese challenges are prot ected, the occurrence of these conditions nevertheless causes a demand on these systems and can impact configuration risk.

Note that when the effect of a particular hazard is not able to be mitigated using the plant SSCs, then there is no impact on the changes in risk calculated to support the RICT Program, and these hazards can be screened out of the RICT Program as well. Only events which create a demand for mitigation equipment are potentially relevant to the RICT Program. The review and disposition of each external hazard is addressed in Table A8-1.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-3 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Aircraft Impact Y PS2 PS4 Airport hazard meets 1975 Standard Review Plan (SRP) requirements. Additionally, airways hazard bounding analysis per NUREG-1855 is < 1E-6/y. Avalanche Y C3 Not applicable to the site because of climate and topography. Biological Event Y C3, C5 Sudden influxes not applicable to the plant design [closed loop systems for Essential Cooling Water System (ECWS) and Component Cooling Water System (CWS)]. Slowly developing growth can be detected and mitigated by surveillance. Coastal Erosion Y C3 Not applicable to the site because of location. Drought Y C5 Plant design eliminates drought as a concern and event is slowly developing. External Flooding Y PS2 Plant design meets 1975 SRP requirements. Extreme Wind or Tornado Y PS2 PS4 The plant design basis tornado has a frequency < 1E-7/y. The spray pond nozzles (not protected against missiles) have a bounding median risk < 1E-7/y. Fog Y C1 Limited occurrence because of arid climate and negligible impact on the

plant. Forest or Range Fire Y C3 Not applicable to the site because of limited vegetation. Frost Y C1 Limited occurrence because of arid climate. Hail Y C1 C4 Limited occurrence and bounded by other events for which the plant is designed. Flooding impacts covered under Intense Precipitation. High Summer

Temperature Y C1 Plant is designed for this hazard.

Associated plant trips have not occurred and are not expected.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-4 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment High Tide, Lake Level, or River Stage Y C3 Not applicable to the site because of location. Hurricane Y C4 Covered under Extreme Wind or Tornado and Intense Precipitation. Ice Cover Y C3 C1 Ice blockage causing flooding is not applicable to the site because of location (no nearby rivers and climate conditions). Plant is designed for freezing temperatures, which are infrequent and short in duration. Industrial or Military

Facility Accident Y PS2 Explosive hazard impacts and control room habitability impacts meet the 1975 SRP requirements (RGs 1.91 and 1.78). Internal Flooding N None PRAs addressing internal flooding have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Flooding PRA. Internal Fire N None PRAs addressing internal fire have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Fire PRA. Landslide Y C3 Not applicable to the site because of topography. Lightning Y C1 Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events. However, other causes are also included. The impacts are no greater than already modeled in the internal events PRA. Low Lake Level or River Stage Y C3 Not applicable to the site because of location.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-5 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Low Winter Temperature Y C1 C5 Extended freezing temperatures are rare, the plant is designed for such events, and their impacts are slow to develop. Meteorite or Satellite

Impact Y PS4 The frequency of meteorites greater than 100 lb striking the plant is around 1E-8/y and corresponding satellite impacts is around 2E-9/y.

Pipeline Accident Y C3 Pipelines are not close enough to significantly impact plant structures. Release of Chemicals in Onsite Storage Y PS2 Plant storage of chemicals meets 1975 SRP requirements. River Diversion Y C3 Not applicable to the site because of location. Sand or Dust Storm Y C1 C5 The plant is designed for such events. Also, a procedure instructs operators to replace filters before they become inoperable. Seiche Y C3 C1 Not applicable to the site because of location. Onsite reservoirs and spray ponds designed for seiches. Seismic Activity N None PRAs addressing seismic activity have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA or Seismic Margins Assessment (SMA) for this hazard which is addressed in the PVNGS Seismic PRA. Snow Y C1 C4 The event damage potential is less than other events for which the plant is designed. Potential flooding impacts covered under external flooding. Soil Shrink-Swell Consolidation Y C1 C5 The potential for this hazard is low at the site, the plant design considers this hazard, and the hazard is slowly developing and can be mitigated. Storm Surge Y C3 Not applicable to the site because of location.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-6 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Toxic Gas Y C4 Toxic gas covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident. Transportation

Accident Y PS2 PS4 C3 C4 Potential accidents meet the 1975 SRP requirements. Bounding analyses used for offsite rail shipment of chlorine gas and onsite truck shipment of ammonium hydroxide. Marine accident not applicable to the site because of location. Aviation and pipeline accidents covered under those specific categories. Tsunami Y C3 Not applicable to the site because of location.

Turbine-Generated Missiles Y PS2 Potential accidents meet the 1975 SRP requirements. Volcanic Activity Y C3 Not applicable to the site because of location.

Waves Y C3 C4 Waves associated with adjacent large bodies of water are not applicable to the site. Waves associated with

external flooding are covered under that hazard.

See references of this Attachment Note a - See Table A8-2, Progressive Screening Approach for Addressing External Hazards, for descriptions of the screening criteria.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-7 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Initial Preliminary Screening C1. Event damage potential is < events for which plant is designed. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse consequences than other events analyzed. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the plant to affect it. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of another event. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 Not used to screen. Used only to include within another event.

C5. Event develops slowly, allowing adequate time to eliminate or mitigate the threat. ASME/ANS Standard Progressive Screening PS1. Design basis hazard cannot cause a core damage accident. ASME/ANS Standard RA-Sa-2009 PS2. Design basis for the event meets the criteria in the NRC 1975 Standard Review Plan (SRP). NUREG-1407 and ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the mean conditional core damage probability is <

0.1. NUREG-1407 as modified in ASME/ANS Standard RA-Sa-2009 PS4. Bounding mean CDF is < 1E-6/y. NUREG-1407 and ASME/ANS Standard RA-Sa-2009 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-8 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Detailed PRA Screening not successful. PRA needs to meet requirements in the ASME/ANS PRA Standard. NUREG-1407 and ASME/ANS Standard RA-Sa-2009 *See references of this Attachment

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk-Informed Completion Time and Risk Managed Action Time for RITSTF Initiative 48, August 2010

3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 2009

4. American Society of Mechanical Engi neers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Levei1/Lar ge Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.

5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975 6. NUREG/CR-2300, PRA Procedures Guide, January 1983

7. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 9 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 9-1 Baseline Core Damage Frequency and Large Early Release Frequency Section 4.0, item 6 of the NRC final safety evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide the plant specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm that these are less than 1E-4/year and 1E-5/year respectively, thus assuring that the potential risk increases allowed under the RMTS program are consistent with Regulatory Guide (RG) 1.174, Revision 1 (Reference 2 of this Attachment). RG 1.174, Revision 2 (Reference 3 of this Attachment) issued by the NRC in May 2011, did not revise these limits.

This attachment demonstrates that the total CDF and total LERF are less than the guidance of RG 1.174, such that the risk metrics of NEI 06-09-A may be applied to the PVNGS Risk-Informed Completion Time (RICT) Program.

Table A9-1, Total Unit 1/2/3 Baseline Average CDF/LERF, provides the CDF and LERF values that resulted from a quantification of the ba seline average annual mode ls (References 4, 5, 6, 7, and 8 of this Attachment), which include contributions from internal events, internal flooding, internal fire, and seismic hazards. Other external hazards are below accepted screening criteria and do not contribute significantly to the totals.

The CDF and LERF for each unit at PVNGS are the same because each unit is nearly identical to the others by design and through the modification process. There are small differences between the units that have been evaluated and found to have minimal risk significance. Examples include:

Unit 1 has a manual transfer switch between each of its four trains of safety-related inverters and their backup regulated power source, while the other two units have automatic transfer switches.

Field routed cabling As demonstrated in the table, the total CDF and total LERF are within the guidance of RG 1.174 to permit small changes in risk which may occur during implementation of RICTs. Therefore, the PVNGS RICT Program is consistent with NEI guidance.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 9-2 Table A9-1: Total Unit 1/2/3 Baseline Average Annual CDF/LERF 1 Hazard CDF (per reactor-yr)

LERF (per reactor-yr)

Internal Events 1.3E-6 4.3E-8 Internal Flooding 4.6E-7 2.1E-8 Seismic 3.1E-5 5.7E-6 Internal Fire 2.9E-5 2.4E-6 Total 6.2E-5 1 8.2E-6 1 Note: 1. The Baseline Average Annual CDF/LERF include average maintenance unavailability of structures, systems, and components (SSCs). The configuration risk management program model used for the RICT Program does not include maintenance unavailability of SSCs unless specific to the configuration.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 November 2002

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. PVNGS Study 13-NS-B067, At-Power PRA Quantification, Revision 6

5. PVNGS Study 13-NS-C042, At-Power Level 2 PRA LERF Quantification, Revision 1

6. PVNGS Study 13-NS-F004, Fire PRA - Quantification and Screenings, Revision 0

7. PVNGS Study 13-NS-C099 "Internal Flooding PRA - PRA Modeling and Quantification, Revision 2

8. Westinghouse Calculation CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 10-1 ATTACHMENT 10 Justification of Application of At-Power PRA Models to Shutdown Modes This attachment is not applicable to the PVNGS submittal. APS is not proposing to apply the Risk-Informed Completion Time Program in shutdown modes, but only in Modes 1 and 2.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 11 Probabilistic Risk Assessment Model Update Process

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 11-1 Probabilistic Risk Assessment Model Update Process Summary Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the probabilistic risk assessment (PRA) models which support the RMTS are maintained consistent with the as-built/as-operated plant. Palo Verde Nuclear Generating Station (PVNGS) procedure 70DP-0RA03 Probabilistic Risk Assessment Model Control (Reference 2 of this Attachment), controls update and maintenance of the PRA models. This procedure is in full compliance with ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 3 of this Attachment) for PRA model maintenance and update.

This attachment describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions, will be identified and reviewed prior to implementation to determine if they could impact the PRA models. The PRA Configuration Control Program will ensure these plant changes are incorp orated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models, which will be addressed through the PVNGS Corrective Action Program.

Should a plant change or a discovered condition be identified that has a significant impact to the RICT program calculations as defined by the Configuration Risk Management Program (CRMP), an interim update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic PRA model updates will be performed no less frequently than every two refueling cycles (i.e., three years), consistent with the guidance of NEI 06-09-A.

PRA Model Update Process The PRA Configuration Control Program ensures that the applicable PRA model used for the RICT Program reflects the as-built, as-operated plant for the three PVNGS units. The PRA Configuration Control Program delineates the responsibilities and guidelines for updating the full-power internal event, internal flood, internal fire, and seismic PRA models, and includes both periodic and interim PRA model updates. The procedure requires an update to be initiated at least once every three years to reflect industry operating experience (other than data), plant design and procedure changes. An update of PRA model data, including initiating event, component unavailability, component reliability, and common cause data is also required by the procedure to be initiated at least once every three years. The program includes guidance on identifying, evaluating, and documenting potential impacts (e.g., plant changes, plant/industry operational experience, or errors or limitations identified in the model). In addition, guidance is provided on assessing individual and cumu lative risk impacts of pending changes. Finally, the PVNGS software quality assurance program records Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 11-2 the controlled version of the PRA and CRMP models and associated references.

Review of Plant Changes for Incorporation into the PRA Model

1) Plant changes or discovered conditions, as defined in the PRA Configuration Control Program, are reviewed for potential impact to the PRA models, including the CRMP model and the subsequent risk calculations which support the RICT Program. 2) Plant changes that meet the criteria defined in the PRA Configuration Control Program (including consideration of the cumulative impact of other pending changes) will be incorporated in the applicable PRA model(s), consistent with the NEI 06-09-A guidance. Otherwise, the change is assi gned a priority and is incorporated at a subsequent periodic update consistent with procedural requirements.

3) PRA updates for plant changes are initiated at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A.

4) If a change is required for the CRMP model, but cannot be immediately implemented for a significant plant change or discovered condition, either:

A. Alternative analyses to conservatively bound the expected risk impact of the change will be performed. In such a case, these alternative analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A. or B. Appropriate administrative restrictions on the use of the RICT Program will be put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. PVNGS Procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control

3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 12 Attributes of the Configuration Risk Management Program (CRMP)

Model Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-1 Attributes of the Configuration Risk Management Program (CRMP)

Model Introduction Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support RMTS, including identification of how the baseline PRA model is modified for use in the Configuration Risk Management Program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. The scope of structures, systems, and components (SSCs) within the CRMP will be provided. This item should also confirm that the CRMP tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant specific RMTS submittal.

This attachment describes the necessary changes to the peer reviewed baseline PRA models for use in the CRMP software to support the Risk-Informed Completion Time (RICT) Program. The process employed to adapt the baseline models for CRMP use is demonstrated: (1) to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; (2) to maintain the quality of the peer reviewed PRA models; and (3) to correctly accommodate changes in risk due to time-of-year, time-of-cycle, and configuration-specific considerations. Quality controls and training programs applicable for the CRMP are also discussed in this enclosure.

Translation of Baseline PRA Model for Use in CRMP: The baseline PRA models for internal events, including internal floods, internal fires, and seismic events, are the peer reviewed models, updated as described in Attachment 11 of this Enclosure to reflect the as-built

/as-operated plant. These models are modified to include changes that are needed to facilitate configuration-specific risk calculations to support the RICT Program implementation. The baseline models, and the changes made to create the CRMP model used in the RICT Program, are controlled using plant calculations, which include the necessary quality controls and reviews. The changes to the models to account for variations in system success criteria based on time-of-year or time-in-operating cycle, and other specific changes needed to properly account for configuration-specific issues, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle, are described in Table A12-1, Changes Made for Configuration-Specific Risk.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-2 TABLE A12-1 CHANGES MADE FOR CONFIGURATION-SPECIFIC RISK DESCRIPTION BASIS FOR CHANGE Plant Availability The baseline PRA models account for the time the reactor operates at power by using a plant availability factor. This is appropriate for determining the average annual (time-based) risk, but the factor is not applicable to configuration-specific risk calculated for the RICT Program. In order to account for the assumption that the plant is always operating in the RICT Program, the frequency of initiating events which include an availability factor are adjusted. This change is necessary to adjust the modeled initiating event frequencies from a "per year" to a "per reactor year" basis for use in the CRMP. Maintenance Alignment Probabilities Maintenance alignment probabilities in the baseline PRA models have probabilities based on the fraction of the year the equipment is unavailable. For the CRMP model, the actual configuration of equipment is evaluated, so the maintenance alignment probabilities are set to zero. This is also done for the system initiating events, which include maintenance contributions.

Excluded Maintenance Combinations The PRA models will not remove excluded maintenance combinations allowed by the technical specifications (i.e., both trains of a single safety system being simultaneously unavailable).

Room Cooling Success Criteria The baseline PRA models include conservative success criteria for room cooling and do not use average annual criteria; therefore, no changes to the CRMP model for room cooling success criteria are required.

Unfavorable Exposure Time (UET) for anticipated transient without trip (ATWT)

Events The current PVNGS core design reflected in the baseline PRA model for ATWT events includes a UET for variable success criteria based on time of core life (i.e., moderator temperature coefficient early in cycle life). The event is set to the fraction of the year for which the UET applies and will be changed to a probability of 1 or 0 based on operator input using the CRMP tool, depending on the actual time in the operating cycle. Quality Requirements and Consistency of PRA Model and CRMP Tools The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA maintenance and update process described in Attachment 11 of this Enclosure and the use of self-assessments and independent peer reviews described in Attachment 6 of this Enclosure

. The information provided in Attachment 6 demonstrates that the PVNGS internal event, internal flood, internal fire, and seismic PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200 Revision 2 (Reference 2 of this Attachment). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.

The current PRA models will either be combined into a single CRMP model for use in the CRMP software tool, or will be used to generate pre-solved solutions for routine plant configurations which will be entered into the CRMP software tool. PVNGS has been using a single CRMP model in EPRI CRMP model for more than eight years based on combined internal events and internal fire models. The CRMP model is rigorously checked against the individual PRA model results to validate the CRMP model quality. If a new CRMP model Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-3 including the upgraded fire and new seismic PRA models cannot be developed that meets work management and scheduling needs for solution speed, PVNGS will take the approach used by South Texas Project by pre-solving thousands of routine expected configurations and saving the results of those solutions in the CRMP software tool. When unanalyzed configurations occur, PRA would promptly solve the PRA models to determine the RICT as well as comply with existing Maintenance Rule configuration risk monitoring requirements. PVNGS currently has and will continue to provide a qualified PRA engineer on call 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months a day, 7 days a week to support Operations and Work Management in assessing the risk of planned and emergent plant configurations.

Changes made to the baseline PRA model in translation to the CRMP model will be controlled and documented per procedure 70DP-0RA03 to maintain the existing CRMP model. An acceptance test is performed after every CRMP model update to verify proper translation of the baseline PRA models and acceptance of all approved changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components to the basic events in the CRMP model. Training and Qualification The PVNGS PRA staff is responsible for development and maintenance of the CRMP model. The PRA staff is trained in accordance with the site Engineering personnel training program and has passed specific qualifications on each major element of the PRA development and use. Operations and Work Control staff will use the CRMP tool under the RICT Program and are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is accredited by I N PO. Application of the CRMP Tool to the RICT Program Scope PVNGS will use the EPRI CRMP tool for RICT Program calculations. The EPRI program already exists in an approved, issued version to support the RICT Program. PVNGS currently uses the EPRI tool in the Maintenance Rule CRMP for at-power conditions. The EPRI CRMP tool meets RG 1.174 (Reference 3 of this Attachment) and PVNGS software quality assurance requirements.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-4 References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 ATTACHMENT 13 Key Assumptions and Sources of Uncertainty

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-1 Key Assumptions and Sources of Uncertainty Introduction Section 4.0, Item 10 of the NRC Final Safety Evaluation (Ref erence 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a discussion of how the key assumptions and sources of uncertainty were identified, and how their impact was assessed and dispositioned. This attachment provides that discussion

. Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1.200, Revision 2, (Reference 2 of this Attachment) and the ASME/ANS RA-Sa-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 3 of this Attachment), have been identified for the PVNGS PRA models using the guidance of NUREG-1855 (Reference 4 of this Attachment) and EPRI TR-1016737 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 5 of this Attachment)

. The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups. Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk.

If the PVNGS model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on RICT Program calculations. Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.

Key assumptions and sources of uncertainty for the RICT Program application are identified and dispositioned in Table A13-1, Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations. The conclusion of this review is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for the following:

The seismic PRA model used for the RICT Program will increase all the seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-2 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The only plant system modeled in the PRA that is shared between the three units is the station blackout generators (SBOGs). Simultaneous multiple unit station blackout conditions are screened out based on low probability. SBOGs are

assumed aligned to one unit only during an event. SBOGs can be aligned to multiple units to supply limited loads.

The existing PRA model conservatively

does not credit SBOGs in more than one unit. Further, the plant design for FLEX and beyond FLEX modifications / capabilities provide additional 480V and 4160V supplies to safety buses not currently credited in the PRA models. For RICT Program implementation, PVNGS will consider, based on plant conditions and associated risk levels, risk management actions (RMAs) for use of FLEX equipment such as 480V and 4160V generators when electric power systems to risk significant equipment are unavailable under a RICT.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-3 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Reactor Coolant Pump (RCP)

Seal Leak or Rupture RCP Seal Leak or Rupture is not modeled as a loss of RCS Inventory safety function. Based on Westinghouse WCAP-15749 (Reference 6 of this Attachment) and pump seal vendor information, it was concluded that because of the very tight clearances, leakage into the seal package from the RCS is limited to about 17 gpm per pump. Each of the four RCPs has a seal package which

consists of three seals. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA.

An analysis showed that continuing to model RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF. If RCP seal parameters are not within normal limits indicating potential seal degradation while a RICT is in effect, RMAs will be used to ensure availability of charging pumps or other plant SSCs which can mitigate excessive RCP seal leakage. Loss of Coolant Accident (LOCA) Frequencies NUREG/CR-6928 (Reference 7 of this Attachment) restated the results from NUREG-1829 (Reference 8 of this Attachment). The LOCA frequencies are based upon expert elicitations. The LOCA sizes identified by the NRC are different from those estimated for PVNGS.

The slight variance in the range of break sizes for different LOCAs is not significant and is judged to have minimal impact on LOCA frequencies, within the uncertainties associated with the expert elicitation values, and of insignificant impact to RICT calculations. No special measures are required for the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-4 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Loss of Off-site Power (LOSP) Frequency The national LOSP data presented in the latest EPRI events reports (References 4 and 5 of this Attachment) was used to obtain point-estimates for switchyard centered and severe weather related LOSP frequencies. The EPRI Reports indicate that the generic LOSP data is subject to user modifications and scr eenings to fit the local plant designs and environmental conditions. This approach of LOSP screening is considered reasonable and necessary to avoid erroneous skewing of the LOSP data. The frequency of extreme weather LOSP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid related LOSP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 9 of this Attachment). The LOSP frequencies are based on recent industry data and are appropriate to represent plant-specific conditions. SBOGs, as well as other additional electric power supplies, are available on site to mitigate LOSP. RMAs will consider, based on plant conditions and associated risk levels, these alternate AC sources for

applications of the RICT Program where LOSP events significantly contribute to configuration risk. Loss of Off-site Power at

Switchyard (LOSP) Associated Non-Recovery Probabilities The probabilities of offsite power non-recoveries were obtained from Table 4-1 of the draft NRC NUREG/CR-INEEL/EXT-04-02326. The error factors associated with LOSP frequencies and LOSP non-recovery probabilities were obtained from NUREG/CR-INEEL/EXT-04-02326 (when provided); otherwise, by using available in-house statistical programs for lognormal and Weibull distributions. The offsite power non-recovery probabilities are based on the best available data and are appropriate to represent plant-specific conditions. SBO diesel generators, as well as other additional electric power supplies, are available on site to mitigate LOSP. RMAs will consider, based on plant conditions and associated risk levels, these alternate AC sources for applications of the RICT Program where LOSP events significantly contribute to configuration risk.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-5 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Battery Life Assumptions The PVNGS batte ries are not credited in the long term, because they are conservatively assumed to be discharged after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Although the IEEE Class 1E batteries are designed to operate for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , Engineering has determined that the class batteries' life is at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Thus they are available for power recovery at the 3-hour point on the incident timeline. Crediting the actual higher capacities of the batteries and updated load shedding actions from Fukushima driven procedure changes would result in longer RICTs due to the additional mitigation capabilities made available. Therefore, the current PRA model use for the RICT Program is conservative and acceptable. Human Failure Events (HFEs) during a seismic event Accessibility for completion of non-screened human failure events (HFE) during a seismic event is assumed possible for all non-screened HFEs besides those which are assumed to fail in the case where the corridor building or turbine building collapses. Both the collapse of the corridor building and turbine building and their impact on the access to the Main Steam Support Structure is considered in the Seismic PRA model. There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed. A sensitivity analysis was performed evaluating the impact of not crediting the subject HFEs and there was minimal

impact on the CDF and LERF. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Seismic performance shaping factors (PSFs) with respect to seismic-induced flooding. Seismic-only PSFs applied to the internal events HEPs will over-ride the flooding PSFs based on the consideration that the seismic events are more global events than the specific flooding events. No additional mo difications are made to the internal events HEP to consider the possibility of seismic-induced flooding events. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-6 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The Seismic PRA HFE dependency analysis The Seismic PRA dependency analysis assumes that once an accident sequence is initiated, the operator action timing for a seismically induced event is similar to that of an internally induced event for main control room actions. The modification of the timing available due to seismic considerations may result in a longer response or identification time and consequently a higher HEP.

A sensitivity analysis was performed in the seismic PRA quanti fication increasing all the Seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event. The change in CDF and LERF was 9.7% and 5.3%, respectively. Therefore, the current Seismic PRA model used for the RICT Program will increase all Seismic HFEs by a factor of 3 to address this uncertainty.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-7 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic PRA Weighting factors applied to three approaches There is no standardized method to calculate human error probabilities (HEP) in a seismic PRA. Therefore, a mean HEP for each basic event was calculated by combining three accepted approaches [Surry, Kernkraftwerk Muhleberg (KKM), and Swiss Federal Nuclear Safety Inspectorate (ENSI) provided in Reference 10 of this Attachment] using the

following weighting factors: 0.7, 0.15, 0.15, respectively.

More emphasis was given to the Surry method since it was a selective combination of previous approaches and the most recently performed and published method. However, the Surry method has the potential to be the least conservative approach among the three methods. A sensitivity analysis was

performed that ran the Seismic PRA model using only the KKM and ENSI approaches, equally weighted. The change in CDF and LERF was -1.63% and 0.42%. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Relay chatter correlation Relay chatter between relays of the same manufacturer, model number, and plant location, i.e., building and elevation were assumed to be fully correlated. Also, each relay identified as a control switch, push button, or motor starter are fully correlated with other generic, like components. This is a conservative assumption because the demand experienced by a relay is dictated by in-cabinet response and not the in-structure response spectra (ISRS) which the binning is based. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Simplified Relay Fragility Parameters Low risk importance relays (based on Risk Achievement Worth) were treated with a simplified fragility analysis and higher importance relays (10 different types) were treated with a detailed fragility analysis. The simplified relay chatter fragility analysis assumed a c of 0.35 based on engineering judgment. This assumption is reasonable given that none of the c values for the relays evaluated using the detailed fragility analysis were determined to have a c below 0.33 and most had c of around 0.5. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-8 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure of relays and basic event mapping For the relays modeled in the Seismic PRA, the basic event associated with the seismic failure of the relay must be mapped to an existing internal events target basic event. A key source of modeling uncertainty is associated with the mapping of seismic basic events. Failure modes postulated for the PVNGS internal events model may not fully align with their assigned seismic

counterparts. PRA analyst experience is credited in the selection of the appropriate internal events PRA model component failure modes to reflect postulated seismic PRA model component failure modes. This selection was performed by Westinghouse PRA seismic experts and reviewed by APS PRA engineers. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Seismic PRA uses internal events PRA as a starting point The PVNGS Seismic PRA assumes that the internal events PRA that is used as a starting point meets the requirements of Capability Category II of the PRA standard.

The internal events PRA that was used to develop the Seismic PRA was evaluated separately for its PRA quality and was determined to meet Capability Category II of the PRA standard with the exception of System Notebook documentation, which is a commitment herein to fully address prior to RICT Program implementation.

Therefore, the current Seismic PRA model

used for the RICT Program is acceptable. Success criteria for Seismic

PRA If not otherwise specified, the success criteria associated with the internal events PRA logic are considered valid and applicable to accident sequences initiated by a seismic event. However, a standard 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time may not be suitable for a seismic-induced accident scenario because of the longer time needed for offsite power recovery. The base case Seismic PRA uses a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time for the run time of mitigating equipment. A sensitivity case was developed to assess the impact of using a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months mission time for equipment run failures. The change in overall CDF and LERF for this case is 2.73% and 0.69%, respectively.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-9 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure correlation Seismic failures are assumed to be completely correlated. This assumption implies that a single basic event is used to model the seismic failure of components that are identified as pertaining to the same fragility. There's one exception to this where failures in the steam path in the Turbine Building are not considered correlated with failures of the feedwater lines. The validity of this assumption of complete correlation is still being discussed at the industry level. This is considered a conservative assumption.

Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Seismically induced Loss of Offsite Power (LOSP) The seismically induced LOSP is assumed to bound the fragility of non-seismic class system. This assumption implies that a number of non-seismic class systems are not addressed with a specific seismic failure.

The basis for this assumption is that seismically induced LOSP has a generally low seismic capacity. Scenarios where the non-seismic support systems incur seismically induced failures while offsite power is still available are considered realistic only for very low magnitude seismic events. Therefore, the most significant mitigating equipment will still be available. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the

RICT Program is acceptable. Seismic PRA LOSP recovery In the Seismic PRA, LOSP recovery is not credited for any seismic event above the safe shutdown earthquake (SSE), while it is credited with unchanged probability for a seismic event below the SSE.

It is realistic to consider that offsite power recovery is available for low magnitude seismic events. The selection of the SSE as a threshold between recovery/no-recovery of offsite power is arbitrary and conservative. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-10 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Screening of equipment in the Seismic Equipment List (SEL) Screening of equipment in the Seismic Equipment List (SEL) is based on fragility analysis. Equipment screened by the fragility team as inherently rugged is not modeled in the Seismic PRA for their seismic induced failure. In order to quantitatively capture the impact of screened out equipment, generic fragility parameters for the building that housed the

screened out equipment were used. The screened equipment are modeled through a surrogate basic event at a system level. Using a surrogate event for a number of components that have been screened out introduces a conservative failure mode. The uncertainty introduced by the use of surrogate equipment for the seismic class I system is judged to have a limited impact on the model. Therefore, the current Seismic PRA model used for the

RICT Program is acceptable.

Operators tripping the reactor above operating basis earthquake (OBE)

It is assumed that the operators will always trip the reactor in case of a seismic event above OBE if even the option for a controlled shutdown is allowed. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Train N Auxiliary Feedwater (AFN) Pump (AFN) is assumed to remain functional following a design basis earthquake The AFN Pump is assumed to remain functional with small breaks or leaks at instrument tubing. The fragility analysis associated with the AFN Pump only addresses the pump and not the entire piping network. A sensitivity case was developed to assess the uncertainty in crediting the AFN pump and not the associated piping network. The capacity of the AFN pump was reduced to the same system level fragility parameters associated with the instrument air system. CDF and LERF increased by 0.08% and 0.03% and

indicates little significance of uncertainty in this simplification of the analysis.

Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-11 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Main steam line relief valves not explicitly included in the SEL. Main steam line relief valves are screened out of the analysis on the basis that the steam generator and related piping & valves are considered very rugged. For this reason, the seismic failure of the main steam line relief valves is not modeled. A sensitivity case is developed to assess the impact of this assumption. A fully dependent seismic failure across all 20 relief valves is modeled. CDF and LERF values did not change when compared to the base case results. This indicates that no significant uncertainty. Therefore, the current Seismic PRA model used for the

RICT Program is acceptable. Structural failures of buildings Structural failures of building are assumed to result in major collapse and failure of all equipment hosted inside the building. This is a conservative assumption since the fragility parameters provided are addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the CST tunnel.

Therefore, the current Seismic PRA model

used for the RICT Program is acceptable.

The Anticipated Transient Without Scram (ATWS) logic

for seismic PRA The ATWS logic for seismic PRA assumes that the RCS pressure will be above the HPSI shutoff

head for only a short period of time.

Moderator Temperature Coefficient (MTC) and ATWS pressure transient are not influenced by the fact that the event is initiated by a seismic event rather than a spurious failure. Therefore, the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-12 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT All flood scenarios on the 40ft and 51ft elevations of the Auxiliary Building assumes that a pipe failure drains the Refueling Water Tank (RWT). A cutset review showed that the contribution of Fire Protection (FP) initiators is very low and that the Internal Flood results are not being skewed by this conservatism. This is a conservative approach and should not have a significant impact on the baseline Internal Flood model. This would not have a significant impact on the RICT Program.

A single internal events PRA

model was developed to quantify the plant flood risk for multiple units.

Since there are no significant differences between the units, the Unit 1 System, Structure, or Component (SSC) designators were used. It was therefore assumed th at the quantification results are applicable to all units.

It is a realistic assumption that the Unit 1 SSC designators are used, since there are no major differences between the three units in terms of internal flood. This would not have a significant impact on the RICT Program. All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect. This is a conservative a ssumption that simplifies the impacted component list. Uncertainty exists where exactly the flood would occur, the impact due to the geometry of the room and equipment, and the direction of the spray or splash for a given scenario. This assumption raises CDF. This is a conservative approach that simplifies the impacted component list.

This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Block walls are not credited in the analysis and are treated as typical plant walls. Unless a treatment is non-conservative, the block walls are analyzed on an individual basis.

The amount of water that could flow through the gaps is unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment. This has no impact and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Breaks in pipes less than or equal to two inches in equivalent diameter were only considered if the break would directly result in a plant trip or result in a flood induced equipment failure that would result in a plant trip or immediate shutdown. The basis for this assumption is as follows:

1. Provides a practical limit to bound the scope of the analysis to potentially large flow rate and significant consequence events.

2. Pipe sizes of less than or equal to two inch diameter do not accurately reflect plant fluid system flood impacts (i.e. two inch diameter pipes produce significantly smaller flood rates).

3. At low flow rates, typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful. Such conditions enhance operator actions signif icantly to successfully mitigate the breaks in small bore pipes.

However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events. Specifically these events are considered in rooms without drains. Piping le ss than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented. This is a conservative approach and is of low consequence to RICT.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-14 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Closed-loop systems and tanks were assumed to instantaneously release the entire system inventory This is a conservative approach that allows for the consideration of all consequences and does not require time based calculations. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Control Room staff would be unable to respond effectively to multiple events immediately following the flooding event Human Error Probability (HEP) and Performance Shaping Factors (PSF) adjustments were made during the early stages of a flooding event to account for the additional stress influencing factors. The CDF is higher with this assumption. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. No addition to the Control Room crew is credited early into a flood event when assessing human actions.

Operator actions to isolate the flood source are required shortly after detecting that a Pressure Boundary Failure (PBF) has occurred. Often when responding to flood events operators are responding to multiple alarms.

It is a realistic assumption that there would be no addition to the Control Room crew early into th e flood event when assessing human actions. This would not have a significant impact on the RICT Program. It is assumed that pipes that are larger than 3" were capable of producing major floods unless it was determined that the piping was not capable of producing a major flood. The assumption is conservative as it includes additional piping that may not be conducive to

major flooding. Since, major floods are not a major contributor to the Pressure Boundary Failure frequency, its contribution to risk would be considered minimal. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. External tanks were not

considered as a flood source unless there is a normally available pathway into the plant whereby the tank contents could empty into a room within the main plant

structures. External tanks that are ruptured would not normally propagate into th e plant. There were no tanks identified in this Internal Flood PRA that did not propagate into the plant. It was assumed that the impact of an external tank rupture was bounded by the evaluation performed for internal events. Breach of an external tank was assumed to discharge to the yard area and there would be no flood-induced failures of PRA related components. There is no significant impact on the model. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-15 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floods are assumed to fail all equipment in the initiating room and then propagate out of the room to surrounding flood areas.

Cases in which equipment is deemed as sufficiently high or flood barriers are not expected to retain water to sufficient flood levels are treated on an individual basis. Additionally, splitting the flood areas would generate an unreasonable number of scenarios with no added insight. The Top cutsets are not impacted, however if very specific isolation actions were taken this assumption could be significant. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Floods are assumed to propagate down pipe chases prior than down stairwells in situations where pipe chases are not surrounded by a curb and/or a door must be opened to enter into the stairwell. Water will flow down the path of least resistance therefore a pipe chase is the preferred path over a stairwell with a door in front. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Floods are assumed to propagate through doorways which open out, away from the initiating flood area more readily rather than doorways which open in, towards the initiating flood area. The hydrostatic load that a door can handle is based on whether the door closes against the frame or away (with relation to the room that the flood initiates). A door that is against the frame can withstand a greater load as opposed to away from the door frame. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-16 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floor drains were assumed to be capable of controlling water levels for spray events. This assumption is based on the expectation that a spray event will not result in a significant accumulation of standing water. During plant walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. Drains were not credited for any flood or major flood events. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank. Such events were screened out as potential flood sources. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Grouping boundary condition sets for the LERF analysis results in conservative modeling of the containment isolation valves. Grouping boundary condition sets for the LERF analysis is a conservative approach. The LERF contribution of sequences that have been grouped for the LERF analysis and involve failure of containment isolation valves are considered very low. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The piping layout for flood sources included in the Internal Flood PRA was shown and estimated to be similar for all three units. To the extent possible, the similarities were confirmed during the plant walkdowns.

Therefore, Units 2 and 3 pipe lengths were assumed to be identical to Unit 1 piping lengths. There are no major differences between the three units. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. It is assumed that if a PBF were to occur in the Safety Injection (SI) or Chemical &

Volume Control (CH) system piping, that the operator would isolate the flood at one of the two pipe headers connecting the Refueling Water Tank (RWT) to the CH and SI systems.

There are no operator procedures for isolating a flood event, therefore the most conservative and bounding location to isolate a flood of the SI or

CH is one of the two pipe headers. By isolating at this point it results in the loss of at least one train of the ECCS. This does cause a trip. Therefore the overall impact on the model is small. This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-17 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank and such events were screened out as potential flood sources. Spurious actuation of a system relief valve was not determined to be a credible flood source because the inventory that was released would be retained within the flood area and would not lead to an applicable initiating event. The risk is considered negligible as this is not considered to be a significant source of inventory. This is of low consequence to RICT. This would not have a significant impact on the RICT Program. Limited or no access to an area where flood initiation occurs was assumed. There was no credit taken for mitigation when the equipment relied on for mitigation was located in the flood initiation area. Operators cannot get into flooded areas. This is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Only one internal flood initiating event is assumed to occur at a time. The occurrence of simultaneous multiple independent internal flood events were considered to be very unlikely and were not considered in this evaluation. This is consistent with PRA modeling. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

The breach of isolation barrier(s) that may result in a maintenance-induced flood event was assumed to have no impact on altering the propagation paths related to other flooding mechanisms (i.e., pipe failure) for the flood source. This is a simplifying assumption that has negligible impact on the model. Propagation pathways were made to be conservative for all scenarios This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-18 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The indirect effects of a PBF on the operability of a closed looped system were considered to be immediate. Closed looped systems were considered to be normally operating and provides cooling to equipment that is relied on to maintain the plant in a power production state. It was therefore assumed that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity. A PBF would drain the system and in most cases an operator action to isolate the PBF would not be feasible. This assumption is conservative and raises CDF. This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The spill rate resulting from a PBF of a potential unlimited flood source that causes a spray event is low enough (i.e., <100 gpm) to have no significant impact on the operation of the affected system.

For a potentially unlimited source, a PBF that resulted in a spray event (<100 gpm) would take an extraordinary amount of time to cause a loss of that system. Additionally, given that for most of the large nearly unlimited sources the makeup capabilities of the system would generally exceed the flow rate generated by a spray event. It was therefore assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (i.e. the CH system) this assumption was not valid. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-19 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The flow rate from a PBF is assumed static at the maximum possible rate and the scenario is only ended when the source was exhausted or isolated.

The spill rate resulting from a PBF of piping is considered to be the highest flow rate possible from the system or piping, and for tank is was assumed to be constant at an assumed flow rate, and for systems requiring pumps is considered the realistic pump flow rate, for the particular break in the originating flood area until the flood source was isolated or its water supply was limited or exhausted.

The accumulation of flood water in a flood area was considered halted when the flood source was terminated, or when outflow from the flood area matches or exceeds the inflow of flood water to the flood area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding. Spill rates were assumed to fall within the following categories:

Spray events: 100 gpm

Flood events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)

Major flood events: greater than 2000 gpm (or the maximum capacity of the system, whichever is lower) This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-20 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The treatment of main steamline break and main feedwater line break internal events analysis was assumed to address the impact of these events in assessing whether main feedwater can be recovered following a reactor trip.

Recovery of feedwater is important for secondary side heat removal. The internal events analysis was believed to provide sufficient analysis to be used in the internal flooding model. This is of low consequence to RICT. This would not have a significant impact on the RICT Program.

It was assumed that minimal or no dependency existed between flood-specific and large early release specific Human Failure Events (HFEs). The flood HRA dependency analysis did not include large early release specific HFEs. HFEs specific to large early releases (i.e., post-core damage operator actions) are generally performed several hours after the initiating event occurs. No dependency between early and late operator actions. There is no impact on the model. This is of low consequence to RICT. This would not have a significant impact on the

RICT Program. The fire areas defined by the

Fire Hazards Analysis (which is contained in the UFSAR, Sections 9B.2.1 through 9B.2.22) will substantially contain the adverse effects of fires originating from any currently installed fixed ignition source or reasonably expected transient ignition source. Fire zone boundaries are similarly assumed adequate or combined. Fire areas are required by regulation to be "sufficiently bounded to withstand the hazards associated with the area" as defined in Generic Letter 86-10 (Enclosure 1 Section 4). Fire zone boundaries are similarly assumed adequate; however, because fire zones have a lesser pedigree than fire areas, their boundaries are verified adequately in this notebook by a FHA review and plant walkdowns. Fire zone boundaries that appear unable to withstand the fire hazards within the zone are combined. The fire PRA utilizes fire compartments which generally align with fire zones, but may be a combination of several fire zones. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-21 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Systems and equipment not credited in the fire-induced risk model (e.g., systems for which cable routing will not be performed) are assumed to be failed in the fire-induced risk model. These systems and equipment are failed in the worst possible failure mode, including spurious operation It is assumed that any fire will minimally result in a loss of Main Feedwater and subsequent reactor trip. This is a simplifying and

conservative assumption and is typical of Fire PRAs. However, it may not be true for all fires.

The assumption that any fire fails all equipment lacking cable routing information has the potential to affect the assessed fire risk. The assumption that any fire will minimally result in a loss of Main Feedwater and subsequent reactor trip likely adds conservatism to the Fire PRA results. However, the degree of conservatism is relatively small compared with other modeling uncertainties, since Main Feedwater will trip for most transient events.

The impact of these assumptions was evaluated by a sensitivity analysis case which concluded that the risk reduction due to crediting all components assumed always failed was small.

It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. There are no systems/components that are assumed failed in the fire PRA model that are within the RICT Program.

It is assumed that the Reactor Protection System (RPS) design is sufficiently fail-safe and redundant to preclude fire-induce failure to scram, or random failure to scram during a fire event, as a risk significant

contributor. RPS design is sufficiently fail-safe and redundant to preclude fire-induce failure to scram: Consistent with the guidance in NUREG/CR-6850 (Reference 11 of this Attachment) Section 2.5.1, type of sequences that can be generally eliminated from consideration in Fire PRA include sequences for which a low frequency argument can be made, and uses ATWS as a specific example, because fire-induced failures will almost certainly remove power from the control rods, resulting a trip, rather than cause a "failure to scram" condition. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The low frequency of a fire occurring coincident with the low probability of independent failure to scram results in a negligible contribution to fire risk.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-22 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Properly sized and coordinated electrical protective devices are assumed to function within their design tripping characteristics, thus preventing initiation of secondary fires through circuit faults created by the initiating fire.

Electrical protection design calculations provide the documentation of the electrical coordination between overcurrent protective devices. An evaluation was performed to assess the Fire PRA power supply coordination requirements in accordance with NUREG/CR 6850, and provides a link to relevant PVNGS electrical coordination calculations that demonstrate selective tripping capability for each credited Fire PRA power supply (Reference 11 of this Attachment). When selective tripping cannot be demonstrated, the current fire PRA model credits plant modifications planned to correct the coordination. It is a realistic assumption and is of low consequence to RICT. Electrical coordination will either be established or the fire-induced impact will be modeled.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-23 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that Fire PRA targets were assigned the appropriate radiant heat flux damage and temperature damage criteria depending on the cable insulation information available. In other words, all raceways containing cables with thermoplastic or unknown cable insulation were assigned a radiant heat flux damage threshold of 6kW/m2 and 205 °C. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thresholds.

All raceways containing cables were assigned a radiant heat flux damage threshold of 6kW/m2 and 205 °C. Raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thre sholds. A brief review of the dominant scenarios identified the existence of thermoplastic insulated cables within the target raceways. It is a realistic assumption and is of low consequence to RICT. It was concluded that minimal benefit could be obtained by further analysis to identify and model raceways containing only thermoset insulation.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-24 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Planned plant modifications and recovery actions are assumed in the base case model. These modeled modifications are assumed to correct the fire vulnerability and not introduce any new failure modes. This approach introduces uncertainty in the results, because the actual modifications may vary for those assumed or they may not function as modeled. The assumed modifications are documented in the Fire PRA studies. Plant and model configuration and control mechanisms are in place to ensure that the fire model will be updated to correct the as-installed modifications.

One specific planned plant modification is the installation of an additional Steam Generator Makeup Pump to address Fire PRA risk. A sensitivity was performed that removes this modification from the model This assumption that the planned plant modifications will be installed and tested/operated as assumed in the fire PRA model has significant impact on the RICT Program. The assumption is realistic since the PRA analysis will provide details to the design modifications group in developing the plant modifications and procedures. The PRA model will be revised to reflect the as-built/as-operated plant configuration prior to implementation of the RICT Program.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-25 References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009 3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009

4. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009

5. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008

6. WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008

7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007

8. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies through the Elicitation Process, Draft 9. NUREG/CR-INEEL/EXT 04-0236, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003 (Draft), October 2004

10. Westinghouse Calculation Note CN-RAM-12-022, Revision 1, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, dated December 2, 2013

11. NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, September 2005 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

ATTACHMENT 14 Program Implementation Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14 14-1 Program Implementation Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license am endment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the RMTS implementation, and specifically discuss the de cision process for risk management action (RMA) implementation during a risk-informed completion time (RICT). This attachment provides the required description.

RICT Program Procedures Procedures will be developed to outline the re quirements and responsibilities for the RICT Program. The procedures will provide guidance on departmental responsibilities and management authority for RICT Program application, and for required training, implementation, and monitoring of the RICT Program, including development and maintenance of the configuration risk management program (CRMP) tool and models reflecting the as-built, as-operated plant.

The RICT Program will be implemented by site procedures, which will fully address all aspects of the guidance of NEI 06-09-A. Operations, specifically the control room staff, is responsible for compliance with technical specifications (TS) requirements, and will be responsible for implementation of a RICT and any risk management actions (RMA) determined to be appropriate for the plant configuration. Use of a RICT and associated RMA will be approved by the General Plant Manager prior to entering an extended completion time (CT) for pre-planned activities. For emergent conditions requiring an extended CT, the use of the RICT program will be approved by the applicable Operations Shift Manager or General Plant Manager.

These procedures will be supplemented as necessary to address the additional guidance of NEI 06-09-A for detailed implementation of the RICT Program, including guidance on the following topics:

Performing a Tier 2 assessment for a RICT prior to entry into the TS limiting condition of operation (LCO)

Plant conditions for which the RICT Program is applicable

Conditions under which a RICT may not be used, or may not be voluntarily entered for the calculation of RICTs and RMA Times (RMAT)

Implementation of RICT Program front stops, 30-day backstop and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months backstop limits

Plant configuration changes [i.e., recalculating the RICT and RMAT within the lesser of the affected required action (RA) completion time or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of any change.]

Conditions for exiting a RICT

Requirements to identify and implement RMA when the RMAT is exceeded or is anticipated to be exceeded in accordance with PVNGS Protected Equipment procedure, and NEI 06-09-A

The use of RMAs, including the conditions under which they may be credited in RICT calculations Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14 14-2

Crediting probabilistic risk assessment (PRA) functionality

Approval processes for use of a RICT

Determining PRA availability from detailed PRA functionality characteristics for each Technical Specification LCO

A RICT cannot be entered if PRA functionality must be lost in order to restore the LCO.

Determining PRA availability of degraded SSCs consistent with NEI 06-09-A

Cases where CDF and/or LERF exceed 1E-3/yr and/or 1E-4/yr as delineated in NEI 06-09-A

Analyzing conditions for Common Cause Failures (CCFs), planned and emergent configurations, in accordance with NEI 06-09-A and the guidance of Regulatory Guide 1.177 (Reference 2 of this Attachment).

RICT Program Training

The scope of the training for the RICT Program will include training on rules and processes for the new RICT program, CRMP tool, TS Actions included in the program, and procedures. Training will be carried out in accordance with PVNGS training procedures and processes. Those organizations with functional responsibilities for performing or administering the CRMP shall have required training (e.g., licensed operators, work control personnel, PRA personnel, and station management).

Training will be provided to personnel responsible for performance of risk-managed technical specification (RMTS) actions. This training will be commensurate with the respective responsibilities of the personnel in the following areas:

Programmatic requirements of RMTS program.

Fundamentals of PRA including analytical methods employed and the interpretation of quantitative results. This training should include training on the potential impact of common cause failures, model assumptions and limitations, and uncertainties. The training also should address the implications of these factors in the use of PRA results in decision-making applicable to RMTS.

Plant specific quantitative and qualitative insights obtained from the PRA.

Operation of the plant configuration risk management tool and interpretation of results derived from its application.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 15 Monitoring Program Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 15-1 Monitoring Program Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license am endment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, (Reference 2 of this Attachment) and NEI 06-09-A. (Note that RG 1.174, Revision 2 (Reference 3 of this Attachment), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation for Section 4.0, Item 12.)

This attachment provides a description of the process applied to monitor the cumulative risk impact of implementation of the risk-informed completion time (RICT) Program, specifically the calculation of cumulative risk of extended completion times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.

The calculation of cumulative risk impact is required by the RICT Program at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09, Revision 0 - A. For the assessment period evaluated, data is collected for the risk increases associated with each application of the RICT Program for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk calculated by summing the contributors to risk associated with each RICT application. This is the change in CDF or LERF above the zero maintenance baseline levels while a RICT was in effect (i.e., beyond the front-stop CT). The change in risk is converted to an average annual value.

The total average annual change in risk for extended CTs is compared to the guidance of RG 1.174, Figures 4 and 5 for CDF and LERF ch anges, respectively. If the actual annual risk increase is acceptable (i.e., not in Region I of the figures), then RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the RG 1.174 guidance and implementation of any necessary corrective actions to ensure future plant operation is within the guidance is conducted under the site Corrective Action Program.

The assessment will identify areas for consideration during the evaluation, including, as examples:

Those SSCs where the application of a RICT dominated the risk increase

Contributions from planned vs. emergent RICT applications

Risk management actions (RMA) implemented but not credited in the risk calculations

Offset risk due to RICT application by avoiding multiple shorter outages

Reductions in risk levels through improvements in SSC availability and reliability due to different maintenance strategies and the operational flexibility made possible through the RICT Program Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 15-2 Based on the evaluation, any necessary corrective actions determined to be appropriate are developed and approved by the General Plant Manager or Operations Shift Manager. These may include:

Administrative restrictions on the use of RICTs for specific high-risk configurations based on instantaneous risk levels

Additional RMA for specific high-risk configurations

Rescheduling planned maintenance activities

Deferring planned maintenance to shutdown conditions

Use of temporary equipment to replace ou t-of-service system s, structures or components (SSCs)

Plant modifications to redu ce risk impact of expected future maintenance configurations In addition to the cumulative impact of RICT Program implementation, the unavailability of SSCs is also potentially impacted. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts that may be incurred by implementation of the RICT Program. The use of the MR Program is acceptable since the SSCs in the scope of the RICT Program are also in the scope of the MR. Using the existing MR monitoring for this program is explicitly discussed in RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, (Reference 4 of this Attachment), Section 3.2, "Maintenance Rule Control." The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serves as the "Implementation and Monitoring Program," defined as Element 3 of RG 1.174 for the RICT Program.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007

2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002

3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 16 Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-1 Risk Management Action Examples Introduction Section 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of the process to identify and provide compensatory measures and risk management actions (RMAs) during extended Completion Times (CTs), including specific examples.

This attachment describes the process for identification of risk management actions (RMA) applicable during extended CTs and provides examples of RMA. RMA will be governed by plant procedures for planning and scheduling maintenance activities. This procedure will provide guidance for the determination and implementation of RMA when entering the Risk-Informed Completion Time (RICT) Program and is consistent with the guidance provided in NEI 06-09-A (Reference 2 of this Attachment).

Responsibilities Work Planning / Work Management is responsible for identifying the need for RMA for planned work and Operations is responsible for identifying the need for RMA for emergent work. Operations, PRA and Fire Protection are responsible for developing the RMA.

Operations is responsible for implementation of RMA.

Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded. The RMA are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded as appropriate for the situation. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent ev ent occurs, requiring recalculation of a RMAT alread y in place, the procedure requires a re-evaluation of the existing RMA for the new plant configuration to see if new RMA ar e appropriate. These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A.

RMAs are put in place no later than the point at which the incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. If as the result of an emergent event, the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1E-3 or 1E-4 per year, respectively, RMA are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A. By determining which structures, systems, or components (SSC) are most important from a CDF and/or LERF perspective for a specific plant configuration, RMA may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF and/or LERF allows development of RMA that enhance the plant's capability to mitigate such events.

System-specific configuration risk management system guidelines (CRMSG) will be developed that will define the risk role of plant systems within the scope of the RICT Program, identify SSC explicitly modeled in the system, and Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-2 identify the key SSC failure modes for equipment explicitly modeled. Approved system-specific RMAs will be contained in the CRMSG and be available in each unit Control Room.

It is possible to credit RMAs in the RICT calculations, but such quantification of RMA is not required by NEI 06-09-A. Crediting RMA in the RICT calculations is only done consistent with the guidance of NEI 06-09-A.

NEI 06-09-A classifies RMA into thr ee categories, as described below:

1) Actions to increase awareness and control

Shift brief

Pre-job brief

Training (formal or informal)

Presence of system engineer or other expertise related to maintenance activity

Special purpose procedure to identify risk sources and contingency plans

2) Actions to reduce the duration of maintenance activities

Pre-staging materials

Conducting training on mock-ups

Performing the activity around the clock

Performing walk-downs on the actual system(s) to be worked on prior to beginning work 3) Actions to minimize the ma gnitude of the risk increase

Suspend/minimize activities on redundant systems

Suspend/minimize activities on other systems that adversely affect the CDF and/or LERF

Suspend/minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate

Use temporary equipment for backup power

Use temporary equipment for backup ventilation

Reschedule other maintenance activities

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-3 Examples of specific RMAs that may be considered during a RICT Program entry are found in Table A16-1. These specific limiting condition of operations (LCOs) have been chosen in response to the requests addressed by Southern Nuclear in NL-17-0447 (Reference 3 of this Attachment).

Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition A - One required offsite circuit inoperable

1. Suspend/minimize discretionary activities on the Station Blackout Generators (SBOGs), the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power availability to the unit.

4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.

5. Suspend/minimize discretionary activities on Diesel Generators (DGs) and 4160 VAC bus(es) which could challenge the Availability of DGs and/or 4160 VAC safety bus(es).

6. Consider staging and connecting portable generators to the 4160 VAC safety bus(es).

7. Consider establishing the Outage Control Center (OCC) for oversight and monitoring of the compensatory measures and the actions described in this section.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-4 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition B - One Diesel Generator (DG) inoperable

1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.

4. Maintain Availability of 4160 VAC safety buses.

5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are

expected during the Risk-I nformed Completion Time.

8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-5 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition C - Two required offsite circuits inoperable

1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.

5. Maintain Availability of both DGs, and maintain Availability of 4160 VAC safety bus(es).

6. Consider staging and connecting portable generators per procedure to the 4160 VAC safety bus(es).

7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-6 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition D - One required offsite circuit inoperable AND one DG inoperable

1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.

4. Maintain Availability of 4160 VAC safety buses.

5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are

expected during the Risk-I nformed Completion Time.

8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-7 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition E - Two DGs inoperable

1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Maintain Availability of 4160 VAC safety buses.

4. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

5. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

6. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.

7. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.

8. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-8 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -

Operating Condition F - One automatic load sequencer inoperable

1. Weather conditions will be assessed prior to removing an automatic load sequencer from service during planned maintenance activities.

2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.

3. Perform a beginning of shift brief that focuses on actions operators will take in response to a loss of offsite power or safety injection. Include review of local emergency start of the DG, manual tie to the bus, and manual Class 1E 4160 VAC bus loading for the affected bus.

4. The DGs (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the DGs.

5. Maintain Availability of 4160 VAC safety buses.

6. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

7. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

8. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.

9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-9 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.4 DC Sources -

Operating Condition A - One battery charger on one subsystem inoperable

1. Limit the immediate discharge of the affected battery, if possible.

2. Recharge the affected battery to float voltage conditions using a spare battery charger, if possible.

3. Evaluate the remaining battery capacity and protect its ability to perform its safety function.

4. Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries. 3.8.4 DC Sources -

Operating Condition B - One DC electrical power subsystem inoperable for reasons other than Condition A

1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

3. Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or Loss of Offsite Power (LOOP).

4. Work to establish alternate power to the 125 VDC bus by temporary modification or by implementation of FLEX procedures.

5. Maintain Availability of redundant and diverse electrical systems.

6. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.

7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.7 Inverters

- Operating Condition A - One required inverter inoperable

1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

2. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.

3. Maintain Availability of DC electrical systems within the same train and the redundant train, associated 480 V bus, and associated regulating transformer.

4. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.

5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-10 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.9 Distribution Systems - Operating Condition A - One AC electrical powe r distribution subsystem inoperable

1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of a Class 1E 4160 VAC bus. Also, avoid unnecessary switching (i.e., breaker manipulations) in affected unit AC electrical systems.

2. Maintain Availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.

3. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.9 Distribution

Systems

- Operating Condition B - One AC vital instrument bus electrical power distribution subsystem inoperable

1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of an AC vital instrument bus.

2. Maintain Availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.

3. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.

4. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

3.8.9 Distribution

Systems - Operating Condition C - One DC electrical powe r distribution subsystems inoperable

1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of a DC electrical power distribution subsystem.

2. Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or LOOP.

3. Maintain Availability of redundant and diverse electrical systems.

4. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.

5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.

References:

1. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI D6-09, "Risk-Informed Technical Specifications Initiative 48, Risk- Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995)," Letter from Jennifer M. Golder (NRR) to Biff Bradley (NEI), (ADAMS Accession Number dated ML071200238), dated May 17, 2007.

2. Nuclear Energy Institute (NEI) 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0-A, November 2006.

3. Vogtle Electric Generating Plant Units 1 and 2 Response to Request for Additional Information on Technical Specifications Change to Adopt Risk Informed Completion Times (ADAMS Accession Number ML17108A253), dated April 14, 2017.

@@ Line 2: / Line 2: @@
 | number = ML17307A188
 | issue date = 11/03/2017
-| title = Palo Verde Nuclear Generating Station Units 1, 2, and 3 - License Amendment Request Supplement for Risk-Informed Completion Times
+| title = License Amendment Request Supplement for Risk-Informed Completion Times
 | author name = Lacal M L
 | author affiliation = Arizona Public Service Co

v t e Letter Sequence Supplement
CAC:MF6576, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance Supplement, Supplement Administration Questions 26 February 2016 7 March 2016 4 April 2018 3 May 2018 23 August 2018 Answers 18 May 2018 21 September 2018 14 April 2017 Results Approval Other: ML18275A275
MONTHYEAR2018-10-05 [Table View]

ML17307A188: Difference between revisions

Revision as of 19:25, 27 January 2019

Text

Dear Sirs:

Reference:

Subject:

Enclosure:

1.0 DESCRIPTION

2.0 ASSESSMENT

4.0 ENVIRONMENTAL CONSIDERATION

1.0 DESCRIPTION

2.0 ASSESSMENT

2.1 Applicability

2.2 Verifications

2.3 Proposed

4.0 ENVIRONMENTAL CONSIDERATION

References:

3.3 INSTRUMENTATION

3.3.6 Engineered

3.4 REACTOR

3.5.1 Safety

3.5 EMERGENCY

3.5.5 Refueling

3.6.3 Containment

3.6 CONTAINMENT

3.6.6 Containment

3.7 PLANT

3.7.4 Atmospheric

3.7 PLANT

3.7.5 Auxiliary

3.7 PLANT

3.7.7 Essential

3.7 PLANT

3.7.8 Essential

3.8 ELECTRICAL

3.8.7 Inverters

3.8 ELECTRICAL

3.8.9 Distribution

3.3.6 Engineered

3.5.1 Safety

3.5.5 Refueling

3.6.3 Containment

3.6.6 Containment

3.7.4 Atmospheric

3.7.5 Auxiliary

3.7.7 Essential

3.7.8 Essential

3.8.7 Inverters

3.8.9 Distribution

3.3.6 ESFAS

3.6.3 Containment

3.7.2 MSIVs

3.7.5 Auxiliary

3.7.8 Essential

3.8.7 Inverters

3.8.9 Distribution

References:

0.5 scaled

References:

3.8.7 Inverters

3.8.9 Distribution

3.8.9 Distribution

References:

Navigation menu

Search