Revision as of 19:53, 28 January 2019

Text

License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times
	ML15218A300
Person / Time
Site:	Palo Verde
Issue date:	07/31/2015
From:	Lacal M L; Arizona Public Service Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	102-07060- MLL/DCE
	Download: ML15218A300 (355)
	v • d • e

10 CFR 50.90aps Maria L. Lacal Vice President, Nuclear Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 102-07060-MLL/DCE Mail Station 7605 Tel 623 393 6491 July 31, 2015 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Dear Sirs:

Subject:

Palo Verde Nuclear Generating Station (PVNGS)Units 1, 2, and 3 Docket Nos. STN 50-528,59-529, and 50-530 License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) is submitting a request for a license amendment to revise the Technical Specifications (TSs) for Palo Verde Nuclear Generating Station Units 1, 2, and 3.The proposed amendment would modify TS requirements to permit the use of Risk-Informed Completion Times (RICTs) in accordance with Technical Specifications Task Force (TSTF) traveler TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b. The availability of this TS improvement was announced in the Federal Register on March 15, 2012 (77 FR 15399).The Enclosure to this letter provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific verifications.

Attachment 1 provides the existing TS pages marked up to show the proposed changes. Attachment 2 provides revised (clean) TS pages. Attachment 3 provides existing TS Bases pages marked up to show the proposed changes.This submittal contains new regulatory commitments (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) to be implemented, which are identified in Attachment 4 of the Enclosure.

Attachments 5 through 16 of the Enclosure provide probabilistic risk assessment information to support NRC review of this license amendment request. APS requests approval of the proposed license amendment within one year of the date of this letter, with the amendment being implemented within 180 days of issuance.In accordance with the PVNGS Quality Assurance Program, the Plant Review Board and the Offsite Safety Review Committee have reviewed and approved the proposed A member of the STARS (Sfrategic Teaming and Resource Sharing) Alliance O ATT'N: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times Page 2 amendment.

By copy of this letter, this license amendment request is being forwarded to the Arizona Radiation Regulatory Agency pursuant to 10 CFR 50.9 1(b)(1).Should you have any questions concerning the content of this letter, please contact Thomas Weber, Department Leader, Nuclear Regulatory Affairs, at (623) 393-5764.I declare under penalty of perjury that the foregoing is true and correct.Executed on "7/3, 4/sl (Date)Sincerely, MLL/DCE/akf

Enclosure:

Description and Assessment of Proposed Amendment for Risk-Informed Completion Times cc: N. L. Dapas M. M. Watford C. A. Peabody A. V. Godwin T. Morales NRC Region IV Regional Administrator NRC NRR Project Manager NRC Senior Resident Inspector for PVNGS Arizona Radiation Regulatory Agency Arizona Radiation Regulatory Agency Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table of Contents

1.0 DESCRIPTION

2.0 ASSESSMENT

3.0 REGULATORY

SAFETY ANALYSIS 4.0 ENVIRONMENTAL CONSIDERATION ATTACHMENTS:

1. Proposed Technical Specification Changes 2. Revised Technical Specification Pages (Clean Copy)3. Technical Specification Bases Changes 4. List of Regulatory Commitments

5. List of Revised Required Actions to Corresponding Probabilistic Risk Assessment Functions 6. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 7. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 8. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models 9. Baseline Core Damage Frequency and Large Early Release Frequency 10. Justification of Application of At-Power PRA Models to Shutdown Modes 11. Probabilistic Risk Assessment Model Update Process 12. Attributes of the Configuration Risk Management Program Model 13. Key Assumptions and Sources of Uncertainty

14. Program Implementation

15. Monitoring Program 16. Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times

1.0 DESCRIPTION

In accordance with the provisions of Section 50.90 of Title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) is submitting a request for a license amendment to revise the Technical Specifications (TSs) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.The proposed amendment would modify TS requirements to permit the use of Risk-Informed Completion Times (RICTs) in accordance with Technical Specifications Task Force (TSTF)traveler TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times -RITSTF Initiative 4b. The availability of the NRC model safety evaluation for TSTF-505-A was announced in the Federal Register on March 15, 2012 (77 FR 15399).The proposed amendment involves TS Completion Times (CTs) for Required Actions (RAs) to provide the option to calculate a risk-informed CT (RICT). A new program, the Risk-Informed Completion Time Program, is added to TS Section 5, Administrative Controls.The methodology for using the RICT Program is described in Nuclear Energy Institute (NEI) 06-09, Revision 0 -A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical/Specifications (RMTS) Guidelines (NEI 06-09-A), which was found acceptable by the NRC on May 17, 2007, for use by licensees in license amendment proposals.

Adherence to NEI 06-09-A is required by the RICT Program and APS is not proposing any deviations from the NEI guidance.The proposed amendment is consistent with TSTF-505-A.

However, only those RAs described in Attachment 5 to this Enclosure are proposed to be changed. Attachment 5 does not include the modified RAs in TSTF-505-A that were not applicable to PVNGS. The proposed amendment also incorporates two additional limiting conditions of operations (LCOs) that were not included in TSTF-505-A.

These are discussed in Section 2.3 of this Enclosure.

This Enclosure provides a description and assessment of the proposed changes, the requested confirmation of applicability, and plant-specific verifications.

Attachment 1 to this Enclosure provides the existing TS pages marked up to show the proposed changes. Attachment 2 provides revised (clean) TS pages. Attachment 3 provides existing TS Bases pages marked up to show the proposed changes. Attachments 4 through 16 provide descriptions of new regulatory commitments, probabilistic risk assessment (PRA) information, and program information to support NRC review of this license amendment request (LAR). They are discussed further in the assessment below.2.0 ASSESSMENT

2.1 Applicability

of Published Safety Evaluation APS reviewed the NRC model safety evaluation in TSTF-505-A, as well as the information provided to support TSTF-505-A and the safety evaluation for NEI 06-09-A. APS has concluded that the technical basis presented in TSTF-505-A and the associated model safety evaluation prepared by the NRC staff are applicable to PVNGS Units 1, 2, and 3, and support incorporation of this amendment in the TS.1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 2.2 Verifications and Regulatory Commitments The following is provided in accordance with Section 4.0 Limitations and Conditions of the safety evaluation for NEI 06-09-A: Attachment 4 to this Enclosure lists the new APS regulatory commitments regarding plant-specific changes necessary to support implementation of TSTF-505-A.

Attachment 5 to this Enclosure identifies each of the TS RAs to which the RIOT Program will apply, with a comparison of the TS functions to the functions modeled in the PRA of the structures, systems and components (SS~s) subject to those actions.Attachment 6 to this Enclosure provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RIOT Program, as required by Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009, Section 4.2.Attachment 7 to this Enclosure is a placeholder to retain the TSTF-505-A format since each APS PRA model used for the RIOT Program is addressed using a standard endorsed by the NRC.Attachment 8 to this Enclosure provides appropriate justification for excluding sources of risk not addressed by the PRA models.Attachment 9 to this Enclosure provides the plant-specific baseline core damage frequency (ODE) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RIOT Program are acceptable.

Attachment 10 to this Enclosure is a placeholder to retain the TSTF-505-A format since each APS PRA model used for the RIOT Program is addressed using a standard endorsed by the NRC.Attachment 11 to this Enclosure provides a discussion of the programs and procedures that assure the PRA models that support the RIOT Program are maintained consistent with the as-built, as-operated plant.Attachment 12 to this Enclosure provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified for use in the Configuration Risk Management Program (CRMP) to assess real-time configuration risk, and describes the scope of and quality controls applied to the CRMP.Attachment 13 to this Enclosure provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified for this LAR, and how their impact on the RIOT Program was assessed and evaluated.

Attachment 14 to this Enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RIOT Program, including risk management action (RMA) implementation.

2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 to this Enclosure provides a description of the monitoring program as described in NEI 06-09-A, Section 2.3.2.Finally, Attachment 16 to this Enclosure provides a description of the process to identify RMAs and includes specific examples of RMAs.2.3 Editorial Changes and Variations APS is proposing certain editorial changes and variations from the TSs described in TSTF-505-A, Revision 1, and applicable parts of the NRC model safety evaluation dated March 15, 2012.Differences between the PVNGS proposed LAR and TSTF-505-A and related justifications are provided in Table 1, TSTF-505-A Reconciliation.

In some instances, the PVNGS TSs use different numbering (including RAs and programs) and titles than NUREG 1432, Standard Technical Specifications, Combustion Engineering Plants, on which TSTF-505-A was based.These differences are administrative and do not affect the applicability of TSTF-505-A to the PVNGS TS. Due to plant-specific design differences, the PVNGS TSs do not contain all of the LCOs and conditions that are contained in TSTF-505-A.

This LAR includes the LCOs from TSTF 505-A which are applicable to PVNGS.TSTF-505-A states: "It is necessary to adopt TSTF-439, Eliminate Second Completion Times Limiting Time From Discovery of Failure To Meet an LCO, in order to adopt TSTF 505 for those Required Actions that are affected by both Travelers." APS previously submitted letter number 102-07002, License Amendment Request (LAR) for Adoption of Technical Specifications Task Force (TSTF) Traveler TSTF-439-A, Revision 2, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO, dated February 27, 2015, to adopt TSTF-439-A, Revision 2 (Agencywide Document Access and Management System [ADAMS] Accession Number ML15065A031).

The LAR proposed removal of the second completion times from the following TS sections, as described in TSTF-439-A:

TS 1.3, Completion Times* TS 3.7.5, Auxiliary Feedwater (AFW) System* TS 3.8.1, AC Sources -Operating* TS 3.8.9, Distribution Systems -Operating APS anticipates NRC approval of the TSTF-439-A LAR before NRC completion of the review of this TSTF-505-A LAR. The expected TSTF-439-A changes have been clearly marked and annotated on the marked-up TS and TS Bases pages in Attachments 1 and 3 of this Enclosure.

The revised (clean) TS pages included in Attachment 2 of this Enclosure reflect the removal of the second completion times from the affected TSs.There are two plant-specific LCOs for which APS is proposing to apply the RICT Program that are not within the scope of TSTF 505-A. These LCOs are variations as identified in Table 1 with additional justification provided: 3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times*TS 3.4.12, Pressurizer Vents. There is no pressurizer vent TS in NUREG 1432 or in TSTF 505-A. The PVNGS TS address the pressurizer vent lines and valves that can be used to depressurize and degas the reactor coolant system. The pressurizer vent valves are remotely operated solenoid valves administratively controlled in the key-locked closed position to prevent inadvertent opening. There are two separate vent paths out of the pressurizer; one path has two solenoid isolation valves and the other has a single solenoid isolation valve and an orifice. Each of these two paths can be directed through an additional solenoid operated valve to either the reactor drain tank or to containment atmosphere directly, for a total of four vent paths. The pressurizer vent paths are modeled in the PRA and credited in the PVNGS safety analysis for the steam generator tube rupture event as described in Updated Final Safety Analysis Report (UFSAR)Section 15.6.3. The pressurizer vent TS at PVNGS has similarities to the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed by TSTF-505-A.

Although the PVNGS design does not include PORVs, APS proposes to apply the RIOT Program to PVNGS TS LCO 3.4.12 for the pressurizer vents using TSTF-505-A RA 3.4.11 .B.3 as a guide.*TS 3.7.3, Main Feedwater Isolation Valves (MFIVs). The MFIV TS was not included in TSTF-505-A because the TS LCO conditions do not include restoration actions for an inoperable MFIV. APS proposes adding restoration actions to RA 3.7.3.A.1 (one or more MFlIVs inoperable) and RA 3.7.3.B.1 (two valves in the same flow path inoperable) and including both in the RIOT Program. A description of the MFlIVs is included in UFSAR 10.4.7. The MFlIVs are modeled in the PRA and credited in the safety analysis to close during a steam line break and a feedwater line break.4 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation iTEM #* TSTF LCO PVNGS LCO DESCRIPTION 11.3 1.3 The changes described in the TSTF are incorporated.

Completion Com pletion Times Times 2 3.3.4 3.3.4 The changes described in the TSTF are incorporated.

Reactor Reactor Protective Protective System (RPS) System (RPS)Logic and Trip Logic and Trip Initiation (Digital)

Initiation 33.3.6 3.3.6 The changes described in the TSTF are incorporated with the following differences:

Engineered Engineered

° EDITORIAL:

TSTF 3.3.6.E states 'Two Actuation Logic channels inoperable." The PVNGS Safety Features Safety Features Condition statement states "One or more functions with two Actuation Logic channels inoperable." Actuation Actuation This is consistent with the NRC-approved PVNGS wording in Conditions A, B, and C.System System

EDITORIAL:

APS proposes to revise Required Action (RA) E.1 to read "Restore channel(s) to (ESFAS) Logic (ESFAS) Logic OPERABLE status" to clarify that at least one Actuation Logic channel must be restored to and Manual Trip and Manual Trip OPERABLE status.(Digital)43.4.9 3.4.9 The changes described in the TSTF are incorporated with the following difference:

Pressurizer Pressurizer

° EDITORIAL:

TSTF RA C.1 states "Restore [required group] of pressurizer heaters to OPERABLE status." PVNGS RA C.1 states "Restore at least one required group of pressurizer heaters to OPERABLE status." PVNGS added the phrase "at least one" to be precise in the action necessary to exit the Condition.

53.4.10 3.4.10 The changes described in the TSTF are incorporated.

Pressurizer Pressurizer Safety Valves Safety Valves -Modes 1, 2, and 3 5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 6 Not in TSTF 3.4.12 VARIATION:

PVNGS has pressurizer vent valves to depressurize the reactor coolant system or Pressurizer remove accumulated gases in the pressurizer.

The pressurizer vent TS at PVNGS has similarities to Vents the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed by TSTF-505-A.

Although the PVNGS design does not include PORVs, APS proposes to apply the RICT Program to PVNGS TS LCO 3.4.12 for the pressurizer vents using TSTF-505-A RA 3.4.11 .B.3 as a guide. APS proposes to apply the RICT Program to PVNGS restoration items RA 3.4.12.A.1 and 3.4.12.B.1 for the pressurizer vents. The vent paths are modeled in the site-specific PRA and credited in the PVNGS safety analysis.

APS also proposes to include a NOTE that states the Risk Informed Completion Time is not_____________applicable when the last vent path is intentionally made inoperable.

3.5.1 3.5.1 The changes described in the TSTF are incorporated with the following differences:

Safety Injection Safety Injection Tank (SIs) Tnks SI~s -* EDITORIAL:

TSTF 3.5.1 .C.1 states "Restore SITs to OPERABLE status." PVNGS 3.5.1 .0.1 states TanspSIe)ratnks (S~)"Restore all but one SIT to OPERABLE status." PVNGS added the phrase to be precise in the Opertingaction necessary to exit the Condition.

EDITORIAL:

TSTF 3.5.1.0 states "Required Action and associated completion time [of Condition A or B] not met." PVNGS 3.5.1 .0 states "Required Action and associated completion time of Condition A, B, or C not met." The TSTF added Condition C so PVNGS TS Condition D is worded such that Conditions A, B, and C are addressed in the restoration condition.

EDITORIAL:

The TSTF Bases state that Condition E regarding entry into LCO 3.0.3 is only applicable to plants that have not adopted a RICT Program. Therefore, APS proposes to delete the existing corresponding PVNGS Condition D.*EDITORIAL:

The logical connector "OR" in PVNGS TS Condition A was adjusted to be properly_____________aligned.

83.5.2 3.5.3 The changes described in the TSTF are incorporated with the following difference:

OeCCtin EOpeatn

VARIATION:

PVNGS proposes to delete the following words from TS Condition B "AND At least OpertingOperting100%

of the ECCS flow equivalent to a single OPERABLE ECCS train available." The deletion of these words from Condition B is being done in order to adopt both the TSTF 505 text and to be consistent with NUREG 1432. TSTF 505 Condition 3.5.2.C and proposed PVNGS Condition 3.5.3.C will address the condition for "less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train" so it is not required to have the wording in PVNGS TS Condition

3.5.3 Condition

B to require at least 100% of the flow equivalent to a single OPERABLE ECCS train.6 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 9 3.5.4 3.5.5 The changes described in the TSTF are incorporated.

Refueling Water Refueling Water Tank (RWT) Tank (RWT)10 3.6.2 3.6.2 The changes described in the TSTF are incorporated.

Containment Air Containment Air Locks Locks (Atmospheric and Dual)____________________________________________

11 3.6.3 3.6.3 The changes described in the TSTF are incorporated.

Containment Containment Isolation Valves Isolation Valves (Atmospheric and Dual)______________________________________________

12 3.6.6A 3.6.6 The changes described in the TSTF are incorporated with the following differences:

Containment Containment

EDITORIAL:

PVNGS TS do not have TSTF Conditions C, D, or E because there is no containment Spray and Spray System cooling system that operates in conjunction with the containment spray system at PVNGS. PVNGS Cooling proposes adopting TSTF Condition F as PVNGS Condition C modified to properly reflect the Systems PVNGS design.(Atmospheric

EDITORIAL:

PVNGS proposes deleting existing TS Condition C regarding entry into LCO 3.0.3 and and Dual) adopting TSTF/NUREG-1432 Condition G as new PVNGS Condition D.*EDITORIAL:

TSTF RA F.1 states containment spray trains are to be restored to OPERABLE status. PVNGS RA C.1 is revised to read "Restore at least one containment spray train to OPERABLE status." APS used the phrase "at least one" to be precise in the action necessary to exit the Condition.

13 3.7.2 3.7.2 The changes described in the TSTF are incorporated with the following differences, primarily in Main Steam Main Steam numbering sequence resulting from changes approved in TS Amendment 163: Isolation Valves Isolation Valves

EDITORIAL:

PVNGS proposes adopting TSTF Condition A as PVNGS Condition F.(MSIVs) (MSIVs)

EDITORIAL:

PVNGS proposes adopting TSTF Condition C as new PVNGS Condition G.* EDITORIAL:

TSTF RA C.1 states "Restore MSIVs to OPERABLE status." PVNGS TS 3.7.2 RA G.1 is revised to read "Restore all but one MSIV to OPERABLE status." APS used the phrase "all but one" to be precise in the action necessary to exit the condition.

7 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 14 Not in TSTF 3.7.3 VARIATION:

TSTF 505 has a comment stating that Conditions A and B do not specify a restoration Main Feedwater action and Condition C is a default Condition, thus the LCO conditions were excluded.

APS proposes Isolation Valves to add restoration actions to plant-specific PVNGS TS 3.7.3 RA A.1 for one or more MFIVs inoperable (MFIVs) and RA B.1 for two valves in the same flow path inoperable, with a RICT applied to each. Each RA will have an alternative (using the logical connector OR) action of isolating AND verifying the MFIV(s)closed or isolated.

APS believes this is acceptable because the TSTF states that there may also be plant-specific TS to which changes of the type presented in the TSTF may be applied.15 3.7.4 3.7.4 The changes described in the TSTF are incorporated with the following difference:

Atmospheric Atmospheric

= VARIATION:

PVNGS proposes adding a NOTE in Condition B that states "Risk-Informed Dump Valves Dump Valves Completion Time not applicable when all ADVs intentionally made inoperable." This reflects the (ADVs) (ADVs) intent of the TSTF to ensure the RICT is not used for situations that represent a loss of safety function due to planned maintenance and reflects the existing NOTE in PVNGS TS Bases 3.7.4.B.1.

The PVNGS design retains the ADV safety function with one ADV OPERABLE.16 3.7.5 3.7.5 The changes described in the TSTF are incorporated with the following difference:

Auxiliary Auxiliary

EDITORIAL:

PVNGS proposes to delete the second part of revised PVNGS TS Condition D Feedwater Feedwater (existing PVNGS TS Condition C) after the OR clause that reads "Two AFW trains inoperable in (AFW) System (AFW) System MODES 1, 2, or 3." TSTF 505 adds the same condition as new PVNGS TS Condition C. This change makes the PVNGS TS consistent with NUREG 1432 and facilitates the incorporation of TSTF 505.17 3.7.6 3.7.6 The changes described in the TSTF are incorporated with the following differences:

Condensate Condensate

VARIATION:

PVNGS proposes to change the PVNGS LCO from "The CST level shall be > 29.5 ft" Storage Tank Storage Tank to read "The CST shall be OPERABLE." This change is consistent with TSTF-505 and NUREG (CST) (CST) 1432. The change revises the LCO wording to directly address the requirement for the CST to be OPERABLE rather than a limited requirement for CST level. CST level is governed by the same limit described in TS surveillance requirement 3.7.6.1 which states "Verify CST level is > 29.5 ft."* VARIATION:

PVNGS proposes to change Condition A from "CST level not within limit" to read"CST inoperable." This change is needed so that the condition matches the LCO requirement.

VARIATION:

PVNGS proposes to change RA A.2 from "Restore CST levelto within limit" to read"Restore CST to OPERABLE status." This change is needed for the RA to match the condition.

8 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 18 3.7.7 3.7.7 The changes described in the TSTF are incorporated with the following differences:

Component Essential

EDITORIAL:

For this TS, PVNGS uses the terminology "EW" rather than "CCW" as in the TSTF.Coolng Wter oolig Waer

VARIATION:

PVNGS proposes adding a NOTE to TSTF Condition B that reads "Not applicable (CCW) System (EW) System when second EW train intentionally made inoperable." This reflects the intent of the TSTF to ensure the RiCT is not used for situations that represent a loss of safety function due to planned maintenance.

19 Water8Esentia Spa DT ORIcaL:e Fosribdi this TSTPVN reusesrthe aterm winoog the" ratherothng diWff asinehcSTF ervceWter E3.7.ia They chIORAnge desribdi thes TSTFPNG ares incoportedrwithog the" followin difernce:"sinteSF Sytm(SWS)

Pond System (ES PS)20 3.7.9 3.7.9 The changes described in the TSTF are incorporated with the following difference:

Ultimate Heat Ultimate Heat

VARIATION:

The design for PVNGS uses spray ponds as the UHS with spray nozzles for the Sink (UHS) Sink (UHS) method to dissipate heat as opposed to natural bodies of water with cooling towers or other designs. PVNGS existing TS 3.7.9 has only one condition (UHS inoperable) for which the RA is to shut down without a required action to restore the UHS. APS proposes adding a Condition requiring restoration of the UHS to an OPERABLE status within one hour or in accordance with the RICT Program in order to be consistent with TSTF 505-A. The wording of the TSTF Condition C was revised to delete "for reasons other than Conditions A or B" since TSTF Condition A and B are not applicable to PVNGS. The revised PVNGS Condition A reads "UHS INOPERABLE." The NOTE above Condition A reads "Risk informed Completion Time not applicable when UHS intentionally made inoperable." The RA and Completion time for Condition A are consistent with TSTF 505-A.21 3.7.10 3.7.10 The changes described in the TSTF are incorporated with the following difference:

Essential Chilled Essential Chilled

EDITORIAL:

For this TS, PVNGS uses the terminology "EC" rather than "ECW" as in the TSTF.Water (ECW) Water (EC)System 22 3.7.12 3.7.12 The changes described in the TSTF are incorporated with the following difference:

Control Room Control Room

EDITORIAL:

The TSTF Bases state that TSTF Condition F regarding entry into LCO 3.0.3 is only Emergency Air Emergency Air applicable to plants that have not adopted a RICT Program. Therefore, APS proposes to delete Temperature Temperature existing PVNGS Condition F, which is the same as TSTF Condition F, and add the condition for two Control System Control System CREATCS trains inoperable into PVNGS TS as Condition B.(CREATCS) (CREATCS)9 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 23 3.8.1 3.8.1 The changes described in the TSTF are incorporated with the following differences:

AC Sources -AC Sources -.EDITORIAL:

APS proposes to revise RA G.1 to read "Restore required AC source(s) to Operating Operating OPERABLE status" to clarify that at least one required AC source must be restored to OPERABLE status.*EDITORIAL:

The TSTF Bases state that Condition I regarding entry into LCO 3.0.3 is only applicable to plants that have not adopted a RICT Program. Therefore, APS proposes to delete existing PVNGS Condition I, which is the same as TSTF Condition I, and add the condition for three or more required AC sources inoperable into PVNGS TS as Condition G.24 3.8.4 3.8.4 The changes described in the TSTF are incorporated with the following difference:

DC Sources -DC Sources -* EDITORIAL:

PVNGS TS do not include TSTF Condition B, as approved in PVNGS License Operating Operating Amendment number 193 that adopted TSTF-500.25 3.8.7 3.8.7 The changes described in the TSTF are incorporated with the following differences:

Inverters

-Inverters

-* VARIATION:

TSTF Condition B includes a NOTE that states "Not applicable when two or more Operating Operating

[required]

inverters intentionally made inoperable." PVNGS proposes rewording the NOTE to read"Not applicable when two or more required inverters intentionally made inoperable resulting in loss of safety function." This reflects the PVNGS design which differs from the TSTF. PVNGS has two inverters per train, thus two inverters inoperable in the same train do not represent a loss of safety function because the other train remains operable.* EDITORIAL:

TSTF RA B.1 states "Restore inverters to OPERABLE status." PVNGS RA B.1 is proposed to state "Restore all but one inverter to OPERABLE status." PVNGS added the phrase"all but one" to be precise in the action necessary to exit the Condition.

10 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 -TSTF-505-A Reconciliation ITEM # TSTF LCO PVNGS LCO DESCRIPTION 26 3.8.9 3.8.9 The changes described in the TSTF are incorporated with the following differences:

Distribution Distribution

VARIATION:

The TSTF Conditions A, B and C state "one or more" while the PVNGS Conditions Systems -Systems -state only "one" with respect to the number of electrical power distribution system being inoperable Operating Operating for the respective conditions.

These differences are reflected in the RAs as well. This is acceptable due to the PVNGS specific licensing bases that approved this wording in TS Amendment number 117.* VARIATION:

APS proposes to not adopt the clause in new TSTF Condition D ". ..that results in a loss of safety function" because the new action applies when more than one electrical power distribution subsystem is inoperable without linking the condition to the loss of safety function.

This is consistent with the wording of Conditions A, B and C.* EDITORIAL:

APS proposes to revise RA D.1 to read "Restore electrical power distribution subsystem(s) to OPERABLE status" to clarify that at least one electrical power distribution subsystem must be restored to OPERABLE status.* EDITORIAL:

The TSTF Bases state that Condition F regarding entry into LCO 3.0.3 is only applicable to plants that have not adopted a RICT Program. Therefore, APS proposes to delete existing PVNGS Condition E, which is the same as TSTF Condition F and add the condition for two or more electrical power distribution subsystems inoperable into PVNGS TS as Condition D.* EDITORIAL:

The NOTE for PVNGS new Condition D adds the phrase "resulting in loss of safety function." This is needed since PVNGS Conditions A, B and C are only applicable to one electrical power distribution subsystem, respectively.

There could be instances where two electrical power distribution subsystems are made inoperable without having a loss of safety function.27 5.5.18 5.5.20 The changes described in the TSTF are incorporated with the following difference:

Risk-Informed Risk-Informed

EDITORIAL:

NEI 06-09 (Revision 0)-A is applicable rather than NEI 06-09, Revision 0.Comnpletion Comnpletion Time Program Time Program 11 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 3.0 REGULATORY SAFETY ANALYSIS Arizona Public Service Company (APS) has evaluated the proposed change to the Technical Specifications (TSs) using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.

APS requests adoption of an NRC accepted change to the Standard TSs and plant specific TS, to modify the TS requirements related to Completion Times (CTs) for Required Actions (RAs) to provide the option to calculate risk-informed CTs based on risk levels associated with equipment determined to be inoperable that are within the scope of the Risk-Informed Completion Time (RICT) Program. The allowance is described in a new program in Chapter 5, Administrative Controls, entitled the Risk-Informed Completion Time Program. The proposed RICT program conforms to the NRC model safety evaluation, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071 200238), dated May 17, 2007.The proposed license amendment includes regulatory commitments to achieve the baseline PRA risk metrics specified in the NRC model evaluation by design changes or compensatory measures.

The design changes proposed by regulatory commitments will be implemented under the requirements of 10 CFR 50.59 and will not require prior NRC approval.As required by 10 CFR 50.91 (a), Notice for Public Comment, an analysis of the issue of no significant hazards consideration is presented below: 1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response:

No.The proposed change permits the use of RICTs provided the associated risk is assessed and managed in accordance with the NRC-accepted RICT Program. The proposed use of RICTs does not involve a significant increase in the probability of an accident previously evaluated because the change only affects TS Conditions, Required Actions and CTs associated with risk informed technical specifications and does not involve changes to the plant, its modes of operation, or TS mode applicability.

The proposed license amendment references regulatory commitments to achieve the baseline PRA risk metrics specified in the NRC model evaluation.

The changes proposed by regulatory commitments will be implemented under the requirements of 10 CFR 50.59 without the need for prior NRC approval.

The proposed change does not increase the consequences of an accident because the accident mitigation functions of the affected systems, structures, or components (SSCs) are not changed.Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility or different kind of accident from any accident previously evaluated?

12 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Response:

No.The proposed change permits the use of RICTs provided the associated risk is assessed and managed in accordance with the NRC-accepted RIOT Program. The proposed use of RIOTs does not create the possibility of a new or different kind of accident from any accident previously evaluated because the change only affects TS Conditions, Required Actions and OTs associated with risk informed technical specifications.

The proposed change does not involve a physical alteration of the plant and does not involve installation of new or different kind of equipment.

The proposed license amendment references regulatory commitments to achieve the baseline PRA risk metrics specified in the NRC model evaluation.

The changes proposed by regulatory commitments will be implemented under the requirements of 10 CER 50.59 without the need for prior NRC approval.

The proposed change does not alter the accident mitigation functions of the affected SSCs and does not introduce new or different SSC failure modes than already evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?Response:

No.The proposed change permits the use of RIOTs provided the risk levels associated with inoperable equipment within the scope of the RIOT program are assessed and managed in accordance with the NRC approved RIOT Program. The proposed change implements a risk-informed Configuration Risk Management Program (CRMP) to assure that adequate margins of safety are maintained.

Application of these new specifications and the CRMP considers cumulative effects of multiple systems or components being out of service and does so more effectively than the current TS. In this regard, the implementation of the CRMP is considered an improvement in safety.Therefore, the proposed change does not involve a significant reduction in a margin of safety.Based on the above, APS concludes that the proposed change presents no significant hazards considerations under the standards set forth in 10 CER 50.92(c), Issuance of amendment, and, accordingly, a finding of "no significant hazards consideration" is justified.

4.0 ENVIRONMENTAL

CONSIDERATION APS has reviewed the environmental evaluation included in the model safety evaluation published on March 15, 2012, as part of the Notice of Availability (77 FR 15399). APS has concluded that the NRC staff findings presented in that evaluation are applicable to PVNGS Units 1, 2, and 3.The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CER 20, Standards for Protection 13 Enclosure Description and Assessment of Proposed Amendment for Risk-informed Completion Times Against Radiation, or would change an inspection or surveillance requirement.

However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review. Therefore, pursuant to 10 CFR 51.22, no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.14 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHM ENT 1 Proposed Technical Specification Changes TS Mark-up Pages 1.3-13 3.3.4-1 3.3.6-1 3.3.6-2 3.3.6-3 3.4.9-1 3.4.9-2 3.4.10-1 3.4.12-1 3.5.1-1 3.5.3-1 3.5.5-1 3.6.2-3 3.6.3-1 3.6.3-2 3.6.3-3 3.6.3-4 3.6.6-1 3.7.2-2 3.7.3-1 3.7.4-1 3.7.5-1 3.7.5-2 3.7.6-1 3.7.7-1 3.7.8-1 3.7.9-1 3.7.10-1 3.7.12-1 3.7.12-2 3.8.1-2 3.8.1-3 3.8.1-4 3.8.1-5 3.8.4-1 3.8.7-1 3.8.7-2 3.8.9-1 3.8.9-2 5.5-19 Compl eti on Times 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (continued)

The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not Insert red.IMMEDIATE COMPLETION TIME When "Immediately" is used as a Completion Time, the Required Action should be pursued without delay and in a control led manner.PALO VERDE UNITS 1,2,3 131 MNMN O 4 1.3-13 AMENDMENT NO.

INSERT for page 1.3-13 EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem A.1 Restore subsystem 7 days inoperable, to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. ---- NOTE ...B.1 Restore subsystems 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable to OPERABLE when second status. OR subsystem intentionally made In accordance with the inoperable.

Risk Informed Completion Time Program Two subsystems inoperable.

C. Required Action C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time AND not met._____________C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the Page 1 of 2 Insert for page 1.3-13 (continued) subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.If a second subsystem is declared inoperable, Condition B may also be entered.The Condition is modified by a Note stating it is not applicable if the second subsystem is intentionally made inoperable.

The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service.The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply a RICT to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and Condition B is not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there is no applicable Condition.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions.

For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock of Condition B have expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.

Page 2 of 2 RPS Logic and Trip Ini ti ati on 3.3.4 3.3 INSTRUMENTATION

3.3.4 Reactor

Protective System (RPS) Logic and Trip Initiation LCO 3.3.4 Six channels of RPS Matrix Logic, four channels of RPS Initiation Logic, four channels of reactor trip circuit breakers (RTCBs), and four channels of Manual Trip shall be OPERABLE.APPLICABILITY:

MODES 1 and 2, MODES 3, 4, and 5, with any RTCBs closed element assemblies capable of being and any control withdrawn.

ACTIONS CONDITION

] REQUIRED ACTION] COMPLETION TIME A. One Matrix Logic channel inoperable.

OR Three Matrix Logic channel s i noperabl e due to a common power source failure de-energi zi ng three matrix power suppl ies.A.1 Restore channel to OPERABLE status.48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months s< RICT Insert (conti nued)Reviewers Note: The "RIOT Insert" is used repeatedly throughout this package. The insert will not be provided as a separate page every time it is used. This will be the only time the insert page will follow the marked-up TS page.PALO VERDE UNITS 1,2,3334-AMNETNO

-7 3.3.4-1 AMENDMENT NO.

RICT Insert O__R In accordance with the Risk Informed Completion Time Program

[SFAS Logic and Manual Trip 3.3.6 3.3 INSTRUMENTATION

3.3.6 Engineered

Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 APPLICABILITY:

Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1.According to Table 3.3.6-1.ACTIONS----------------

~~NOTE-------------

Separate Condition entry is allowed for each Function.CONDITION JREQUIRED ACTION COMPLETION TIME A. One or more Functions with one Matrix Logic channel inoperable.

OR Three Matrix Logic channels are inoperable due to a common power source failure de-energizing three matrix power supplies.A.1 Restore channel to OPERABLE status.48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months B. One or more Functions B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Manual Trip OPERABLE status.or Ini ti ati on Logi c -RC net channel inoperable.(continued)

PALO VERDE UNITS 1,2,3 3361AEDETN.4.

3.3.6-1 AMENDMENT NO.

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions C.1 Open at least one Immediately with two Initiation contact in the Logic channels or affected trip leg of Manual Trip channels both ESFAS Actuation affecting the same Logics.trip leg inoperable.

AND C.2 Restore channels to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status. <- RC net D. One or more Functions D.1------NOTE----

with one Actuation One channel of Logic channel Actuation Logic may inoperable, be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Survei 11 Iances, provided the other channel is OPERABLE.Restore ino~perab.e 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Insertchannel to OPERABLE j~ nsr I[ status. <- RIOT InsertI Requi red Action and associ ated Compl eti on Time of Conditions for Containment Spray Actuation Signal, Main Steam Isol ati on Signal or Auxi li ary Feedwater Actuation Signal not met.4.1 AND Be in MODE 3.Be in MODE 4.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours (conti nued)PALO VERDE UNITS 1,2,33..-

MNMN O 4 3.3.6-2 AMENDMENT NO.

Insert for page 3.3.6-2 E.-----NOTE-

--Not applicable when second Actuation Logic channel intentionally made inoperable.

E.1 Restore channel(s) to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months O._R In accordance with the Risk Informed Completion Time Program One or more functions with two Actuation Logic channels inoperable.

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

CONDITION

_ZREQUIRED ACTION] COMPLETION TIME.Required Action and Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months f associ ated Compl eti on AND Time of Conditions for Safety Injection Actuation Signal, .2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Containment Isol ati on Actuation Signal, or0 Reci rcul ati on Actuation Signal not met.SURVEILLANCE REQUIREMENTS SURVE ILLANCE FREQUENCY SR 3.3.6.1----------NOTE--

Testing of Actuation Logic shallI include the verification of the proper operation of each i ni tiati on relay.Perform a CHANNEL FUNCTIONAL TEST on each In accordance ESFAS logic channel and Manual Trip with the channel. Surveill ance Frequency Control Program SR 3.3.6.2----------NOTE--

Relays exempt from testing during operation shall be tested in accordance with the SurveilIlance Frequency Control Program.Perform a subgroup relay test of each In accordance Actuation Logic channel, which includes the with the de-energization of each subgroup relay and Surveillance verification of the OPERABILITY of each Frequency subgroup relay. Control Program PALO VERDE UNITS 1,2,3 3.3.6-3 PALO ERDEUNIT 1,23 3..6-3AMENDMENT NO. 94 Pressurizer 3.4.9 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.9 Pressurizer LCO 3.4.9 The pressurizer shall be OPERABLE with: a. Pressurizer water level 27% and 56%; and b. Two groups of pressurizer heaters OPERABLE with the capacity of each group 125 kW.APPLICABILITY:

MODES 1, 2, and 3.-~~~~~NOTE----------

The pressurizer water level limit does not apply during: a°b.THERMAL POWER ramp > 5% RTP per minute; or THERMAL POWER step > 10% RTP.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Pressurizer water A.1 Be in MODE 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months level not within with reactor limit. trip breakers open.AND A.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months B. One required group of pressurizer heaters inoperable.

B.1 Restore required group of pressurizer heaters to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (conti nued)Insert PALO VERDE UNITS 1,2,3 3491AEDETN.4.-6 3.4.9-1 AMENDMENT NO. !17, !6<

Insert for page 3.4.9-1 C.----NOTE-

--Not applicable when second group of required pressurizer heaters intentionally made inoperable.

Two required groups of pressurizer heaters inoperable.

0. 1 Restore at least one required group of pressurizer heaters to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Pressurizer

3.4.9 ACTIONS

(continued)

CONDITION REQUIRED ACTION COMPLETION TIME Rquired Action and .1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time of Condition B A not met. ;.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months oD SURVEILLANCEREQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.4.9.1 Verify pressurizer water level is 27% and In accordance

<56% with the Surveillance Frequency Control Program SR 3.4.9.2 Verify capacity of each required group of In accordance pressurizer heaters 125 kW. with the Surveil11ance Frequency Control Program PALO VERDE UNITS 1,2,33492AMNETNO

--4g 3.4.9-2 AMENDMENT NO. !!7, 188 Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.10 Pressurizer Safety Valves -Modes 1, 2 and 3 LCO 3.4.10 APPLICABILITY:

Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.MODES 1, 2, and 3,~~~~~~~-NOTE------------

The lift settings are not required to be within LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions.

This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.ACTIONS CONDITION JREQUIRED ACTION COMPLETION TIME A. One pressurizer safety valve inoperable.

A. 1 Restore valve to OPERABLE status.15 minutes B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND OR B.2 Be in MODE 4 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Two or more pressurizer safety valves inoperable.

PALO VERDE UNITS 1,2,3 3..1- MNMN O 4 3.4.10-1 AMENDMENT NO.

Pressurizer Vents 3.4.12 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.12 Pressurizer Vents LCO 3.4.12 APPLICABILITY:

Four pressurizer vent paths shall be OPERABLE.MODES 1, 2, and 3.MODE 4 with RCS pressure 385 psia.ACTIONS CONDITION

[REQUIRED ACTION! COMPLETION TIME A. Two or three required pressurizer vent paths inoperable.

A.1 Restore required pressurizer vent paths to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months B. Al pres izer vent B.1 Restore one6hor paths io rable. pressurizer vent path to OPERABLE status.<C. Required and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Comp etion AN Time of A, AN or B not met. \ C.2 Be in MODE 4 with RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months pressure < 385 psia.\-..NOTE-----.

Risk Informed Completion Time not applicable when last vent path intentionally made inoperable.

PALO VERDE UNITS 1,2,334.21AEDNT O. ----8 3.4.12-1 AMENDMENT NO. 117, 189 SITs -Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.1 Safety Injection Tanks (SITs) -Operating LCO 3.5.1 Four SITs shall be OPERABLE.APPLICABILITY:

MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1831 psia.ACTIONS CONDITION

] REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due to boron concentration not within limits.m- O One SIT inoperable due to inability to verify level or pressure.A.1 Restore SIT to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months SRICT Insert B. One SIT inoperable for B.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status.ConditionA D Required Action and associ ated Compileti on Time of Condition A 0Fgnot met.g. i AND2 Be in MODE 3.Reduce pressurizer pressure to<1837 psia.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours I, B, or Q. T,,o or marc STTz -4 EncTC ...

PALO VERDE UNITS 1,2,33511AMNETNO 3.5.1-1 AMENDMENT NO. 117, 118 Insert for page 3.5.1-1 C. -- --NOTE---..

Not applicable when two or more SITs intentionally made inoperable.

Two or more SITs inoperable.

0.1 Restore

all but one SIT to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months O._R In accordance with the Risk Informed Completion Time Program EGGS -Operating 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.3 ECCS -Operating LCO 3.5.3 APPLICABILITY:

Two ECCS trains shall be OPERABLE.MODES 1 and 2, MODE 3 with pressurizer pressure 1831 psia or with RCS Tc > 485°F.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem inoperable.

A.1 Restore subsystem to OPERABLE status.7 days B. One or more trains inoperable for reasons other than Condition A.AND-At lcast 100% of thc B.1 Restore train(s) to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to a zing OPEPRBLE J~t C. red Act N ion and associ ated Compl eti on Time not met.N1 AND AND3 Be in MODE 3.Reduce pressurizer pressure to< 1837 psia.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Reduce RCS<485° F.Tc to PALO VERDE UNITS 1,2,3 3.5.3-1 PAL VRDEUNTS ,23 35.-1AMENDMENT NO. 117,--!24 Insert for page 3.5.3-1 Not applicable when second ECCS train intentionally made inoperable.

Less than 100% of the ECCS flow equivalent to a single OPERABLE train available.

C.1 Restore ECCS flow equivalent to 100% of a single OPERABLE train.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program RWT 3.5.5 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.5 Refueling Water Tank (RWT)LCO 3.5.5 APPLICABILITY:

The RWT shall be OPERABLE.MODES 1, 2, 3, and 4.ACTI ONS CONDITION REQUIRED ACTION JCOMPLETION TIME A. RWT boron concentrati on not within limits.OR A.1 Restore RWT to OPERABLE status.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months RICT InsertI RWFT borated temperature limits.water not within B. RWT inoperable for B.1 Restore RWT to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months reasons other than OPERABLE status.Condition A.C. Required Action and C.I Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AN Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3355-AMNETNO41 3.5.5-1 AMENDMENT NO.

Containment Air Locks 3.6.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.1 Verify an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.AND B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.AND B.3------NOTE----

Air lock doors in high radiation areas may be verified locked closed by administrative means.Verify an OPERABLE Once per 31 days door is locked closed in the affected air lock.C. One or more containment air locks inoperable for reasons other than Condition A or B.C.1 AND C.2 Initiate action to evaluate overall containment leakage rate per LCO 3.6.1.Verify a door is closed in the affected air lock.Restore air lock to OPERABLE status.Immedi ately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (conti nued)PALO VERDE UNITS 1,2,3 3623AEDETN.h-3.6.2-3 AMENDMENT NO.

Containment Isol ati on Valves 3.6.3 3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Valves LCO 3.6.3 APPLICABILITY:

Each required containment isolation valve shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS----------------

~~-NOTES--------------

1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.2. Separate Condition entry is allowed for each penetration flow path.3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves.4. Enter applicable Conditions and Required Actions of LCO 3.6.1,"Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in accordance with SR 3.6.1.1.CONDITION REQUIRED ACTION ] COMPLETION TIME A.------NOTE-

--Only appl icable to penetration flow paths with two required contai nment i sol ati on valves.One or more penetration flow paths with one requi red containment i sol ati on valve i noperabl e except for purge valve leakage not within limit.A.1 Isolate the affected penetration flow path by use of at least one closed and de- acti vated automatic val ve, closed manual valve, bl ind flange, or check valve with flow through the valve secured.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (conti nued)AND PALO VERDE UNITS 1,2,3 3631AEDETN.4.-6 3.6.3-1 AMENDMENT NO.

Containment Isol ati on Valves 3.6.3 ACTIONS CONDITION

[REQUIRED ACTION ]COMPLETION TIME A. (continued)

A.2-NOTE----Isolation devices in high radiation areas may be verified by use of administrative means.Verify the affected.penetration flow path is isolated.Ifollowing isolation Once per 31 for i sol ati on devices outside contai nment AND Pri or to entering MODE 4 from MODE 5 if not performed wi thin the previous 92 days for i sol ati on devices i nsi de contai nment B.------NOTE-----

Only applicable to penetration flow paths with two requi red contai nment i sol ati on val ves.One or more penetration flow paths with two required contai nment i sol ati on valves i noperabl e except for purge valve leakage not within limit.B.1 Isolate the affected penetration flow path by use of at least one closed and de- acti vated automatic valve, closed manual valve, or blind flange.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (continued)

PALO VERDE UNITS 1,2,3363-AMNETNO 1-46 3.6.3-2 AMENDMENT NO. 117, Containment Isolation Valves 3.6.3 ACTIONS (continued)

CONDITION

] REQUIRED ACTION JCOMPLETION TIME C. ---NOTE----Only applicable to penetration flow paths with only one required containment isolation valve and a closed system.One or more penetration flow paths with one requi red containment i sol ati on valve inoperable.

C.1 AND C.2 Isolate the affected penetration flow path by use of at least one closed and de- acti vated automatic valve, closed manual valve, or blind flange.-NOTE- --Isolation devices in hi gh radi ati on areas may be verified by use of admi ni strati ve means.Verify the affected penetration flow path is isolated.4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months s0.00667 hours 3.968254e-5 weeks 9.132e-6 months (conti nued)D. One or more penetration flow paths with one or more requi red containment purge valves not wi thin purge valve leakage limits.D.1 Isolate the affected penetration flow path by use of at least one closed and de- acti vated automatic valve with resilient seals, or blind flange.AND PALO VERDE UNITS 1,2,3 3633AEDETN.4---6 3.6.3-3 AMENDMENT NO. 117, 155 Contai nment Isol ati on Val yes 3.6.3 ACTIONS CONDITION jREQUIRED ACTION ]COMPLETION TIME D. (continued)

D.2------------

NOTE- --Isolation devices in high radiation areas may be verified by use of administrative means.Verify the affected penetration flow path is isolated.Once per 31 days l for isolation devices outside contai nment AND following isolation Prior to/entering MODE 4 from MODE 5 if not performed within the previous 92 days for isolation devices inside contai nment , Once per 92 AND D.3 Perform SR 3.6.3.6 for the resilient seal purge valves closed to comply with Required Action D.I.E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3634AEDETN...

3.6.3-4 AMENDMENT NO.

Containment Spray System 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.APPLICABILITY:

MODES 1, 2, and 3.MODE 4 when RCS pr"essure is 385 psia ACTIONS CONDITION REQUIRED ACTION jCOMPLETION TIME A.1 A. One containment spray train inoperable.

Restore containment spray train to OPERABLE status.72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s< -RICT Insert B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compi eti on Time of Condi ti on A AND not met.B.2 Be in MODE 4 with RCS 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months Inetpressure

< 385 psi a.PALO VERDE UNITS 1,2,33661AMNETNO 4 3.6.6-1 AMENDMENT NO.

Insert for page 3.6.6-1 C. -...NOTE-...Not applicable when second containment spray train intentionally made inoperable.

Two containment spray trains inoperable.

C.1 Restore at least one containment spray train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OuR In accordance with the Risk Informed Completion Time Program D. Required Action D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time of AND Condition C not met. D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV E.1 Declare each affected Immediately actuator trains MSIV inoperable.

inoperable.

OR Requi red Action and associ ated Compl eti on Time of Condition A,/F. One MSI i~noperable in F.1 Restore MSIV to 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months s~OPERABLE status. _ IRC lne 2Ii Requi red Action andlAssociated Compl eti n Time of Condition FN not met.ki 1 Be in MODE 2.6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months s--- -NOTE- --Sepa rate Condi tion entry is allowed for each MSIV.One or more MSIVs inoperable in MODE 2, 3, or 4.1 Close MSIV.AND 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Once per 7 days 2 Verify MSIV is closed.Required Action and associ ated Compl eti on Time of not met.Ii MODE 3.Be in MODE 5.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours PALO VERDE UNITS 1,2,3372-AMNETNO

.-44 3.7.2-2 AMENDMENT NO. 117, !23 Insert for page 3.7.2-2 G. --- -NOTE----.

Not applicable when two or more MSIVs intentionally made inoperable.

Two or more MSIVs inoperable in MODE 1.G.1 Restore all but one MSIV to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months O._R In accordance with the Risk Informed Completion Time Program MF IVs 3.7.3 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)LCO 3.7.3 APPLICABILITY:

Four economizer MFIVs and four downcomner MFIVs shall be OPERABLE.MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power operated valve.ACTI ONS----------------

~~-NOTE----

Separate Condition entry is allowed for each penetration flow path.CONDITION COMPLETION TIME A. One or more MFIVs inoperable.

72) hoursin A--2. Verify inoperabic MFIV is closed or isolated.B-. Two va!'-cs in the B. Isolate affected flow £ o'r.... i ...

MFTIVi 4c losed or islaed.1 (conti nued)PALO VERDE UNITS 1,2,3 3731AEDETN.17~

3.7.3-i AMENDMENT NO.

Insert for page 3.7.3-1 OPERABLE status.OR A.2.1 Close or isolate inoperable MFlIV(s).AND A.2.2 Verify inoperable MFIV(s) is closed or isolated.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Once per isolation 7 days following B. Two valves in the same flow path inoperable.

OPERABLE status.OR B.2.1 Isolate affected flow path.AND B.2.2 Verify inoperable MFI V(s) is closed or isolated.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk Informed Completion Time Program 8 houi-s Once per 7 days following isolation ADVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)LCO 3.7.4 APPLICABILITY:

Four ADV lines shall be OPERABLE.MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal.ACTI ONS CONDITION REQUIRED ACTION COMPLETION TIME A.-----NOTE-

--Separate Condition A.1 Restore ADV line to 7 days entry is allowed for OPERABLE status.each SG. ITIsR One required ADV line inoperable.

B. Two or ADV lines B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months inoperable with both to OPERABLE status on ADV lin~s inoperable each SG. RC Ine on one fr more SGs.C. Requil ed Action and assoc~ ated Compl eti on Time ot met.C.1 Be in MODE 3.AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 24 hours C.2 Be in MODE 4 without reliance on steam generator for heat removal.-NOTE----Risk Informed Completion Time not applicable when all ADVs intentionally made inoperable.

PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 16,11 (COFnICTED AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7..5 Three AFW trains shall be OPERABLE.-~~~~~~NOTE-----------

Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.APPLICABILITY:

ACTIONS-------------

NOTE LCO 3.0.4.b is not applicable.

CONDITION

[R EQUIRED ACTION COMPLETION TIME A. One steam supply to turbine driven AFW pump inoperable.

OR-~~NOTE----

Only applicable if MODE 2 has not been entered following refueling.

One turbine driven AFW pump inoperable in MODE 3 following refueling.

A.1 Restore affected equipment to OPERABLE status.7 days< RIOT AND Insert Deleted by adoption of TSTF-439 da4 e-, fie,.e.,.-v he 4 .Q B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.other than Condition AAN in MODE 1, 2, or 3.Deletedb adopton of...,....

TSTF-439 1 ... ÷, (conti nued)PALO VERDE UNITS 1,2,3 3751AEDETN.44-6 3.7.5-1 AMENDMENT NO. 134, 155 ACTIONS (cninud AFW System 3.7.5 f "CONDITION D REQUIRED ACTION COMPLETION TIME 0. ReurdAction and .1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time of Condition A, AND I t otmt.-G.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Q. hree AFW trains BI. 1------NOTE-

--inoperable in MODE 1, LCO 3.0.3 and all 2, or 3.other LCO Required Actions requi ring MODE changes are suspended until one AFW train is restored to OPERABLE status.Initiate action to Immediately restore one AFW train~to OPERABLE status.E. ReurdAWtrain

~ .1------NOTE-

--inoperable in MODE 4. LCO 3.0.3 and all other LCO Required Actions requi ring MODE changes are suspended until one AFW train is restored to OPERABLE status.Ini ti ate acti on to Immediately restore one AFW train to OPERABLE ,status.PALO VERDE UNITS 1,2,3 3752AEDETN.4 3.7.5-2 AMENDMENT NO.

Insert for page 3.7.5-2 C. -- -- NOTE----.Not applicable when second AFW train intentionally made inoperable.

C.1 Restore at least one AFW train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two AFW trains inoperable in MODEl 12, or 3.

CST 3.7.6 3.7 PLANT SYSTEMS 3.7.6 Condensate LCO 3.7.6 APPLICABILITY:

Storage Tank (CST) _OPERABLE.

The CST shall be 95t MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.ACTI ONS CONDITION

] REQUIRED ACTION COMPLETION TIME A.A.1 Verify backup OPERABILITY of water supply.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter 7 days<IC AND A.2 Restore CST tolimit OPABLE tatus. -B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND B.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat removal.SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.6.1 Verify CST level is 29.5 ft. In accordance with the Surveil11ance Frequency Control Program LI PALO VERDE UNITS 1,2,3 3761AEDETN.4---

3.7.6-1 AMENDMENT NO. !!7, 188 EW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Essential Cooling Water (EW) System LCO 3.7.7 APPLICABILITY:

Two LW trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION JREQUIRED ACTION COMPLETION TIME A. One LW train inoperable.

A.1-NOTE- --Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -MODE 4" for shutdown cooling made inoperable by LW.Restore LW train to OPERABLE status.Insert l 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s< RIOT Insert I J.m -- m n 4.L B. ReurdActi on and associ ated Compl eti on Time of Condition A not met.B.1 AND B.2 Be in MODE 3.Be in MODE 5.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours PALO VERDE UNITS 1,2,3377-AMNETNO 4 3.7.7-1 AMENDMENT NO.

Insert for page 3.7.7-1 B. ---- NOTE----.Not applicable when second EW train intentionally made inoperable.

B.1 Restore at least one EW train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two EW trains inoperable.

ES PS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)LCO 3.7.8 APPLICABILITY:

Two ESPS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION

] REQUIRED ACTION COMPLETION TIME A. One ESPS train i noperabl e.A.1-Notes- --1. Enter applicable Conditions and Requi red Actions of LCO 3.8.1."AC Sources -Operating," for emergency diesel generator made i noperabl e by ES PS.2. Enter applicable Condi tions and Requi red Actions of LCO 3.4.6."RCS Loops -MODE 4," for shutdown cool ing made i noperabl e by ESPS.Restore ESPS train to OPERABLE status.72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s< RIOT Insert 4 4 B. eqied Action and associ ated Compl eti on Time of Condition A not met.B.1 AND B.2 Be in MODE 3.Be in MODE 5.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours PALO VERDE UNITS 1,2,3378-AMNETNO 3.7.8-1 AMENDMENT NO.

Insert for page 3.7.8-1 Not applicable when second ESPS train intentionally made inoperable.

B.1 Restore at least one ESPS train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two ESPS trains inoperable.

UHS 3.7.9 3.7 PLANT SYSTEMS 3.7.9 Ultimate Heat Sink (UHS)LCO 3.7.9 APPLICABILITY:

The UHS shall be OPERABLE.MODES 1, 2, 3, and 4.SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.1.9.1 Verify the usable water depth of each In accordance essential spray pond is 12 feet. with the Surveil11ance Frequency Control Program SR 3.7.9.2 Verify water temperature of each essential In accordance spray pond is 89°F. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.9-1 PAL VRD UIT 12, 37.-1AMENDMENT NO. !17, !88 Insert for page 3.7.9-1 A.-...NOTE-....Risk Informed Completion Time not applicable when UHS intentionally made inoperable.

UHS inoperable.

A.1 Restore UHS to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months O._R In accordance with the Risk Informed Completion Time Program B. Required Action and associated Completion Time not met.

EC 3.7.10 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 APPLICABILITY:

Two EC trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION JREQUIRED ACTION COMPLETION TIME 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months A. One EC train inoperable.

A.1 Restore EC train to OPERABLE status.p~IJ-J0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours SURVEILLANCEREQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power In accordance operated, and automatic valve in the flow with the path, that is not locked, sealed, or Surveillance otherwise secured in position, is in the Frequency correct position.

Control Program SR 3.7.10.2 Verify the proper actuation of each EC In accordance System component on an actual or simulated with the actuation signal. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 371- MNMN O 4--8 3.7.10-1 AMENDMENT NO. 117, 188 Insert for page 3.7.10-1 B. ----NOTE----.Not applicable when second EC train intentionally made inoperable.

B.1 Restore at least one EC train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two EC trains inoperable.

CREATCS 3.7.12 3.7 PLANT SYSTEMS 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS)LCO 3.7.12 APPLICABILITY:

Two CREATCS trains shall be OPERABLE.MODES 1, 2, 3, 4, 5, and 6, During movement of irradiated fuel assemblies, ACTIONS CONDITION REQUIRED ACTION ] COMPLETION TIME A. One CREATCS train llner inoperable A.I Restore CREATCS train to OPERABLE status.30 days B. ReurdAction and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time of Condition AND not met in MODE 1,2, 3, or 4. D or B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months G. Requi'-" red Acti on and -G. 1 Pl ace OPERABLE Immediately associated Completion CREATCS train in Time of Condi ti on A operati on.D. Reure ction and lQ.l Place OPERABLE Immediately associated Compl eti on ICREATCS train i n Time of Condition A Ioperation not met during l OR movement of i rradi atedk-fuel assembl ies. 2 Suspend movement of Immediately i rradi ated fuel assembl ies.(conti nued)PALO VERDE UNITS 1,2,337121AEDNT O.4.3.7.12-1 AMENDMENT NO.

Insert for page 3.7.12-1 8.1 B. ----NOTE----.Not applicable when second CREATCS train intentionally made inoperable.

Two CREATCS trains inoperable in MODE 1,2, 3, or 4.Restore at least one CREATCS train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program CREATCS 3.7.12 ACTIONS (continued)

CONDITION UIRED ACTION COMPLETION TIME Two CREATCS trains inoperable in MODE 5 or 6, or during movement of irradiated fuel assemblies.

Suspend CORE ALTERATIONS.

Immedi ately Immedi ately AND Suspend movement of irradiated fuel assemblies.Tw:o CREATCS trains Enter LCO 3.0.3.

in MODE 1, SURVEILLANCEREQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.12.1 Verify each CREATCS train has the In accordance capability to remove the assumed heat load, with the Surveil11ance Frequency Control Program PALO VERDE UNITS 1,2,3 3.7.12-2 PAL VRD UIT 1,,33..1-2AMENDMENT NO. 117,-188 AC Sources -Operating 3.8.1 ACTIONS CONDITION

[RE QUIRED ACTION COMPLETION TIME A. (continued)

A.3 Restore requi red offsite circuit to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months failurc to meet L-CD Deleted by adoption of ,, TSTF-439 I I+ 4 B. One DG inoperable.

B.1 AND B.2 AND B.3.1 OR B.3.2 Perform SR 3.8.1.1 for the OPERABLE requi red offsite circuit(s).

Decl are requi red feature(s) supported by the inoperable DG inoperable when its redundant requi red feature(s) is inoperable.

Determine OPERABLE DG is not inoperable due to common cause failure.Perform SR 3.8.1.2 for OPERABLE DG.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from discovery of Condition B concurrent with inoperability of redundant requi red feature(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 24 hours (conti nued)AND PALO VERDE UNITS 1,2,33.12AMN ETNO 44 3.8.1-2 AMENDMENT NO. 117, 154 AC Sources -Operating 3.8.1 IRICT insert ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.4 Restore DG days to OPERABLE status.failure to moot C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable, feature(s) inoperable discovery of when its redundant Condition C required feature(s) concurrent with is inoperable.

inoperability of redundant requi red feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status.]RICT insertj (conti nued)PALO VERDE UNITS 1,2,3 3813AEDETN.1~~~6 3.8.1-3 AMENDMENT NO. 117, !54 AC Sources -Operati ng 3.8.1 ACTIONS (continued)

CONDITION j REQUIRED ACTION {COMPLETION TIME D. One required offsite circuit inoperable.

AND One DG inoperable.

-~~NOTE-----

Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems -Operating," when Condition D i s entered wi th no AC power source to a train.D.1 OR D.2 Restore required offsite circuits to OPERABLE status.Restore DG to OPERABLE status.12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months hours< RICT Insert fours 12 E. Two DGs inoperable.

E.1 Restore one DG to OPERABLE status.2h 4 F. One automatic load sequencer inoperable.

F.1 AND F.2 Restore automatic load sequencer to OPERABLE status.Declare required feature(s) supported by the inoperable sequencer inoperable when its redundant requi red feature(s) is inoperable.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 4 hours from discovery of Condition F concurrent with inoperability of redundant requi red feature(s)

~(conti nued)PALO VERDE UNITS 1,2,3381-AMNETNO 3.8.1-4 AMENDMENT NO.

Insert for page 3.8.1-4 G. ---- NOTE-....Not applicable when three or more required AC SOUroes intentionally made inoperable.

Three or more required AC sources inoperable.

G.1 Restore required AC source(s) to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program AC Sources -Operating 3.8.1 ACTIONS (conti nued)COI REQUIRED ACTION COMPLETION TIME G. On rmre required G.i Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months offsite circuit(s) do capability of the not meet requi red offsite ci rcuit(s).capabilIi ty. OR-------------------

NOTE-----Enter LCO 3.8.1 Condition A or C for required offsite ci rcuit(s) inoperable.Transfer the ESF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months bus(es) from the , offsite circuit(s) to the EDG(s).H. Requi red Action and Associ ated Compl eti on Time of Condition A, B,_C, D, E, F, e~Gnot met. 'G, rHI 4.1 AND2 Be in MODE 3.Be in MODE 5.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months -36 hours I. Thrcc^ or rnor 4-- Enter IC 3".0.3. mi ....uircd AC ........r1 I .. .. ......PALO VERDE UNITS 1,2,338.5AMNETNO -2 3.8.1-5 AMENDMENT NO. 117, 123 DC Sources -Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources -Operating LCO 3.8.4 APPLICABILITY:

The Train A and Train B DC electrical power subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS _______________

CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on A.1 Restore battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months one subsystem terminal voltage to inoperable, greater than or equal RC to the minimum established float Isr voltage.AND A.2 Verify battery float Once per 12 current s 2 amps. hours AND A.3 Restore battery 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months charger to OPERABLE status.B.cticlB.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Spower subsystem OpoerAL staubsytm o Sinoperable for reasonsOPRBEsau Sother than lserI Condition A. _Required Action and J.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Tienot met. AND 0.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3.8.4-1 PAL VEDE NIT 1,,3 .8.-1AMENDMENT NO. iie Insert for page 3.8.4-1 C. -- -- NOTE----.Not applicable when second DC electrical power subsystem intentionally made inoperable.

Two DC electrical power subsystems inoperable.

C.1 Restore at least one DC electrical power subsystem to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months O._R In accordance with the Risk Informed Completion Time Program Inverters

-Operati ng 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters

-Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.-~~~~~~NOTE-----------

One inverter may be disconnected from its associated DC bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided: a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY:

MODES 1, 2, 3, and 4.ACTI ONS _________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter A.1------NOTE-

--i noperabl e. Enter appl icabl e Conditions and Requi red Actions of LCO 3.8.9,'Distribution Systems -Operating" with any vital instrument bus de-energi zed.Restore inverter to 7 days OPERABLE status.Insert IRICT insert/(continued)

PALO VERDE UNITS 1,2,3387-AMNETNO 4-4Q 3.8.7-i AMENDMENT NO.

Insert for page 3.8.7-1 B. ----NOTE---..Not applicable when two or more required inverters intentionally made inoperable resulting in loss of safety function.B.1 Restore all but one inverter to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two or more required inverters inoperable.

Inverters

-Operati ng 3.8.7 ACTIONS (continued)

CODI _ REQUIRED ACTION COMPLETION TIME B. eqied Action B.1 Be in MODE 3. 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months sBe in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct inverter voltage, frequency, In accordance and alignment to required AC vital with the instrument buses. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3.8.7-2 PAL VEDE NIT 1,,3 .8.-2AMENDMENT NO. 4117, 148B-Di stri buti on Systems -Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems -Operating LCO 3.8.9 APPLICABILITY:

electrical power distribution subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION]

REQUIRED ACTION~ COMPLETION TIME A. One AC electrical power di stri buti on subsystem i noperabl e.A.1 Restore AC el ectrical power di stri buti on subsystem to OPERABLE status.Deleted by adoption of TSTF-439 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months s< RICT ADInsert 16 nour from v .e ean B. One AC vita]instrument bus electrical power di stri buti on subsystem i noperabl e.8.1 Restore AC vital instrument bus electrical power di stri buti on subsystem to OPERABLE status./2 hours AND 16 ho,,z fro,-m 4*semlt y-u v ~uc to mcct ,-1 ,-,g (conti nued)Deleted by adoption of TSTF-439 PALO VERDE UNITS 1,2,3 3891AEDETN.4.

3.8.9-i AMENDMENT NO.

Di stri buti on Systems -Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One DC electrical power di stri buti on subsystems i noperabl e.C.1 Restore DC electrical power distribution subsystem to OPERABLE status.2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 4-a-< RICT Insert TSTF-439 LCO+D.- Required Action and associ ated Compl eti on Time not met..i NiD Be in MODE 3.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Be in MODE 5.36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Tw bo or more inoperable Enter LCO 3.0.3. ime-aey in a lo of. safety SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and In accordance voltage to required AC, DC, and AC vital with the instrument bus electrical power Surveillance distribution subsystems.

Frequency Control Program PALO VERDE UNITS 1,2,3 3892AEDETN.~--8 3.8.9-2 AMENDMENT NO. 117, 188 Insert for page 3.8.9-2 D. ----NOTE----.Not applicable when two or more electrical power distribution subsystems intentionally made inoperable resulting in loss of safety function.D.1I Restore electrical power distribution subsystem(s) to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program Two or more electrical power distribution subsystems inoperable.

Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.19 Battery Monitoring and Maintenance Program (continued)

4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following statements in paragraph (d) may be omitted: "When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full charge.These measurements shall be made after the initially high charging current decreases sharply and the battery voltage rises to approach the charger output voltage." 5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string." b. The program shall include the following provisions:

1. Actions to restore battery cells with float voltage< 2.13V;2. Actions to determine whether the float voltage of the remaining battery cells is 2.13 V when the float voltage of a battery cell has been found to be<2.13V;3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates;4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage;and 5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.

PALO VERDE UNITS 1,2,3 551 MNMN O D 5.5-19 AMENDMENT NO.

Insert for page 5.5-19 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RIOT) and must be implemented in accordance with NEI 06-09 Revision 0 -A,"Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RIOT may not exceed 30 days;b. A RIOT may only be utilized in MODE 1, 2;c. When a RIOT is being used, any plant configuration change within the scope of the Risk Informed Completion Time Program must be considered for the effect on the RIOT.1. For planned changes, the revised RIOT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RIOT must be determined within the time limits of the Required Action Completion Time (i.e., not the RIOT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.3. Revising the RIOT is not required if the plant configuration change would lower plant risk and would result in a longer RIOT.d. Use of a RIOT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.e. Use of a RIOT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in Section 2.3.1 of NEI 06-09 Revision 0 -A.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTAC H MENT 2 Revised Technical Specification Pages (Clean copy)1.3-13 1.3-14 1.3-15 3.3.4-1 3.3.6-1 3.3.6-2 3.3.6-3 3.3.6-4 3.3.6-5 3.4.9-1 3.4.9-2 3.4.10-1 3.4.12-1 3.5.1-1 3.5.1-2 3.5.3-1 3.5.3-2 3.5.3-3 3.5.3-4 3.5.5-1 3.6.2-3 3.6.3-1 3.6.3-2 3.6.3-3 3.6.3-4 3.6.6-1 3.6.6-2 3.6.6-3 3.7.2-2 3.7.2-3 3.7.2-4 3.7.3-1 3.7.3-2 3.7.4-1 3.7.5-1 3.7.5-2 3.7.6-1 3.7.6-2 3.7.7-1 3.7.7-2 3.7.8-1 3.7.8-2 3.7.9-1 3.7.9-2 3.7.10-1 3.7.10-2 3.7.12-1 3.7.12-2 3.8.1-2 3.8.1-3 3.8.1-4 3.8.1-5 3.8.1-6 3.8.1-7 3.8.1-8 3.8.1-9 3.8.1-10 3.8.1-11 3.8.1-12 3.8.1-13 3.8.1-14 3.8.1-15 3.8.1-16 3.8.1-17 3.8.1-18 3.8.4-1 3.8.4-2 3.8.4-3 3.8.4-4 3.8.7-1 3.8.7-2 3.8.9-1 3.8,9-2 5.5.20 Note: The following TS clean pages in this attachment reflect the deletion of second completions adopted by the pending licensing amendment request to adopt TSTF-439-A (ML1 5065A031)oTS 1.3, Completion Times* TS 3.7.5, Auxiliary Feedwater (AFW) System o TS 3.8.1, AC Sources -Operating oTS 3.8.9, Distribution Systems -Operating Completi on Tines 1.3 1.3 Completion Times EXAMPLES EXAMPLE 1.3-7 (conti nued)The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired.EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore subsystem 7 days subsystem to OPERABLE inoperable, status. OR In accordance with the Risk Informed Completion Time Program B.-...NOTE

... B.1 Restore 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable subsystems to when second OPERABLE status. OR subsystem intentionally In accordance made inoperable, with the Risk* Informed Completion Time Two subsystems Program inoperable.

C. Required Action C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and associated Completion Time AND not met.C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2. However, the licensee may elect to apply the PALO VERDE UNITS 1,2,313-3AEDNT O.-7, 1.3-13 AMENDMENT NO.

Compl eti on Times 1.3 1.3 Completion Times ACTION Risk Informed Completion Time Program which permits calculation (continued) of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time.The RICT cannot exceed 30 days. After the 1 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition C must also be entered.If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by a NOTE stating it is not applicable if the second subsystem is intentionally made inoperable.

The Required Actions of Condition B are not intended for voluntary removal of redundant subsystems from service. The Required Action is only applicable if one subsystem is inoperable for any reason and the second subsystem is found to be inoperable, or if both subsystems are found to be inoperable at the same time. If Condition B is applicable, at least one subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or Condition C must also be entered. The licensee may be able to apply a RICT to extend the Completion Time beyond 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months if the requirements of the Risk Informed Completion Time Program are met. If two subsystems are inoperable and Condition B is not applicable (i.e., the second subsystem was intentionally made inoperable), LCO 3.0.3 is entered as there i s no appl icable Condi ti on.The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions.

For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time clock Condition B have expired and subsequent changes in the plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start.If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition C is also entered and the Completion Time clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.

PALO VERDE UNITS 1,2,3 1.3-14 AMENDMENT NO.

Compl eti on Times 1.3 1.3 Completion Times IMMEDIATE COMPLETION TIME When "Immediately" is used as a Completion Time, the Required Action should be pursued without delay and in a control led manner.PALO VERDE UNITS 1,2,3 131 MNMN O 1 I .3-15 AMENDMENT NO.

RPS Logic and Trip Initiation 3.3.4 3.3 INSTRUMENTATION

3.3.4 Reactor

Protective System (RPS) Logic and Trip Initiation LCO 3.3.4 Six channels of RPS Matrix Logic, four channels of RPS Initiation Logic, four channels of reactor trip circuit breakers (RTCBs), and four channels of Manual Trip shall be OPERABLE.APPLICABILITY:

MODES 1 and 2, MODES 3, 4, and 5, with any RTCBs closed element assemblies capable of being and any control withdrawn.

ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIME A. One Matrix Logic A.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months channel inoperable.

OPERABLE status.OR OR Three Matrix Logic In accordance channels inoperable with the Risk due to a common power Informed source failure Completion Time de-energizing three Program matrix power supplies.(continued)

PALO VERDE UNITS 1,2,33341AMNETNO 1, 3.3.4-1 AMENDMENT NO. -t--1-7, ESFAS Logic and Manua 1 Trip 3.3.6 3.3 INSTRUMENTATION

3.3.6 Engineered

Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 APPLICABILITY:

Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1.According to Table 3.3.6-1.ACTIONS----------------

NOTE-- ----Separate Condition entry is allowed for each Function.CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions A.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Matrix Logic OPERABLE status.channel inoperable.

OR OR Three Matrix Logic In accordance channels are with the Risk inoperable due to a Informed common power source Completion Time failure de-energizing Program three matrix power supplies.B. One or more Functions B.1 Restore channel to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months with one Manual Trip OPERABLE status.or Initiation Logic OR channel inoperable.

In accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,3 3361AEDETN.4-.

3.3.6-1 AMENDMENT NO.

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions C.1i Open at least one Tmmedi ately with two Initiation contact in the Logic channels or affected trip leg of Manual Trip channels both ESFAS Actuation affecting the same Logics.trip leg inoperable.

AND C.2 Restore channels to 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months OPERABLE status.OR In accordance with the Risk Informed Completion Time Program D. One or more Functions D.1------NOTE------48 hours with one Actuation One channel of Logi c channel Actuati on Logi c may OR inoperable, be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for In accordance Surveillances, with the Risk provided the other Informed channel is OPERABLE.

Completion Time Program Restore channel to OPERABLE status.E. --NOTE-----E.1 Restore channel(s) to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not appl icable when OPERABLE status.second Actuati on OR Logic channel i ntenti onal ly made In accordance inoperable, with the Risk Informed Compl eti on Time One or more Program functions with two Actuation Logic channels inoperable.

PALO VERDE UNITS 1,2,3336-AMN ETNO 1-f 3.3.6-2 AMENDMENT NO. -I-i-%,

ESFAS Logic and Manual Trip 3.3.6 ACTIONS (continued)

F. Required Action and F.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on AND Time of Conditions for Containment Spray F2 B nMD .1 or Actuation Signal , Main F2 B nMD .1 or Steam Isolation Signal or AuxiIi ary Feedwater Actuation Signal not met.G. Required Action and G.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti onAN Time of Conditions for -N Safety Injecti on Actuation Signal, G.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Contai nment Isol ati on Actuation Signal, or Reci rcul ati on Actuation Signal not met.SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.3.6.1----------NOTE-

Testi ng of Actuati on Logi c shallI i ncl ude the yenifi cati on of the proper operati on of each i ni tiati on relay.Perform a CHANNEL FUNCTIONAL TEST on each In accordance ESFAS logic channel and Manual Trip with the channel. Surveill Iance Frequency Control Program PALO VERDE UNITS 1,2,3336-AMN ETNO -4 3.3.6-3 AMENDMENT NO.

ESFAS Logic and Manual Trip 3.3.6 SURVEILLANCE REQUIREMENTS (conti nued)SR 3.3.6.2-~~~~~NOTE--------

Relays exempt from testing during operation shall be tested in accordance with the Surveillance Frequency Control Program.Perform a subgroup relay test of each Actuation Logic channel, which includes the de-energization of each subgroup relay and verification of the OPERABILITY of each subgroup relay.In accordance with the Surveil11ance Frequency Control Program PALO VERDE UNITS 1,2,33364AMNETNO 19, 3.3.6-4 AMENDMENT NO.

Pressuri zer 3.4.9 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.9 Pressurizer LCO 3.4.9 The pressurizer shall be OPERABLE with: a. Pressurizer water level 27% and 56%; and b. Two groups of pressurizer heaters OPERABLE with the capacity of each group 125 kW.APPLICABILITY:

MODES 1, 2, and 3.~~~~~~-NOTE---------

--The pressurizer water level limit does not apply during: a.b.THERMAL POWER ramp > 5% RTP per minute; or THERMAL POWER step > 10% RTP.ACTI ONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. Pressurizer water A.1 Be in MODE 3 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months level not within with reactor limit. trip breakers open.AND A.? Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months B. One required group of B.1 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer heaters group of pressurizer inoperable, heaters to OPERABLE OR status.In accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,3 3491AEDETN.14 3.4.9-1 AMENDMENT NO.

Pressuri zer 3.4.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C.-----NOTE-----C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when requi red group of second group of pressurizer heaters to OR requied pessuizerOPERABLE status.heatied rs suie In accordance heaterswith the Risk intentionally made Informed i noperabl e. Compl eti on Ti me Program Two required groups of pressurizer heaters inoperable.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Compl eti on AND Time of Condition B or C o e.D.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.9.1 Verify pressurizer water level is 27% and In accordance

<56% with the Surveil11ance Frequency Control Program SR 3.4.9.2 Verify capacity of each required group of In accordance pressurizer heaters 125 kW. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 3492AEDETN.I~

3.4.9-2 AMENDMENT NO.

ESFAS Logic and Manual Trip 3.3.6 Table 3.3.6-1 (page 1 of 1)Engineered Safety Features Actuation System Logic and Manual Trip Applicability FUNCTION APPLICABLE MODES 1. Safety Injection Actuation Signal a. Matrix LOgiC 1,2,3 b. Initiation Logic 1,2,3,4 c. Actuation Logic 1,2,3,4 d. Manual Trip 1,2,3,4 2. Containment Isolation Actuation Signal a. Matrix Logic 1,2.3 b. Initiation Logic 1,2,3,4 c. Actuation Logic 1,2,3,4 d. Manual Trip 1,2,3.4 3. Recirculation Actuation Signal a. Matrix Logic 1,2,3 b. Initiation Logic 1,2,3,4 c. Actuation Logic 1,2.3.4 d. Manual Trip 1,2,3,4 4. Containment Spray Actuation Signal a. Matrix Logic 1,2,3 b. Initiation Logic 1,2,3 c. Actuation Logic 1,2,3 d. Manual Trip 1,2,3 5. Main Steam Isolation Signal(a)a. Matrix Logic 1,2,3 b. Initiation Logic 1,2,3 c. Actuation Logic 1,2,3 d. Manual Trip 1,2,3 6. Auxiliary Feedwater Actuation Signal SG #1 (AFAS-1)a. Matrix Logic 1,2,3 b. Initiation Logic 1,2,3 c. Actuation Logic 1,2,3 d. Manual Trip 1,2,3 7. Auxiliary Feedwater Actuation Signal SG #2 (AFAS-2)a. Matrix Logic 1,2,3 b. Initiation Logic 1,2,3 c. Actuation Logic 1,2,3 d. Manual Trip 1,2,3 (a) The MSlS Function is not required to be OPERABLE when all associated valves isolated by the MSIS Function are closed.PALO VERDE UNITS 1,2,3 3365AEDETN.1 3.3.6-5 AMENDMENT NO.

Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.10 Pressurizer Safety Valves -Modes 1, 2 and 3 LCO 3.4.10 APPLICABILITY:

Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.MODES 1, 2, and 3,~~~~~~-NOTE-----------

The lift settings are not required to be within LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions.

This exception is allowed for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.ACTI ONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. One pressurizer safety A.1 Restore valve to 15 minutes valve inoperable.

OPERABLE status.OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.OR B.2 Be in MODE 4 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Two or more pressurizer safety valves inoperable.

PALO VERDE UNITS 1,2,33 4101AED NT O.17, 3.4.10-I AMENDMENT NO. -i-i-7-,

Pressurizer Vents 3.4.12 3.4 REACTOR COOLANT SYSTEM (RCS)3.4.12 Pressurizer Vents LCO 3.4.12 APPLICABILITY:

Four pressurizer vent paths shall be OPERABLE.MODES 1, 2, and 3.MODE 4 with RCS pressure 385 psia.ACTI ONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required A.1 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pressurizer vent paths pressurizer vent inoperable, paths to OPERABLE OR status.In accordance with the Risk Informed Completion Time Program B. --NOTE-----B.1 Restore one 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Risk Informed pressurizer vent path Completion Time not to OPERABLE status. OR applicable when last vent path In accordance intentionally made with the Risk inoperable.

Informed Completion Time Program All pressurizer vent paths inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AN Time of Condition A, AN-orB otme.C.2 Be in MODE 4 with RCS 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months pressure < 385 psia.PALO VERDE UNITS 1,2,3 341- MNMN O ~3.4.12-I AMENDMENT NO.

SITs-Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.1 Safety Injection Tanks (SITs) -Operating LCO 3.5.1 Four SITs shall be OPERABLE.APPLICABILITY:

MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.ACTI ONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due A.1 Restore SIT to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to boron concentration OPERABLE status.not within limits. OR OR In accordance with the Risk One SIT inoperable due Informed to inability to verify Completion Time level or pressure.

Program B. One SIT inoperable for B.1 Restore SIT to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reasons other than OPERABLE status.Condition A. OR In accordance with the Risk Informed Completion Time Program C. --NOTE-----C.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when SIT to OPERABLE two or more SITs status. OR i ntenti onal ly made i noperabl e. In accordance with the Risk Informed Two or more SITs Completion Time inoperable.

Program PALO VERDE UNITS 1,2,33511AMN ETNO -, 3.5.1-1 AMENDMENT NO.

SITs-Operating 3.5.1 ACTI ONS D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Compl eti on AND Time of Condition A, B, or C not met.D.2 Reduce pressurizer 12'hours pressure to<1837 psia.SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each SIT isolation valve is fully In accordance open. with the Surveil11ance Frequency Control Program SR 3.5.1.2 Verify.borated water volume in each SIT is In accordance

>28% narrow range and 72% narrow range. with the Surveil11ance Frequency Control Program In accordance R3.5.1.3 Verify nitrogen cover pressure in each SIT with the is 600 psig and 625 psig. Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 3512AEDETN.13 3.5.1-2 AMENDMENT NO. -!-88, EGGS -Operating 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.3 ECCS -Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.APPLICABILITY:

MODES 1 and 2, MODE 3 with pressurizer pressure 1837 psia or with RCS Tc 485°F.ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem A.1 Restore subsystem to 7 days inoperable.

OPERABLE status.OR In accordance with the Risk Informed Completion Time Program B. One or more trains B.1 Restore train(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.other than Condition OR A.In accordance with the Risk Informed Compl eti on Ti me Program C. --NOTE------C.1 Restore ECCS flow 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when equivalent to 100% of second ECCS train a single OPERABLE OR intentionally made train.inoperable.

In accordance with the Risk Less than 100% of the Informed ECCS flow equivalent Completion Time to a single OPERABLE Program train available.

PALO VERDE UNITS 1,2,3 353iAEDETN.124 3.5.3-i AMENDMENT NO. J2-4, EGGS -Operating 3.5.3 ACTIONS 0. Required Action and associ ated Camp]leti on Time not met.0.1 AND D.2 AND D.3 Be in MODE 3.Reduce pressurizer pressure to<1837 psi a.Reduce RCS Tc to<485° F.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months PALO VERDE UNITS 1,2,3 3532AEDETN.14 3.5.3-2 AMENDMENT NO. I-2-4, ECCS -Operating 3.5.3 SURVEILLANCE REQUIREMENTS__________

SURVEILLANCE FREQUENCY SR 3.5.3.1 Verify each ECCS manual , power operated, In accordance and automatic valve in the flow path, that with the is not locked, sealed, or otherwise secured Surveillance in position, is in the correct position.

Frequency Control Program SR 3.5.3.2 Verify ECCS piping is full of water. In accordance with the Surveillance Frequency Control Program SR 3.5.3.3 Verify each ECCS pump develops the required In accordance differential pressure at the flow test with the point. Inservi ce Testing Program SR 3.5.3.4 Verify each ECCS automatic valve that is In accordance not locked, sealed, or otherwise secured in with the position, in the flow path actuates to the Surveillance correct position on an actual or simulated Frequency actuation signal. Control Program SR 3.5.3.5 Verify each ECCS pump starts automatically In accordance on an actual or simulated actuation signal,. with the Surveillance Frequency Control Program SR 3.5.3.6 Verify each LPSI pump stops on an actual or In accordance simulated actuation signal. with the Surveil11ance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,33533AMNETN.

8, 3.5.3-3 AMENDMENT NO.

EGGS -Operating 3.5.3 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.5.3.7 Verify, for each ECCS throttle valve i sted below, each position stop is in the correct posi ti on.In accordance with the Surveillance Frequency Control Program LPSI System Valve Number Hot Leg Injection Valve Numbers SIB-UV SIB -UV S IA- UV S IA- UV S IA- HV SIB-HV 615 625 635 645 306 307 SIC-HV 321 SID-HV 331 SR 3.5.3.8 Verify, by visual inspection, each ECCS In accordance train containment sump suction inlet is not with the restricted by debris and the suction inlet Surveillance strainers show no evidence of structural Frequency distress or abnormal corrosion.

Control Program PALO VERDE UNITS 1,2,3 3534AEDETN.I~

3.5.3-4.AMENDMENT NO.

RWT 3.5.5 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)3.5.5 Refueling Water Tank (RWT)LCO 3.5.5 APPLICABILITY:

The RWT shall be OPERABLE.MODES 1, 2, 3, and 4.ACTI ONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron A.1 Restore RWT to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months concentration not OPERABLE status.within limits. OR OR In accordance with the Risk RWT borated water Informed temperature not within Completion Time limits. Program B. RWT inoperable for B.1 Restore RWT to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months reasons other than OPERABLE status.Condition A. OR In accordance with the Risk Informed Completion Time Program C. Required Action and C.l Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C.2 Be in MODE 5.PALO VERDE UNITS 1,2,3355-AMNETNO 47 3.5.5-1 AMENDMENT NO. I-7, Containment Air Locks 3.6.2 ACTIONS _________CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.1 Verify an OPERABLE 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months door is closed in the affected air lock.AND B.2 Lock an OPERABLE door 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months closed in the affected air lock.AND B.3------NOTE----

Air lock doors in high radiation areas may be verified locked closed by administrative means.Verify an OPERABLE Once per 31 days door is locked closed in the affected air lock.C. One or more C.1 Initiate action to Immediately containment air locks evaluate overal l inoperable for reasons containment leakage other than Condition A rate per LCO 3.6.1.or B. AND C.2 Verify a door is 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months closed in the affected air lock.AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status.OR In accordance with the Risk Informed Completion Time Program (conti nued)AMENDMENT NO. 1-4-7, PALO VERDE UNITS 1,2,3362-3.6.2-3 Containment Isol ati on Valves 3.6.3 3.6 CONTAINMENT SYSTEMS 3.6.3 Containment Isolation Valves LCO 3.6.3 APPLICABILITY:

Each required containment isolation valve shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS----------------

~~-NOTES--------------

1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.2. Separate Condition entry is allowed for each penetration flow path.3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves.4. Enter applicable Conditions and Required Actions of LCO 3.6.1,"Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in accordance with SR 3.6.1.1.CONDITION REQUIRED ACTION COMPLETION TIME A. NOTE-----A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path penetration flow paths by use of at least OR with two required one closed and -containment isolation de-activated In accordance valves, automatic valve, with the Risk closed manual valve, Informed One or more blind flange, or Completion Time peneratin fow pthscheck valve with flow Program with one requi red throughted vlv containment isolation scrd valve inoperable AND except for purge valve leakage not within limit.______________________

_______________________(conti~nued)

PALO VERDE UNITS 1,2,3 3631AEDETN.16 3.6.3-1 AMENDMENT NO. 1-66, Containment Isol ati on Valves 3.6.3 ACTI ONS _________CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)

A.2------NOTE-

--Isolation devices in high radiation areas may be verified by use of admi ni strati ve means.Verify the affected Once per 31 days penetration flow path following i s i sol ated. i sol ati on for i sol ati on devices outside contai nment AND Pri or to entering MODE 4 from MODE 5 if not performed wi thin the previous 92 days for i sol ati on devices inside contai nment B. ---NOTE-----B.1 Isolate the affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Only applicable to penetration flow path penetration flow paths by use of at least OR with two requi red one closed and -contai nment i sol ati on de-acti vated In accordance valves, automatic valve, with the Risk closed manual valve, Informed or blind flange. Completion Time One or more Program penetration flow paths with two requi red containment i sol ati on valves inoperable except for purge valve leakage not within limit.(conti nued)PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO. ize6, Containment Isolation Valves 3.6.3 ACTIONS (continued)_______________

_________CONDITION REQUIRED ACTION COMPLETION TIME C.-----NOTE------C.l Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Only applicable to penetration flow path OR penetration flow paths by use of at least -with only one required one closed and In accordance containment isolation de-activated with the Risk valve and a closed automatic valve, Ifre system. closed manual valve, Ifre or bindflage.Compl eti on Ti me or blnd flnge.Program One or more AND penetration flow paths wi th one requi red C.2------NOTE----

containment i sol ati on Isol ati on devices i n valve inoperable, high radiation areas may be verified by use of administrative means.Verify the affected Once per 31 days penetration flow path following is isolated, isolation D. One or more D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months penetration flow paths penetration flow path with one or more by use of at least OR requi red containment one closed and -purge valves not de-activated In accordance wi thin purge val ve automatic valve with wi th the Risk leakage limits, resilient seals, or Informed bl ind flange. Compl eti on Ti me AND Program (conti nued)PALO VERDE UNITS 1,2,3 3633AEDETN.1~

3.6.3-3 AMENDMENT NO.

Containment Isol ati on Valves 3.6.3 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D.2 D. (continued)

NOTE----Isolation devices in high radiation areas may be verified by use of admi ni strati ve means.Verify the affected penetration flow path is isolated.Once per 31 days fol lowi ng i sol ati on for i sol ati on devices outside contai nment AND Pri or to entering MODE 4 from MODE 5 if not performed wi thin the previous 92 days for i sol ati on devices inside contai nment Once per 92 days fol lowing i sol ati on AND D.3 Perform SR 3.6.3.6 for the resilient seal purge valves closed to comply with Required Action D.1.E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,336.4AMNETNO 17 3.6.3-4 AMENDMENT NO.

Containment Spray System 3.6.6 3.6 CONTAINMENT SYSTEMS 3.6.6 Containment Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.APPLICABILITY:

MODES 1, 2, and 3.MODE 4 when RCS pressure is385 psia ACTI ONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray A.1 Restore containment 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months train inoperable, spray train to OPERABLE status. OR In accordance with the Risk Informed Compl eti on Time Program B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time of Condition A AND not met.B.2 Be in MODE 4 with RCS 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months pressure < 385 psia.C.----NOTE------C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when containment spray second containment train to OPERABLE OR spray train status.intentionally made In accordance inoperable, with the Risk Informed Completion Time Two containment spray Program trains inoperable.

PALO VERDE UNITS 1,2,3366-AMNETNO 1, 3.6.6-1 AMENDMENT NO. *--A-7-,

Containment Spray System 3.6.6 ACTIONS (continued)

_______________

________CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Comp] eti on Time of Condition C AND not met.D.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS_________

SURVEILLANCE FREQUENCY SR 3.6.6.1 Verify each containment spray manual , power In accordance operated, and automatic valve in the flow with the path that is not locked, sealed, or Surveillance otherwise secured in position is in the Frequency correct position.

Control Program SR 3.6.6.2 Verify the containment spray piping is In accordance full of water to the 113 ft level in the with the containment spray header. Surveillance Frequency Control Program SR 3.6.6.3 Verify each containment spray pump's In accordance developed head at the flow test point is with the greater than or equal to the required Inservice developed head. Testing Program SR 3.6.6.4 Verify each automatic containment spray In accordance valve in the flow path that is not locked, with the sealed, or otherwise secured in position, Surveillance actuates to the correct position on an Frequency actual or simulated actuation signal. Control Program PALO VERDE UNITS 1,2,3 3662AEDETN.1&

3.6.6-2 AMENDMENT NO.

Containment Spray System 3.6.6 SURVEILLANCE REQUIREMENTS (continued)_________

SR 3.6.6.5 Verify each containment spray pump starts In accordance automatically on an actual or simulated with the actuation signal. Surveillance Frequency Control Program SR 3.6.6.6 Verify each spray nozzle is unobstructed.

In accordance with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,336.3AMNETNO 3.6.6-3 AMENDMENT NO. :!-88, MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV E.i Declare each affected Immediately actuator trains MSIV inoperable.

inoperable.

OR Required Action and associ ated Compl eti on Time of Condition A, B, or C not met.F. One MSIV inoperable in F.1 Restore MSIV to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months MODE 1. OPERABLE status.OR In accordance with the Risk Informed Completion Time Program G.----NOTE-----G.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when MSIV to OPERABLE two or more MSIVs status. OR intentionally made inoperable.

In accordance with the Risk Two or more MSIVs Informed inoprabe inMOD 1.Completion Time inoprabe inMOD 1.Program H. Required Action and H.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associ ated Compl eti on Time of Condition F or G not met.PALO VERDE UNITS 1,2,3 3722AEDETN.13 3.7.2-2 AMENDMENT NO. $68, MS IVs 3.7.2 ACTIONS (continued)_________

I. --NOTE-----1.1 Close MSIV. 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Separate Condition AN entry is allowed for AN each MSIV. 1.2 Verify MSIV is Once per 7 days closed.One or more MSIVs inoperable in MODE 2, 3, or 4.J. Required Action and J.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time of Condition I AND not met.J.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3723AEDETN.T3 3.7.2-3 AMENDMENT NO.

MSIVs 3.7.2 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1----------NOTE-

Not required to be performed prior to entry into MODE 3.Verify closure time of each MSIV is In accordance within limits with each actuator train on with the an actual or simulated actuation signal .Inservice Testing Program PALO VERDE UNITS 1,2,33.24AMNETNO

, 3.7.2-4 AMENDMENT NO.

NPFIVs 3.7.3 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)LCO 3.7.3 APPLICABILITY:

Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE.MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power operated valve.ACTIONS-----------------

~NOTE----

Separate Condition entry is allowed for each penetration flow path.CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs A.1 Restore MFIV(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable.

OPERABLE status.OR In accordance OR with the Risk OR Informed Completion Time Program A.2.1 Close or isolate 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable MFIV(s).AND A.2.2 Verify inoperable Once per 7 days MFIV(s) is closed or following isolated.

isolation PALO VERDE UNITS 1,2,3 3731AEDETN.15 3.7.3-1 AMENDMENT NO.

MF IVs 3.7.3 ACTIONS (continued)

B. Two valves in the same flow path i noperabl e.B.1 Restore one valve to OPERABLE status.OR B.2.1 Isolated affected flow path.AND B.2.2. Verify inoperable MFIV(s) is closed or isolated.8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OR In accordance with the Risk Informed Completion Time Program 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Once per 7 days fol lowing i sol ati on C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3,7.3.1 Verify the closure time of each MFIV is In accordance with within limits on an actual or simulated the Inservice actuation signal .Testing Program PALO VE~RDE UNITS 1,2,3 3732AEDETN.4-3.7.3-2 AMENDMENT NO.

ADVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)LCO 3.7.4 APPLICABILITY:

Four ADV lines shall be OPERABLE.MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal.ACTIONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. --NOTE-----A.1 Restore ADV line to 7 days Separate Condition OPERABLE status.entry is allowed for OR each SG.One equred DV ineIn accordance inoerabeurdAVln with the Risk inopeable.Informed Completion Time Program B. --NOTE-----B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Risk Informed to OPERABLE status on Completion Time not each SG. OR applicable when all ADVs intentionally made inoperable.

In accordance with the Risk Informed Two or more ADV lines Completion Time inoperable with both Program ADV lines inoperable on one or more SGs.C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat remioval, PALO VERDE UNITS 1,2,3374-AMN ETNO 11, 3.7.4-i AMENDMENT NO. -i-%,

AFW System 3.7.5 3.7 PLANT SYSTEMS 3.7.5 Auxiliary Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.~~~~~~-NOTE-----------

Only one AEW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.APPLICABILITY:

ACTIONS---------------

~~-NOTE---------------

LCO 3.0.4.b is not applicable.

CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to A.1 Restore affected 7 days turbine driven AFW equipment to OPERABLE pump inoperable, status. OR OR-NOTE- In accordance with the Risk Only applicable if Informed MODE 2 has not been entered following Completion Time refueling.

Program One turbine driven AFW pump inoperable in MODE 3 following refueling.

B. One AFW train B.1 Restore AFW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons OPERABLE status.other than Condition A OR in MODE 1, 2, or 3. _In accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. -!-6-5, AFW System 3.7.5 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C.-----NOTE------C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when AFW train to OPERABLE second AFW train status.O intentionally made

__R inoperable.

In accordance with the Risk Two AFW trains Informed inoperable in MODE 1, Completion Time 2, or 3. Program D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, AND B, or C not met.D.2 Be in MODE 4. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months E. Three AFW trains E.1------NOTE-

--inoperable in MODE 1, LCD 3.0.3 and all 2, or 3. other LCD Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.Initiate action to Immediately restore one AFW train to OPERABLE status.F. Required AFW train F.1------NOTE-

--inoperable in MODE 4. LCD 3.0.3 and all other LCD Required Actions requiring MODE changes are suspended until one AFW train is restored to OPERABLE status.Initiate action to Immediately restore one AFW train to OPERABLE status.PALO VERDE UNITS 1,2,3 3752AEDETN.11~

3.7.5-2 AMENDMENT NO.

CST 3.7.6 3.7 PLANT SYSTEMS 3.7.6 Condensate Storage Tank (CST)LCO 3.7.6 APPLICABILITY:

The CST shall be OPERABLE.MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. CST inoperable.

A.1 Verify OPERABILITY of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months backup water supply.AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter AND A.2 Restore CST to 7 days OPERABLE status OR In accordance with the Risk Informed Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND B.2 Be in MODE 4 without 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months reliance on steam generator for heat removal.PALO VERDE UNITS 1,2,3376-AMNETNO 8, 3.7.6-i AMENDMENT NO. IL88, CST 3.7.6 SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.6.1 Verify CST level is 29.5 ft. In accordance with the Surveil1lance Frequency Control Programi PALO VERDE UNITS 1,2,3 3762AEDETN.--k 3.7.6-2 AMENDMENT NO.-I-88, EW System 3.7.7 3.7 PLANT SYSTEMS 3.7.7 Essential Cooling Water (EW) System LCO 3.7.7 APPLICABILITY:

Two EW trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train A.1------NOTE-

--inoperable.

Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -MODE 4" for shutdown cooling made inoperable by EW.Restore EW train to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OPERABLE status.OR In accordance with the Risk Informed Completion Time Program B.-----NOTE-----B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when EW train to OPERABLE second EW train status. OR intentionally made inoperable.

In accordance with the Risk Two EW trains Informed inoperable Completion Time Program PALO VERDE UNITS 1,2,3 3771AEDETN.44 3.7.7-1 AMENDMENT NO. %-i-7-.

LW System 3.7.7 ACTIONS (conti nued)C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Camp]leti on Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1----------NOTE--------

Isolation of LW flow to individual components does not render the LW System inoperable.

Verify each LW manual, power operated, and In accordance automatic valve in the flow path servicing with the safety related equipment, that is not Surveillance locked, sealed, or otherwise secured in Frequency position, is in the correct position.

Control Program SR 3.1.7.2 Verify each LW automatic valve in the flow In accordance path that is not locked, sealed, or with the otherwise secured in position, actuates to Surveillance the correct position on an actual or Frequency simulated actuation signal. Control Program SR 3.7.7.3 Verify each LW pump starts automatically on In accordance an actual or simulated actuation signal,. with the Surveillance Frequency Control Program PALO VERDE UNITS 1,2,33772AMNETNO

, 3.7.7-2 AMENDMENT NO.

3.7 PLANT

SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)LCO 3.7.8 APPLICABILITY:

Two ESPS trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION REQUIRED ACTION ] COMPLETION TIME A. One ESPS train inoperable.

A.1-Notes- --1. Enter applicable Conditions and Requi red Actions of LCO 3.8.1I."AC Sources -Operating," for emergency diesel generator made inoperable by ESPS.2. Enter applicable Conditions and Requi red Actions of LCO 3.4.6."RCS Loops -MODE 4," for shutdown cooling made inoperable by ESPS.Restore ESPS train to OPERABLE status.72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months OR In accordance with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,337.1AMNETNO

, 3.7.8-].AMENDMENT NO. !-I-7-,

ACTIONS (continued)

B.-----NOTE---

Not applicable when second ESPS train intentionally made i noperabl e.Two ESPS trains i noperabl e.B.1 Restore at least one ESPS train to OPERABLE status.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OR In accordance with the Risk Informed Completion Time Program C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.8.1----------Notes-

Isolation of ESPS flow to individual components does not render ESPS inoperable.

Verify each ESPS manual and power operated In accordance valve in the flow path servicing safety with the related equipment, that is not locked, Surveillance sealed, or otherwise secured in position, Frequency is in the correct position.

Control Program SR 3.7.8.2 Verify each ESPS pump starts automatically In accordance on an actual or simulated actuation signal, with the Surveil11ance Frequency Control Program PALO VERDE UNITS 1,2,33.8-AMN ETNO 8, 3.7.8-2 AMENDMENT NO. 88, UHS 3.7.9 3.7 PLANT SYSTEMS 3.7.9 Ultimate Heat Sink (UHS)LCO 3.7.9 APPLICABILITY:

The UHS shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.-----NOTE------A.1 Restore UHS to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Risk Informed OPERABLE status.Completion Time not OR applicable when UHS _intentionally made inoperable.

In accordance with the Risk Informed UHS inoperable.

Completion Time Program B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3191AEDETN.T8 3.7.9-1 AMENDMENT NO. -I-88, UHS 3.7.9 SURVE IL LANCE REQU IREMENTS_________

SURVEILLANCE FREQUENCY SR 3.7.9.1 Verify the usable water depth of each In accordance essential spray pond is _> 12 feet. with the Surveill ance Frequency Control Program SR 3.7.9.2 Verify water temperature of each essential In accordance spray pond is _< 89°F. with the Survei 11 Iance Frequency Control Program PALO VERDE UNITS 1,2,3 3792AEDETN.4~

3.7.9-2 AMENDMENT NO. -!-88, EC 3.7.10 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) Systenm LCD 3.7.10 APPLICABILITY:

Two EC trains shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train A.1 Restore EC train to 72 Hours inoperable.

OPERABLE status.OR In accordance with the Risk Informed Compl eti on Ti me Program B.-----NOTE-----B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when EC train to OPERABLE second EC train status. OR intentionally made inoperable.

In accordance with the Risk Two EC trains Informed inoerale.Compl eti on Ti me inopeable.Program C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,337.11AMN ETNO -, 3.7.10-1 AMENDMENT NO. -!-88, EC 3.7.10 SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power In accordance operated, and automatic valve in the flow with the path, that is not locked, sealed, or Surveillance otherwise secured in position, is in the Frequency correct position.

Control Program SR 3.7.10.2 Verify the proper actuation of each [C In accordance System component on an actual or simulated with the actuation signal. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3 37.02AEDETN.ig 3.7.10-2 AMENDMENT NO. JZ-88, C REATCS 3.7.12 3.7 PLANT SYSTEMS 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS)LCO 3.7.12 APPLICABILITY:

Two CREATCS trains shall be OPERABLE.MODES 1, 2, 3, 4, 5, and 6, During movement of irradiated fuel assemblies, ACTIONS _______________

CONDITION REQUIRED ACTION COMPLETION TIME A. One CREATCS train A.1 Restore CREATCS train 30 days inoperable, to OPERABLE status.B. --NOTE-----B.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when CREATCS train to second CREATCS train OPERABLE status. OR intentionally made _i noperabl e.In accordance with the Risk Two CREATCS trains Informed inoperable in MODE 1, Completion Time 2, 3, or 4. Program C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Completion Time of Condition A or AND B not met in MODE 1, 2, 3, or 4. C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months D. Required Action and D.1 Place OPERABLE Immediately associated Comple CREATCS train in tion Time of Condition operation.

A not met in MODE 5 or 6.(conti nued)PALO VERDE UNITS 1,2,3 371- MNMN O 1..3.7.12-1 AMENDMENT NO. &&

CREATCS 3.7.12 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. Required Action and E.1 Place OPERABLE Immediately associated Completion CREATCS train in Time of Condition A operation not met during O movement of irradiated OR fuel assemblies.

E.2 Suspend movement of Immediately irradiated fuel assemblies.

F. Two CREATCS trains F.l Suspend CORE Immediately inoperable in MODE 5 ALTERATIONS.

or 6, or during movement of irradiated AND fuel assemblies.

F.? Suspend movement of Immediately irradiated fuel assemblies.

SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.7.12.1 Verify each CREATCS train has the In accordance capability to remove the assumed heat load, with the Surveil11ance Frequency Control Program PALO VERDE UNITS 1,2,33..22AMNETNO g, 3.7.12-2 AMENDMENT NO.

AC Sources -Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)

A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program B. One DG inoperable.

B.1 AND B.2 AND B.3.1 OR B.3.2 Perform SR 3.8.1.1 for the OPERABLE required offsite circuit(s).

Declare required feature(s) supported by the inoperable DO inoperable when its redundant requi red feature(s) is inoperable.

Determine OPERABLE DG is not inoperable due to common cause failure.Perform SR 3.8.1.2 for OPERABLE DG.1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from discovery of Condition B concurrent with inoperability of redundant requi red feature(s) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 24 hours (conti nued)AND PALO VERDE UNITS 1,2,338.2AMNETNO

-4 3.8.1-2 AMENDMENT NO.

AC Sources -Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

B.4 Restore DG 10 days to OPERABLE status.OR In accordance with the Risk Informed Completion Time Program C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable, feature(s) inoperable discovery of when its redundant Condition C required feature(s) concurrent with is inoperable.

inoperability of redundant requi red feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months offsite circuit to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,3 3B13AEDETN.14 3.8.1-3 AMENDMENT NO. A-64, AC Sources -Operating 3.8.1 ACTIONS (continued)

CONDITION I REQUIRED ACTION COMPLETION TIME D. One required offsite circuit inoperable.

AND One DO inoperable.

NOTE-----Enter applicable Conditions and Requi red Actions of LCD 3.8.9, "Distribution Systems -Operating," when Condi ti on D i s entered with no AC power source to a train.D.1 OR Restore requi red offsite circuits OPERABLE status.to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR In accordance with the Risk Informed Compl eti on Ti me Program 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OR In accordance with the Risk Informed Compl eti on Ti me Program D.2 Restore DG to OPERABLE status.E. Two D~s inoperable.

E.1 Restore one DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status.OR In accordance with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,3 3814AEDETN.14 3.8.1-4 AMENDMENT NO. -i-I-7-,

AC Sources -Operating 3.8.1 ACTIONS (continued)_________

CONDITION REQUIRED ACTION COMPLETION TIME F. One automatic load V.1 Restore automatic 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months sequencer inoperable, load sequencer to OPERABLE status. OR AN D In accordance with the Risk Informed Completion Time Program F.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported discovery of by the inoperable Condition F sequencer inoperable concurrent with when its redundant inoperability of required feature(s) redundant is inoperable, required feature(s)

G.-----NOTE-----G.1 Restore required AC 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when source(s) to OPERABLE three or more required status. OR AC sources _intentionally made inoperable.

In accordance with the Risk Informed Three or more required Completion Time AC sources inoperable.

Program (continued)

PALO VERDE UNITS 1,2,33..5AMNETNO 2, 3.8.1-5 AMENDMENT NO.

AC Sources -Operating 3.8.1 ACTIONS (conti nued)CONDITION REQUIRED ACTION COMPLETION TIME H. One or more required H.1 Restore required 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months offsite circuit(s) do capability of the not meet requi red offsi te ci rcui t(s).capabilIi ty. OR--------------

NOTE-----Enter LCO 3.8.1 Condi ti on A or C for required offsite circuit(s) inoperable.

H.2 Transfer the [SF 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months bus(es) from the offsite circuit(s) to the EDG(s).I. Required Action and 1.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Associated Completion AND Time of Condi ti on A, B, C, D, E, F, G, or 12 B nMD .3 or H not met. ' 12 B nMD .3 or PALO VERDE UNITS 1,2,3 3816AEDETN.1~

3.8.1-6 AMENDMENT NO. -i-88, AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and In accordance indicated power availability for each with the requi red offsi te ci rcui t. Surveill Iance Frequency Control Program SR 3.8.1.2--------------

NOTES- ------1. Performance of SR 3.8.1.7 satisfies this SR.2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.3. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this SR as recommended by the manufacturer.

When modified start procedures are not used, the time, voltage, and frequency tolerances of SR 3.8.1.7 must be met.4. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify each DG starts from standby condition and achieves steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz.In accordance with the Surveillance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,3 3817AEDETN.1~

3.8,1-7 AMENDMENT NO. -!-88, AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FR EQ U ENCY SR 3.8.1.3----------NOTES--------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients outside the load range do not invalidate this test.3. This Surveillance shall be conducted on only one DG at a time.4. This SR shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.2 or SR 3.8.1.7.Verify each DG is synchronized and loaded, and operates for 60 minutes at a load>4950 kW and 5500 kW.In accordance with the Surveil11ance Frequency Control Program SR 3.8.1.4 Verify each day tank contains 550 gal of In accordance fuel oil (minimum level of 2.75 feet). with the Surveillance Frequency Control Program SR 3.8.1.5 Check for and remove accumulated water from In accordance each day tank. with the Surveil11ance Frequency Control Program SR 3.8.1.6 Verify the fuel oil transfer system In accordance operates to automatically transfer fuel with the oil from the storage tank to the day tank. Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,33.18AMNETNO

, 3.8.1-8 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQU I REM ENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.7----------NOTE--------

1. All DG starts may be preceded by an engine prelube period followed by a warmup period prior to loading.2. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify each DG starts from standby condi ti on and achi eves a. In < 10 seconds, voltage _> 3740 V and frequency

>_ 58.8 Hz; and b. Steady state voltage > 4000 V and_< 4371.2 V, and frequency

> 59.7 Hz and _< 60.7 Hz.In accordance with the Surveillance Frequency Control Program+SR 3.8.1.8-~~-NOTE--------

This Surveillance shall not normally be performed in MODE 1 or 2. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.Verify manual transfer of AC power sources from the normal offsite circuit to each alternate offsite circuit.In accordance with the Surveill ance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,3 3819AEDETN..-~

3.8.1-9 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.9-------------

NOTE-- -----This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.Verify each DG rejects a load greater than or equal to its associated single largest post-accident load, and: a. Following load rejection, the frequency is 64.5 Hz;b. Within 3 seconds following load rejection, the voltage is 3740 V and 4580 V; and c. Within 3 seconds following load rejection, the frequency is58.8 Hz and 61.2 Hz.In accordance with the Surveil11ance Frequency Control Program SR 3.8.1.10-------------

NOTE-------

If performed with the DG synchronized with offsite power, it shall be performed at a power factor of 0.89. However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

Verify each DG does not trip, and is maintained 6200 V during and a load rejection of 4950 kW and<5500 kW.voltage following In accordance with the Surveillance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,33.81-0AEDNT O.4g 3.8.1-10 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)_________

SURVEILLANCE FREQUENCY SR 3.8.1.11---------NOTE--------

1. All OG starts may be preceded by an engine prelube period.2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.3. Momentary voltage and frequency transients induced by load changes do not invalidate this test.4. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify on an actual or simulated loss of In accordance offsite power signal: with the Surveil11ance

a. De-energization of emergency buses; Frequency Control Program b. Load shedding from emergency buses;c. DG auto-starts and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto-connected emergency loads through automatic load sequencer, 3. maintains steady state voltage4000 V and 4377.2 V, 4. maintains steady state frequency59.7 Hz and 60.7 Hz, and 5. supplies permanently connected and auto-connected emergency loads for 5 minutes.(continued)

PALO VERDE UNITS 1,2,338.-1AMNETNO

, 3.8.1-11 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVE ILLANCE FREQUENCY SR 3.8.1.12-~~~~NOTES-------

1. All OG starts may be preceded by an engine prelube period.2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify on an actual or simulated Engineered Safety Feature (ESF) actuation signal (without a loss of offsite power) each DG auto-starts and: a. In 10 seconds, achieves voltage3740 V and frequency 58.8 Hz: b. Achieves steady state voltage 4000 and 4371.2 V and frequency 59.7 Hz and 60.1 Hz;c. Operates for 5 minutes on standby (running unloaded);

d. Permanently connected loads remain energized from the offsite power system; and e. Emergency loads are energized (auto-connected through the automatic load sequencer) from the offsite power system.In accordance with the Surveillance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,3 38 -2AEDETN.4~

3.8.1-12 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.13 Verify each DG automatic trip is bypassed In accordance on actual or simulated loss of voltage with the signal on the emergency bus concurrent with Surveillance an actual or simulated ESF actuation Frequency signal except: Control Program a. Engine overspeed;

b. Generator differential current;c. Engine low lube oil pressure; and d. Manual emergency stop trip.(continued)

PALO VERDE UNITS 1,2,338.13AMNETNO

, 3.8.1-13 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.14-~~NOTES---

1. Momentary transients outside range do not invalidate this the load test.2. If performed with the DG synchronized with offsite power, it shall be performed at a power factor of 0.89.However, if grid conditions do not permit, the power factor limit is not required to be met. Under this condition the power factor shall be maintained as close to the limit as practicable.

3. All DO starts may be preceded by an engine prelube period followed by a warmup period prior to loading.4. DG loading may include gradual loading as recommended by the manufacturer.

Verify each DG operates for 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months s: a. For 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months loaded 4950 kW and5500 kW; and b. For the remaining hours ( 2) of the test loaded 5775 kW and 6050 kW.In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,33.8114AEDNT O.ig 3.8.1-14 AMENDMENT NO.

AC Sources -Operati ng 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.15-------------

NOTES--------

1. This Surveillance shall be performed within 5 minutes of shutting down the DG after the DG, loaded 4950 kW and5500 kW, has operated 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months or until temperatures have stabilized.

Momentary transients outside of load range do not invalidate this test.2. All DG starts may be preceded by an engine prelube period.3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify each DG starts and achieves a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and b. Steady state voltage 4000 V and4377.2 V, and frequency 59.7 Hz and 60.7 Hz.In accordance with the Surveillance Frequency Control Program SR 3.8.1.16-------------

NOTE- ------This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.Verify each DG: a. Synchronizes with offsite power source while loaded with emergency loads upon a simulated restoration of offsite power;b. Transfers loads to offsite power source; and c. Returns to ready-to-load operation.

In accordance with the Surveillance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,338.15AMN ETNO , 3.8.1-15 AMENDMENT NO.

AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (conti nued)SURVEILLANCE FREQUENCY SR 3.8.1.17------------

NOTE--------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.Verify, with a DG operating in test mode and connected to its bus, an actual or simulated ESF actuation signal overrides the test mode by: a. Returning DG to ready-to-load operation; and b. Automatically energizing the emergency load from offsite power.In accordance with the Surveillance Freuecy Control Program SR 3.8.1.18---------NOTE--------

This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.Verify interval between each sequenced load block is within +/- 1 second of design interval for each automatic load sequencer.

In accordance with the Surveil11ance Frequency Control Program (conti nued)PALO VERDE UNITS 1,2,3 38 -6AEDETN.-~

3.8.1-16 AMENDMENT AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.19------------

NOTES- ------1. All DG starts may be preceded by an engine prelube period.2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.However, portions of the Surveillance may be performed to reestablish OPERABILITY provided an assessment determines the safety of the plant is maintained or enhanced.3. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify on an actual or simulated loss of offsite power signal in conjunction with an actual or simulated ESF actuation signal: a. De-energization of emergency buses;b. Load shedding from emergency buses;c. DO auto-starts from standby condition and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto-connected emergency loads through load sequencer, 3. achieves steady state voltage4000 V and 4377.2 V, 4. achieves steady state frequency59.7 Hz and 60.7 Hz, and 5. supplies permanently connected and auto-connected emergency loads for 5 minutes.In accordance with the Surveillance Frequency Control Program (continued)

PALO VERDE UNITS 1,2,3 38 -7AEDETN.156 8 3.8.1-17 AMENDMENT NO. -I-56, 188 AC Sources -Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.20 NOTES--------

1. All DG starts may be preceded by an engine prelube period.2. The steady state voltage and frequency limits are analyzed values and have not been adjusted for instrument error.Verify, when started simultaneously, each In accordance DG achieves with the a. In 10 seconds, voltage 3740 V and Surveillance frequency 58.8 Hz; and Frequency b. Steady state voltage 4000 V and Control Program4377.2 V, and frequency 59.7 Hz and 60.7 Hz.PALO VERDE UNITS 1,2,3381-8AEDNTO.I, 3.8.1-].8 AMENDMENT NO. &-88, DC Sources -Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources -Operating LCO 3.8.4 APPLICABILITY:

The Train A and Train B DC electrical power subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTI ONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on A.l Restore battery 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months one subsystem terminal voltage to inoperable, greater than or equal OR to the minimum established float In accordance voltage, with the Risk AND Informed w Completion Time Program A.2 Verify battery float Once per 12 current 2 amps. hours AND A.3 Restore battery 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months charger to OPERABLE status. OR In accordance with the Risk Informed Completion Time Program PALO VERDE UNITS 1,2,3 384iAEDETN.~

3.8.4-i AMENDMENT NO.

DC Sources -Operating 3.8.4 ACTIONS (continued)_________

B.On D eecrialB.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months B. oner DCuelectrica power subsystem to poe ubytmOPERABLE status OR inoperable for reasons _other than Condition A. In accordance with the Risk Informed Completion Time Program C. --NOTE-----C.1 Restore at least one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when DC electrical power second DC electrical subsystem to OPERABLE OR power subsystem status. -intentionally made inoperable.

In accordance with the Risk Informed Two DC electrical Completion Time power subsystems Program inoperable.

D. Required Action and D.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND 0.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months PALO VERDE UNITS 1,2,3 3842AEDETN.1~

3.8.4-2 AMENDMENT NO.

DC Sources -Operating 3.8.4 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is greater In accordance than or equal to the minimum established with the float voltage. Surveil11ance Frequency Control Program SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 Deleted SR 3.8.4.5 Deleted SR 3.8.4.6 Verify each battery charger supplies In accordance

>400 amps for Batteries A and B and with the>300 amps for Batteries C and D at Surveillance greater than or equal to the minimum Frequency established float voltage for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Control Program OR Verify each battery charger can recharge the battery to the fully charged state within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months while supplying the largest combined demands of the various continuous steady state loads, after a battery discharge to the bounding design basis event discharge state.(conti nued)PALO VERDE UNITS 1,2,3384-AMNETND 9, 3.8.4-3 AMENDMENT NO.

DC Sources -Operati ng 3.8.4 SURVEILLANCE REQUIREMENTS (conti nued)SURVEILLANCE FREQUENCY SR 3.8.4.7----------NOTES--------

1. The modified performance discharge test in SR 3.8.6.9 may be performed in lieu of SR 3.8.4.7.2. This Surveillance shall not be performed in MODE 1, 2. 3, or 4.Verify battery capacity is adequate to supply, and maintain in OPERABLE status, the required emergency loads for the design duty cycle when subjected to a battery service test.In accordance with the Surveillance Freuecy Control Program SR 3.8.4.8 Deleted PALO VERDE UNITS 1,2,3384-AMN ETNO 1g 3.8.4-4 AMENDMENT NO. %,

Inverters

-Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Inverters

-Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.-~~~~~~NOTE-----------

One inverter may be disconnected from its associated DC bus for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to perform an equalizing charge on its associated battery, provided: a. The associated AC vital instrument bus is energized its Class 1E constant voltage source regulator:

and from b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.

APPLICABILITY:

MODES 1, 2, 3, and 4.ACTIONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter A.1------NOTE--

--i noperabl e. Enter appl icable Condi ti ons and Requi red Actions of LCO 3.8.9,"Di stri buti on Systems -Operating" with any vital instrument bus de-energi zed.Restore inverter to 7 days OPERABLE status.OR In accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,338.-AMN ETNO 3d 3.8.7-I AMENDMENT NO.

Inverters

-Operating 3.8.7 ACTIONS (continued)_________

CONDITION REQUIRED ACTION COMPLETION TIME B. --NOTE-----B.1 Restore all but one 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not applicable when inverter to OPERABLE two or more required status. OR i nverters _intentionally made inoperable resulting In accordance in loss of safety with the Risk functi on. Informed Compl eti on Ti me Program Two or more required inverters inoperable.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associ ated Compl eti on Time not met. AND C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCEREQUIREMENTS

_________SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, In accordance and alignment to required AC vital with the instrument buses. Surveillance Frequency Control Program PALO VERDE UNITS 1,2,3387-AMNETNO SB 3.8.7-2 AMENDMENT NO.

Distribution Systems -Operating 3.8.9 3.8 ELECTRICAL POWER SYSTEMS 3.8.9 Distribution Systems -Operating LCO 3.8.9 APPLICABILITY:

electrical power distribution subsystems shall be OPERABLE.MODES 1, 2, 3, and 4.ACTIONS_________________________

CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical A.1 Restore AC electrical 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months power distribution power distribution subsystem inoperable, subsystem to OPERABLE OR status.In accordance with the Risk Informed Completion Time Program B. One AC vital B.1 Restore AC vital 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months instrument bus instrument bus electrical power electrical power OR distribution subsystem distribution

-inoperable, subsystem to OPERABLE In accordance status. with the Risk Informed Compl eti on Ti me Program (conti nued)PALO VERDE UNITS 1.2,3389-AMN ETNO 17, 3.8.9-I AMENDMENT NO. i-1-7-,

Distribution Systems -Operating 3.8.9 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One DC electrical C.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months power distribution power distribution subsystems inoperable, subsystem to OPERABLE OR status.In accordance with the Risk Informed Compl eti on Ti me Program D.-----NOTE-----D.1i Restore el ectri cal 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Not appl icabl e when power di stri buti on two or more electrical subsystem(s) to O power distribution OPERABLE status. OR subsystems intentionally made In accordance inoperable resulting with the Risk in loss of safety Informed function.

Completion Time Program Two or more electrical power distribution subsystems i nope rabl e.E. Required Action and E.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion AND Time not met.E.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS__________

SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and In accordance voltage to required AC, DC, and AC vital with the instrument bus electrical power Surveillance di stri buti on subsystems.

Frequency Control Program PALO VERDE UNITS 1,2,3 3892AEDETN.*~g 3.8.9-2 AMENDMENT NO. -i-88, Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5 .5 .20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed (RICT) and must be implemented in accordance with NEI 06-09"Risk-Managed Technical Specifications (RMTS) Guidelines." include the following:

Completion Time (Revision

0) -A, The program shall a. The RICT may not exceed 30 days;b. A RICT may only be utilized in MODE 1, 2;c. When a RICT is being used, any plant configuration change within the scope of the Risk Informed Completion Time Program must be considered for the effect on the RICT.1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT)or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.3. Revisng the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.e. Use of a RICT is permitted for a specified safety function or system required to be OPERABLE"PRA functional" as defined in emergent conditions which represent a loss of inoperability of all required trains of a if one or more of the trains are considered Section 2.3.1 of NEI 06-09 (Revision

0) -A.PALO VERDE UNITS 1,2,3 552 MNMN O 5.5-20 AMENDMENT NO.

Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACH MENT 3 Technical Specification Bases Changes TS Bases Pages B 3.3.4-10 B 3.3.6-16 B 3.3.6-17 B 3.3.6-18 B 3.3.6-19 B 3.4.9-5 B 3.4.10-3 B 3.4.12-3 B 3.4.12-4 B 3.5.1-7 B 3.5.1-8 B 3.5.3-6 B 3.5.3-7 B 3.5.5-7 B 3.5.5-8 B 3.6.2-7 B 3.6.3-10 B 3.6.3-11 B 3.6.3-12 B 3.6.3-13 B 3.6.3-14 B 3.6.3-15 B 3.6.6-5 B 3.6.6-6 B 3.7.2-7 B 3.7.2-8 B 3.7.3-3 B 3.7.3-4 B 3.7.4-5 B 3.7.5-5 B 3.7.5-6 B 3.7.5-7 B 3.7.5-8 B 3.7.6-3 B 3.7.7-3 B 3.7.7-4 B 3.7.8-3 B 3.7.9-2 B 3.7.10-3 B 3.7.12-2 B 3.7.12-3 B 3.7.12-4 B 3.8.1-9 B 3.8.1-12 B 3.8.1-13 B 3.8.1-14 B 3.8.1-15 B 3.8.1-16 B 3.8.1-17 B 3.8.1-18 B 3.8.1-19 B 3.8.1-20 B 3.8.1-21 B 3.8.1-22 B 3.8.4-5 B 3.8.4-6 B 3.8.4-7 B 3.8.4-8 B 3.8.7-3 B 3.8.7-4 B 3.8.9-4 B 3.8.9-5 B 3.8.9-6 B 3.8.9-7 B 3.8.9-8 B 3.8.9-9 RPS Logic and Trip Initiation B 3.3.4 BASES ACTIONS A.1 lori mcordnmeith Condition A applies if one Matrix Logic channel is the Rsklnrmed inoperable or three Matrix Logic channels inoperable due to thmpetRisk Tirmed a common power source failure de-energizing three matrix ower supplies in any applicable MODE. Loss of a single IProgram.

Vi 1 instrument bus will de-energize one of the two matrix* powe supplies in up to three matrices.

This is considered a singT -matrix failure, providing the matrix relays associate ith the failed power supplies de-energize as required.

Tnchannel must be restored to OPERABLE status within 48 hou s. The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months provides the operator time to take appropriate actions and still ensures that any risk involved in operating with a failed channel is acceptable.

Operating experience has demonstrated that the probability of a random failure of a second Matrix Logic channel is low during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months interval .If the channel cannot be restored to OPERABLE status wi thin 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , Condition E is entered.B.1, 8.2.1, and 8.2.2 Condi ti on B applies to one Ini ti ation Logic channel, RTCB channel, or Manual Trip channel in MODES 1 and 2, since they have the same actions. MODES 3, 4, and 5, with the RTCBs shut, are addressed in Condition C. These Required Actions require opening of the affected RTCB, or the redundant RTCB in the affected Trip Leg. This removes the need for the affected Trip Leg by performing its associated safety function.

With an RTCB open, the affected Functions are in one-out-of-two logic, which meets redundancy requirements, but testing on the OPERABLE channels cannot be performed without causing a reactor trip unless the RTCBs in the inoperable channels are closed to permit testing.Therefore, a Note has been added specifying that the RTCBs associated with one inoperable channel may be closed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for the performance of an RPS CHANNEL FUNCTIONAL TEST.(conti nued)PALO VERDE UNITS 1,2,3 B3341 EIIN~B 3.3.4-10 REVISION ESFAS Logic and Manual Trip B 3.3.6 BASES ACTIONS A.lI (continued)

The channel must be restored to OPERABLE status within 48 hu .This provides the operator with time to take a ;!riate actions and still ensures that any risk acoranenvlvdin operating with a failed channel is acceptable.

accoranceOperating experience has demonstrated that the probability the Risk of a random failure of a second Matrix Logic channel is low med during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. If the channel cannot be pletion Time restored to OPERABLE status with 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , Condition E is ram ntered.Con tion B applies to one Manual Trip or Initiation Logic channel1_inoperable.

The cha pel must be restored to OPERABLE status within 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Operating experience has demonstrated that the probability of a random failure in a second channel is low during any given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period.Failure of a single Initiation Logic channel may open one contact affecting both Actuation Logic channels.

For the purposes of this Specification, the Actuation Logic is not inoperable.

This prevents the need to enter LCO 3.0.3 in the event of an Initiation Logic channel failure. The Actions differ from those involving one RPS manual channel inoperable, because in the case of the RPS, opening RTCBs can be easily performed and verified.

Opening an i ni tiati on rel ay contact is more di fficul t to verify, and subsequent shorting of the contact is always possible.C.1 and C.2 Condition C applies to the failure of both Initiation Logic channels affecting the same trip leg.In this case, the Actuation Logic channels are not inoperable, since they are in one-out-of-two logic and capable of performing as requi red. This obviates the need to enter LCO 3.0.3 in the event of a matrix or vital bus power failure.(conti nued)PALO VERDE UNITS 1,2,3B33.-6RVSO B 3.3.6-16 REVISION g ESFAS Logic and Manual Trip B 3.3.6 BASES ACTIONS C_.1 and C.2 (continued)

/j-channels (ed. change)Both Initiation Logic channel n the same trip leg will de-energize if a matrix pow #supply or vital instrument bus is lost. This will o jn the Actuation Logic contacts, satisfying the Require 'ction to open at least one set of contacts in the affe ued trip leg. Indefinite operation in this condition is because of the difficulty of ensuring the c ]tacts remain open under all conditions.

Thus, the be restored to OPERABLE status within 48 hou .This provides the operator with time to orin accordance take appr ira'te actions and still ensures that any risk with the Risk l' vg~- i n operating with a fai led channel is acceptable.

Informed erating experience has demonstrated that the probability of a random failure of a second channel is low during any Completion Time given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period. If the channel cannot be restored to Program OPERABLE status with 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , Condition E is entered.Of greater concern is the failure of the initiation circuit in a nontrip condition (e.g., due to two initiation relay failures).

With one failed, there is still the redundant contact in the trip leg of each Actuation Logic. With both failed in a nontrip condition, the ESFAS Function is lost in the affected train. To prevent this, immediate opening of at least one contact in the affected trip leg is required.

If the required contact has not opened, as i ndi cated by annunci ati on or trip l eg current lamps, Manual Trip of the affected trip leg contacts may be attempted.

Caution must be exercised, since operating the wrong ESFAS handswitch may result in an ESFAS actuation.

D.1 Condi ti on D applies to Actuati on Logi c.With one Actuation Logic channel inoperable, automatic actuation of one train of ESF may be inhibited.

The remaining train provi des adequate protecti on i n the event of Design Basis Accidents, but the single failure criterion may be violated.

For this reason operation in this condi ti on i s restricted.(conti nued)PALO VERDE UNITS 1,2,3 B3361 EIIN2 B 3.3.6-17 REVISION 2-7 ESFAS Logic and Manual Trip B 3.3.6 BASES ACTI ONS D.1 (continued)

The channel must be restored to OPERABLE status within 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .Operating experience has demonstrated that the probab/i ity of a random failure in the Actuation Logic of the econd train is low during a given 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months period.or in accordance F Failure of a single Initiation Logic channel, matrix with the Risk c Jhannel power supply, or vital instrument bus may open one llnfomed or both contacts in the same trip leg in both Actuation ICompletion Time I Logic channels.

For the purposes of this Specification, i~rogam I the Actuation Logic is not inoperable.

This obviates the Proramneed to enter LCO 3.0.3 in the event of a vital bus, matrix, or initiation channel failure.Each Actuation Logic channel has two sets of redundant power supplies.

The power supplies in each set are powered from different vital instrument buses. Failure of a single power supply or a set of power supplies due to the loss of a vital instrument bus, does not affect the operation of the Actuation Logic because the redundant power supplies can supply the full system load. For the purposes of this specification, the Actuation Logic is not inoperable.

Required Action D.1 is modified by a Note to indicate that one channel of Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Surveillance, provided the other channel is OPERABLE.This allows performance of a PPS CHANNEL FUNCTIONAL TEST an OPERABLE ESFAS trai.n without generating an ESFAS actuation in the inoperable train.on~IInsert and[E~~1 LJ~If the Required Actions and associated Completion Times of Conditions for CSAS, MSIS or AFAS cannot be met, the plant must be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.(continued)

PALO VERDE UNITS 1,2,3B336-8RVSO B 3.3.6-18 REVISION Insert for page B 3.3.6-18 E.1 With two Actuation Logic channeis inoperabie, the Required Action is to restore at least one channel to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one channel. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second Actuation Logic channel is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one Actuation Logic channel is inoperable for any reason and a second Actuation Logic channel is found to be inoperable, or if two Actuation Logic channels are found to be inoperable at the same time.

ESFAS Logic and Manual Trip B 3.3.6 (conti nued)If the Required Actions and associated Completion Times for SIAS, CIAS, or RAS are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . If the Required Actions and associated Completion Times for SIAS, CIAS, or RAS Matrix Logic are not met this Action may be exited when the plant is brought to MODE 4 since the LCO does not apply in MODE 4. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challIengi ng pl ant systems.SURVEILLANCE SR 3.3.6.1 REQU IREMENTS A CHANNEL FUNCTIONAL TEST is performed to ensure the entire channel will perform its intended function when needed.The CHANNEL FUNCTIONAL TEST is part of an overlapping test sequence similar to that employed in the RPS. This sequence, consisting of SR 3.3.5.2, SR 3.3.6.1, and SR 3.3.6.2, tests the enti re ESFAS from the bistable input through the actuation of the individual subgroup relays.These overlapping tests are described in Reference 1.SR 3.3.5.2 and SR 3.3.6.1 are normally performed together and in conjunction with ESFAS testing. SR 3.3.6.2 verifies that the subgroup relays are capable of actuating their respective ESF components when de-energized.

These tests verify that the ESFAS is capable of performing its intended function, from bistable input through the actuated components.

SR 3.3.5.2 is addressed in LCO 3.3.5.SR 3.3.6.1 includes Matrix Logic tests and trip path (Initiation Logic) tests, and Manual Actuation Tests.(conti nued)PALO VERDE UNITS 1,2,3 B3361 EIIN~B 3.3.6-19 REVISION Pressurizer B 3.4.9 or in accordance with the Risk Informed (~ArnnI~tinn Tim~BASES ACT](IONS B.1 IProgram -- \*conti nued) -If one required group of pressurizer h laters is inoperable, restoration is required within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using normal station powered heaters. D I required grou of pressurizer heaters ioeable Dand cannot be restored within the allowed Completion Time e#

,,Act,^on B.1,P the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power in an orderly manner and without challenging safety systems. Similarly, the Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 4 from full power in an orderly manner and without challenging plant systems.SURVEILLANCE REQUIREMENTS SR 3.4.9.1 This Surveillance ensures that during steady state operation, pressurizer water level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.(continued)

PALO VERDE UNITS 1,2,3B3495REION 6 B 3.4.9-5 REVISION Insert for page B 3.4.9-5 03.1 With two required groups of pressurizer heaters inoperable, the Required Action is to restore at least one required group of pressurizer heaters to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain this safety function, prior to initiating actions to place the plant in a MODE or other specified condition in which the LCO does not apply. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second required group of pressurizer heaters is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service.The Required Action is only applicable if one required group of pressurizer heaters is inoperable for any reason and the second required group of pressurizer heaters is found to be inoperable, or if two required groups of pressurizer heaters are found to be inoperable at the same time.

Pressurizer Safety Valves-MODES 1, 2, and 3 B 3.4.10 BAS ES APPLICABILITY (continued)

The requirements for overpressure protection in other MODES are covered by LCO 3.4.11, "Pressurizer Safety Valves-MODE 4," and LCO 3.4.13, "LTOP System." The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition.

Only one valve at a time will be removed from service for testing. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months exception is based on 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each of the four valves.The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from operating experience that hot testing can be performed within this timeframe.

Ior in accordance with the Risk Informed ACTIONS ICompletion Time Program I\With one pressurizer safety valv~linoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS overpressure protection system. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the RCPB.B.1 and B.2 If the Required Action cannot be met within the required Completion Time or if two or more pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed is reasonable, based on operating experience, to reach MODE 3 from full power without challenging plant systems.Similarly, the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed is reasonable, based on operating experience, to reach MODE 4 without challenging plant systems.(conti nued)PALO VERDE UNITS 1,2,3B34103RVSO B 3.4.10-3 REVISION 0 Pressurizer Vents B 3.4.12 BASES LCO A vent path is flow capability from the pressurizer to the (continued)

ROT or from the pressurizer to containment atmosphere.

Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable.

A pressurizer vent path is required to depressurize the RCS in a SGTR design basis event which assumes LOP and APSS unavailable.

APPLICABILITY In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the four pressurizer vent paths are required to be OPERABLE.The safety analysis for the SGTR with LOP and a Single Failure (loss of APSS) credits a pressurizer vent path to reduce RCS pressure.In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the SGs are the primary means of heat removal in the RCS, until shutdown cooling can be initiated.

In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia, assuming the APSS is not available, the pressurizer vent paths are the credited means to depressurize the RCS to Shutdown Cooling System entry conditions.

Further depressurization into MODE 5 requires use of the pressurizer vent paths. In MODE 5 with the reactor vessel head in place, temperature requirements of MODE 5 (< 210°F) ensure the RCS remains depressurized.

In MODE 6 the RCS is depressurized.

ACTIONS A.1 If two or three pressurizer vent paths are inoperable, they must be restored to OPERABLE status. Loss of any single valve in the pressurizer vent system will cause two flow paths to become inoperable.

Any vent path that provides flow capability from the pressurizer to the ROT or to the containment atmosphere, independent of which train is powering the valves in the flow path, can be considered an operable vent path. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable because there is at least one pressurizer vent path that remains OPERABLE.Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B341- EIIN4 B 3.4.12-3 REVISION 48 Pr Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program."essuri zer Vents B 3.4.12 BASES ACTIONS (conti nued)If all pressurizer vent path ae1prable, then restore at least one pressurizer vent path to PERABLE status. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable-to allow time to correct the situation, yet emphasize the ifpo rtance of restoring at least one pressurizer vent path. If at least one pressurizer vent path is not restored to OPERABLE within the Completion Time, then Action C is entered.C.1 If the required Actions, A and B, cannot be met within the associated Completion Times, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and to MODE 4 with RCS pressure < 385 psia within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red pl ant condi ti ons from fullI power condi ti ons in an orderly manner without challIengi ng pl ant systems.SURVEILLANCE REQU IREMENTS SR 3.4.12.1 SR 3.4.12.1 requires complete cycling of each pressurizer vent path valve. The vent valves must be cycled from the control room to demonstrate their operability.

Pressurizer vent path valve cycling demonstrates its function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6. In any Mode, partial surveillance tests can be performed for post-maintenance testing under site procedural controls that ensure the valve being tested is isolated from RCS pressure.SR 3.4.12.2 SR 3.4.12.2 requires verification of flow through each pressurizer vent path. Verification of pressurizer vent path flow demonstrates its function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This surveillance test must be performed in Mode 5 or Mode 6.(conti nued)REVISION ~PALO VERDE UNITS 1,2,3 B341-B 3.4.12-4 Insert for page B 3.4.12-4 (Second paragraph for Action B. 1)The Condition is modified by a Note stating the Risk Informed Completion Time is not applicable when the last vent path is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service.The Required Action is only applicable if three pressurizer vent paths are inoperable for.any reason and the last vent path is found to be inoperable, or if all pressurizer vent paths are found to be inoperable at the same time.

SITs-Operati ng mainain uberticaityor minimumcoroancpecipithtatiotim maybeEeduedbutth reducmed Conentrtion efcso aditin the voolumonenrto of the SIT is stil aviable inetion.I msine rthred boon rPEquRABEmentats arebasdin t2heur average boron concentration inof wtheitta vlumets ofiit thre maSintai webreintavilablet for minjcimuoon.

Thuspi72thour tise mallwe to return, u the bronce concentration tofitineimts.o Ifone sITcristinoeablet duein telod the minabltor verlinofy level orC prtessren the SITe mustibe returned toopenrablesh dooniscusses saurvtei d requiremetsa rmins technical e I spjecifctions Sic the iornstreuirmentchnes urbsed in the measurtemcnsqento satre lesssveladpesre ihn StsThey ol ei folloIng swteenot avisadlefo injSection7.4 ofus N2hurEGis6 orowd o inr te accordancein owihi lmis with heIRik"Te combinationoferabedundato level andblt pressure inst r resumentto

[frayhige SIT]msertre may operovide Informedssessufficentinfo6rmatioemnsotha itnmaycntcbe sroera assocatedn oe instrument

[wihanrelsultdingth theasremweresufficientltel tod prepairoe in thesevent floings<trumentis doano iniat aSaetaction,74o itRE-is6 caseordnc whrIOeacmltr[ST sioealu with the Rito I "The cminoeabityo of weunante level and pressure Inforchannes,'metaion which the completionTtimey toresorieth Wh ufietchnticfrallyionsoprbe theaccutmuat or woldb Copltin im I wothwimead thus thias cangemp woul havrec adegigibl increasee sfincisk." e orparoe nte vn thata scon onebecme nopeabl. (conti nuede PALO VERDE UNITS 1,2,3B351-REION.

B 3.5.1-7 REVISION BASES ACTIONS SITs-Operati ng ior in accordance B 3.5.1 Iwith the Risk"" Ilnformed--

-Completion Time If one SIT is inoperable for a reason other than concentration or the inability to verify level or the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .In this Condition, the required contents of three SITs cannot be assumed to reach the core during a LOCA.IInsert[ACTI ONS DB.1 and D.2 CE NPSD-994 (Ref. 6) provides a series of deterministic and probabiIi stic findings that support 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months as being either"risk beneficial" or "risk neutral" in comparison to shorter periods for restoring the SIT to OPERABLE status. CE NPSD-994 (Ref. 6) discusses best-estimate analysis for a typical PWR that confirmed that, during large-break LOCA scenarios, core melt can be prevented by either operation of one low pressure safety injection (LPSI) pump or the operation of one high pressure safety injection (HPSI) pump and a single SIT. CE NPSD-994 (Ref. 6) also discusses plant-specific probabilistic analysis that evaluated the risk-impact of the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months recovery period in comparison to shorter recovery periods.C 1landCP2 SIf the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 1837 psia within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red pl ant conditions from fullI power conditions in an orderly manner and without challenging plant systems.Specification 3.5.2, "SITs -Shutdown", further requires the plant to be in Mode 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if the SIT i noperabiIi ty was discovered but not restored while in the appl icabiIi ty of Speci fi cati on 3.5.1, "SITs -Operating".

D.1 If more than one SIT is inoperable, thc unit is in a condition outside the accid~t analyses.

~I Pn 0 ~J.Reviewer's note: the TSTF Bases state that this Condition is only applicable to plants that have not adopted a RICT Program.(conti nued)PALO VERDE UNITS 1,2,3 B3518RVSO B 3.5.1-8 REVISION 1 Insert for page B 3.5.1-8 C.1 With two or more SITs inoperable, the Required Action is to restore all but one SIT to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain this safety function.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of sufficient SITs to regain safety function.

Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when two or more SITs are intentionally made inoperable.

The Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one SIT is inoperable for any reason and additional SITs are found to be inoperable, or if two or more SITs are found to be inoperable at the same time.

or in acci Risk Info Completi BASES Proaram EGGS -Operating B 3.5.3 ACTIONS A.1 Condition A addresss the specific condition where the only affected EGGS subsys em is a single LPSI subsystem.

The availability of at le, st 100% of the EGGS flow equivalent to a single OPERABLE EGGS train is implicit in the definition of Condition A. \If LCO 3.5.3 requirements are not met due only to the existence of Condition A,\then the inoperable LPSI subsystem components must be to OPERABLE status within 1 days of discovery of Condition This 7 day Completion Time is based on the findings of the determini sti c and probabiIi stic analysis that are discussed in Reference

6. Seven days is a reasonable amount of time to perform many corrective and preventative maintenance items on the affected LPSI subsystem.

Reference 6 concluded that the overall risk impact of this Completion Time was either risk-beneficial or risk-neutral.

The Configuration Risk Management Program (CRMP) in TRM Secti on 5.0. 500.19 appl ies when Condi ti on A i s entered.B.- 1 Completion Time Program If one or rere EGGS trains are inoperable, except for reasons ot er than Condition A (one LPSI subsystem inoperable/, and at least 100% of the EGGS flow equivalent to a sing e OPERABLE EGGS train is available, the inoperable componen is must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC study (Ref. 4) using a reliability evaluation and is a reasonable amount of time to effect many repairs.An EGGS train is inoperable if it is not capable of delivering the design flow to the RCS. The individual components are inoperable if they are not capable of performing their design function, or if supporting systems are not available.(conti nued)PALO VERDE UNITS 1,2,3 B3536RVSO B 3.5.3-6 REVISION EGGS -Operating B 3.5.3 BASES ACTIONS B.1 (continued)

The LCO requires the OPERABILITY of a number of independent subsystems.

Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the EGGS incapable of performing its function.

Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the EGGS. The intent of this Condition is to maintain a combination of OPERABLE equipment such that 100% of the EGGS flow equivalent to 100%of a single OPERABLE train remains available.

This allows increased flexibility in plant operations when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an emergency DO can disable one EGGS train until power is restored.

A reliability analysis (Ref. 4) has shown that the impact with one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .With one or more components inoperable, such that 100% of the equivalent flow to a single OPERABLE EGGS train is not available, the facility is in a condition outside the I eneed .1 .2 ndD3accident analyses.

Therefore, LCO 3.0.3 must be immediately If the inoperable train cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to< 1837 psia and RCS Tc reduced to < 485°F within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems.(conti nued)PALO VERDE UNITS 1,2,3 B3537RVSO B 3.5.3-7 REVISION 2 Insert for page B 3.5.3-7 c__1 Condition C is applicable with one or more trains inoperable for reasons other than Condition A. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available.

With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses and flow must be restored to 100% of the ECCS flow equivalent to a single OPERABLE ECCS train within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time, or a Completion Time determined under the Risk Informed Completion Time Program. The Completion Time is based on the need to restore the ECCS flow to within the safety analysis assumptions.

The Condition is modified by a Note stating it is not applicable when the second ECCS train is intentionally made inoperable.

The Required Actions are not intended for voluntary removal of redundant systems or components from service. The Required Actions are only applicable if one ECCS train is inoperable for any reason and the second ECCS train is found to be inoperable, or if two ECCS trains are found to be inoperable at the same time.

RWT B 3.5.5 BASES LCO The RWT ensures that an adequate supply of borated water is available to cool and depressunize the containment in the event of a Design Basis Accident (DBA) and to cool and cover the core in the event of a LOGA, that the reactor remains subcritical following a DBA, and that an adequate level exists in the containment sump to support ESF pump operation in the recirculation mode.To be considered OPERABLE, the RWT must meet the limits established in the SRs for water volume, boron concentration, and temperature.

APPLICABILITY In MODES 1, 2, 3, and 4, the RWT OPERABILITY requirements are dictated by the EGGS and Containment Spray System OPERABILITY requirements.

Since both the EGGS and the Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWT must be OPERABLE to support their operation.

Gore cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RGS Loops -MODE 5, Loops Filled," and LGO 3.4.8,"RGS Loops -MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Shutdown Cooling (SOC) and Coolant Circulation

-High Water Level ," and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation

-Low Water Level." ACTIONS A.1 With RWT boron concentration or borated water temperature not within limits, it must be returned to within limits within 8 In this condition neither the EGGS nor the Containment Sp ,System can perform their design functions; therefore, prompt ction must be taken to restore the tank to OPERABLE conditio The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to restore the T to within limits was developed considering the time req' ired to change boron concentration or temperature and that th'ck contents of the tank are still available for injection and ,<re cooling.or in accordance with the Risk Informed Completion Time Program (conti nued)PALO VERDE UNITS 1,2,3 B3551RVSO B 3.5.5-7 REVISION RWT B 3.5.5 or in accordance with the Risk Informed Compietion Time Program I-BASES ACTI ONS (conti nued)B.1 With RWT borated water volume not withi\ limits, it must be returned to within limits within 1 hou r. In this condition, neither the EGGS nor Containment Spray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the unit in a MODE in which these systems are not required.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWT to OPERABLE status is based on this condition since the contents of the tank are not available for injection and core cooling.C.1 and C.2 If the RWT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.SURVEILLANCE REQU IREMENTS SR 3.5.5.1 RWT borated water temperature shall be verified to be within the limits assumed in the accident analysis.

The Surveill ance Frequency i s controllIed under the Surveill ance Frequency Control Program.The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures are within the operating temperature limits of the RWT. With ambient temperatures within this range, the RWT temperature should not exceed the limits.(conti nued)PALO VERDE UNITS 1,2,3B355-REION 6 B 3.5.5-8 REVISION Containment Air Locks Requi red Action C.2 requires that one door in the affected containment air lock must be verified to be close .This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Comple, ion Time.This specified time period is consistent with the ACTIONS of LCO 3.6.1, which requires that containment be res ~ored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .Additionally, the affected air lock(s) must be ored to OPERABLE status within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The specified time period is considered reasonable for restoring an inoperable air lock to OPERABLE status, assuming that at least one door is maintained closed in each affected air lock.D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from fullI power conditions in an orderly manner and without challIengi ng pl ant systems.SURVEILLANCE SR 3.6.2.1 REQU I REMENTS Mai ntai ni ng contai nment air locks OPERABLE requires compl iance with the leakage rate test requirements of the Containment Leakage Rate Testing Program. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance cri teri a were establ ished during i niti al ai r lock and containment OPERABILITY testing. The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall containment leakage rate. The Frequency is required by the Containment Leakage Rate Testing Program and includes testing of the airlock doors following each closing, as specified.(continued)

PALO VERDE UNITS 1,2,3 B3627RVSO B 3.6.2-7 REVISION Containment Isol ati on Valves B 3.6.3 BASES ACTIONS A.li and A.2 (conti nued)In the event one required containment isolation valve in one or more penetration flow paths is inoperable except for purge valve leakage not within limit (refer to Action D),the affected penetration flow path must be isolated.

The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that mleet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic valve), a blind flange, and a check valve with flow through the valve secured. Compl iance with this Acti on is established via : 1) Administrative controls (i.e., permit) on the de-acti vated automatic valve, closed manual valve, bl ind flange, or check valve, and 2) Administrative controls (i .e. , permit or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located within the containment penetration.

Instruments (i .e. , flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop porti on of the associated penetrati on: therefore, i sol ati on valves associated with instruments meeting this criteria need not be isolated nor otherwise admini strati vely controllIed to comply with the requirements of this Action. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment.

Requi red Action A. 1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering tl" time required to isolate the penetration and the relativ# importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.For affected penetration floW paths that cannot be restored to OPERABLE status within the\4 hour Completion Time and that have been i sol ated in accordan e with Requi red Action A. 1, the affected penetration flow must be verified to be isolated on a periodic basis. lhis is necessary to ensure that containment penetrations re ui red to be isolated fol lowi ng an accident and no lon ~er capable of being automatically isolated will be in the isolation position or in accordance with the Risk Informed Completion Time IProgram (conti nued)PALO VERDE UNITS 1,2,3 B3631 EIINA B 3.6.3-10 REVISION 4-3 Containment Isolation Valves B 3.6.3 should an event occur. Th s Required Action does not require any testing or device mani ~ul ation. Rather, it involves verification, through a sy stern walkdown, that those isolation devices outside contai nmen t and capable of being mispositioned are in the position.

The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as"prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the i sol ati on devices and other admi ni strati ve control s that wiIll ensure that isolation device misalignment is an unlikely possi bili ty.Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides appropri ate actions.Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Al lowi ng veri fi cati on by administrati ve means i s considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4 B 3.6.3-11 REVISION 4-3 Contai nment Isol ati on Valves B 3.6.3 Ior in accordance with the Risk Informed Completion Time BASES IProgram i-!ACTI ONS (conti nued)B.I1o With two requi red containment isol ation valves in oe or more penetration flow paths inoperable except for purge leakage not within limit *(refer to Action D), the a ected penetration flow path must be isolated within 1 hou .The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic valve), and a blind flange. Compliance with this Action is established via: 1) Administrative controls (i.e., permit)on the de-activated automatic valve, closed manual valve, or blind flange, and 2) Administrative controls (i.e., permit or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located wi thin the containment penetration.

Instruments (i.e., flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetrati on; therefore, i sol ati on val ves associated with instruments meeting this criteria need not be isolated nor otherwise administratively controlled to comply with the requirements of this Action. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1. In the event the affected penetration i s isolated i n accordance with Requi red Action B.1, the affected penetration must be verified to be i sol ated on a periodic basis per Requi red Acti on A.?2, which remains in effect. This periodic veri fi cati on i s necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated.

The Completion Time of once per 31 days for verifying each affected penetration flow path i s isolated i s appropri ate considering the fact that the valves are operated under admi ni strati ve control s and the probabiIi ty of their misalignment is low.Condi ti on B i s modi fi ed by a Note i ndi cati ng thi s Condi tion is only applicable to penetration flow paths with two containment i sol ation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4 B 3.6.3-12 REVISION 4-3 Containment Isolation Valves B 3.6.3 BASES ACTIONS (conti nued)C.1 and C.2 With one or more required penetration flow paths with one containment isolation valve inoperable, the inoperable valve_______________must be restored to OPERABLE status or the affected Altenatvel, apenetration flow path must be isolated.

The method of Alterntivel, a \ isolation must i ncl ude the use of at least one isolation Completion Time barrier that cannot be adversely affected by a single active can be determined

\failure.

Isolation barriers that meet this criterion are a in accordance with and de-activated automatic valve, a closed manual the Risk Informed v lye (including a de-activated non-automatic valve), and a Completion Time bli id fl ange. Compl iance with thi s Acti on i s established Program.via:

1) Administrative controls (i.e., permit) on the Program.de-actvkated automatic valve, closed manual valve, or blind flange a d 2) Administrative controls (i .e., permit or Locked Valve/Bre er/Component Control lock) on vents, drains, and test connec ions located within the containment penetration.

Instruments (1.e., flow/pressure transmitters) located within the penetratioi that are not removed from service for maintenance nor en to the atmosphere are considered a closed loop portio of the associated penetration; therefore, i sol ati on valves as ci ated with instruments meeting this criteria need not be Xolated nor otherwise administratively controlled to comply WI ~h the requirements of this Action. A check valve may not be u d to isolate the affected pentaion.

eured Act qn C.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation folowig iolaio boundary and the relative importance of supporting Ifolowng soatin iXcontainment OPERABILITY during MODES 1, 2, 3, and 4. In the\event the affected penetration is isolated in accordance withAction C.1, the affected penetration flow path must b verified to be isolated on a periodic basis. This is nece ssary to assure leak tightness of containment and that cont inment penetrations requiring isolation following an accide are isolated.

The Completion Time of once per 31 day, for verifying that each affected penetration flow path is isolated is appropriate considering the valves are operated under administrative controls and the probability of their misalignment is low.Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The only credited closed systems are the Steam Generating and the Containment Pressure Monitoring Systems.This Note is necessary since this Condition is (conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4 B 3.6.3-13 REVISION 4-3 Contai nment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued) written to specifically address those penetration flow paths which are neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere (10 CFR 50, APP. A, GDC 57).Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means i s considered acceptabl e, since access to these areas is typically restricted.

Therefore, the probability of misalignment of these valves, once they have been verified to be in the proper position, is small.D.1, 0.2, and 0.3 In the event one or more required containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within limits, or the affected penetration must be isolated.

The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active fai lure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve with resilient seals, or a blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.1 must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. Compl iance with this Acti on i s establ ished via : 1) Admi nistrati ve control s (i .e., permit) on the de-activated automatic valve with resilient seals or blind flange, and 2) Administrative controls (i .e., permit or Locked Valve/Breaker/Component Control lock) on vents, drains, and test connections located within the containment penetration.

Instruments (i.e., flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open oL the atmosphere are considered a closed loop portion of ated penetrati on ; therefore, i sol ation valves associ ate th instruments meeting this cri teri a need not be i sol ated no- se admi ni strati vely controllIed to comply with the req ents of this Action. The specified Completion Time is considering that one cotimntpre valeremains se so that a gross breach of containment does not (conti nued)IAlternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.PALO VERDE UNITS 1,2,3 B3631 EIIN4 B 3.6.3-14 REVISION 4-3 Containment Isolation Valves B 3.6.3 BASES ACTIONS D.1, D.2 and D.3 (continued)

In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis.The periodic verification is necessary to ensure that containment penetrations requi red to be isolated fol lowing an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve mani pul ati on. Rather, i t i nvol ves veri fi cati on, through a system wal kdown, that those isolation devices outside containment capable of being mispositioned are in the correct position.

/-following isolation For the isolation devices inside contaynment, the time period specified as "prior to entering MODE from MODE 5 if not performed within the previous 92 daysv is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility, ifollowing isolationl For the required containment purge valve with a resilientJ seal that i s i sol ated in accordance with Requi red Acti on/D. 1, SR 3.6.3.6 must be performed at least once every 92 This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase during the time the penetration is isolated.

The normal Frequency for SR 3.6.3.6, 184 days, is based on an NRC initiative, Generic Issue B-20 (Ref. 3). Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days chosen and has been shown to be acceptable based on ope'r tng experience.

E. 1 and E .2 .following isolation If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red p1 ant conditions from fullI power condi ti ons i n an orderly manner and without challenging plant systems.(conti nued)PALO VERDE UNITS 1,2,3 B3631 EIIN4 B 3.6.3-15 REVISION 4-3 Containment Spray System B 3.6.6 BASES LCO (conti nued)containment spray actuation signal and automatically transferring suction to the containment sump on a reci rcul ati on actuati on signal .Each spray train flow path from the containment sump shall be via an OPERABLE shutdown cooling heat exchanger.

Therefore, in the event of an accident, the minimum requirements are met, assuming that the worst case single active failure occurs.Each Containment Spray System typically includes a spray pump, a shutdown cooling heat exchanger, spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWT upon an ESF actuation signal and automatically transferring suction to the containment sump.APPLICABILITY In MODES 1, 2, and 3, and Mode 4 with RCS pressure 385 psia, a DBA could cause a release of radioactive material to containment and an increase in containment pressure and temperature, requiring the operation of the containment spray trains.In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray System is not required to be OPERABLE in these MODES.ACTIONS A.1 With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE spray train is to perform the iodine removal, hydrogen mixing, and containment cooling functions.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completi n Time takes into account the redundant heat removal cap bility afforded by the Containment Spray System, time for repairs, and the low probability of a DBA during this period.or in accordance with the Risk Informed Completion Time Program (continued)

PALO VERDE UNITS 1,2,3 B3665RVSO B 3.6.6-5 REVISION Containment Spray System B 3.6.6 BASES ACTIONS (conti nued)SInsertI B.1 and 32 If the inoperable containment spray train cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 with RCS pressure < 385 psia within 84 hours9.722222e-4 days 0.0233 hours 1.388889e-4 weeks 3.1962e-5 months . The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The extended interval to reach MODE 4 with RCS pressure < 385 psia allows additional time for the restoration of the containment spray train and is reasonable when considering that the driving force for a release of radioactive material from the Reactor Coolant System is reduced in MODE 3.Reviewer's note: the TSTF Bases state that this Condition is onlyl applicable to plants that have not adopted a RICT Program. I GA LCi.. mutbincc mid~cy SURVEILLANCE REQU IREMENTS SR 3.6.6.1 Verifying the correct alignment for manual, power operated, and automatic valves in the containment spray flow path provides assurance that the proper flow paths will exist for Containment Spray System operation (positioned to take suction from the RWT on a containment spray actuation test signal [CSAS]). This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to being secured. This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation.

Rather, it involves verifying, through a system walkdown, that those valves outside containment and capable of potentially being mispositioned are in the correct position.

The Surveillance Frequency i s controllIed under the Surveill ance Frequency Control Program.(continued)

PALO VERDE UNITS 1,2,3B3.6-REION 6 B 3.6.6-6 REVISION Insert for page B 3.6.6-6 c3.1 With two containment spray trains inoperable, the Required Action is to restore at least one containment spray train to OPERABLE status within one hour to regain some capability to perform iodine removal, hydrogen mixing, and containment cooling functions.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when two containment spray trains are intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one containment spray train is inoperable for any reason and a second containment spray train is found to be inoperable, or if two containment spray trains are found to be inoperable at the same time.D.1 and D.2 If the Required Action and associated Completion Time of Condition C of this LCO is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

MS IVs Alternately, the Completion Time can be determined in accordance with the Risk IB 3.7 .2 Informed Completion Time Program.I BASES (continued)

K ACTIONS (conti nued)[.1 (continued) or more MSIVs inoper erble while in MODE 1 requires entry into LCO 3.0.3.F.1 With one MSIV inoperable

n MODE 1, time is allowed to restore the component to 0 ERABLE status. Some repairs can be made to the MSIV with unit hot. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonabl , considering the probability of an accident occurring duni~ the time period that would require closure of the MSIVs." Condition F is entered when one MSIV is inoperable in MODE 1, including when both actuator trains for one MSIV are inoperable.

When only one actuator train is inoperable on one MSIV, Condition A applies.The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that normally allIowed for containment isol ati on valves that i sol ate a closed system penetrating containment.

These valves differ from other containment isol ati on valves in that the closed system provides an additional means for containment i sol ati on.If, the MSIV cannot be restored to OPER Ewtin 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the unit must be placed in a MODE in w ich the LCO does not apply. To achieve this status, the must be placed in MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and Condition would be entered. The Completion Time is reasonable, based on operating experience, to reach MODE 2, and close the MSIVs in an odrymanner and without challenging unit systems. Codition *smdfied by a Note indicating that separate Condition entry is allowed for each MSIV.Since the MSIVs are required to and 3, the inoperable MSIVs may OPERABLE status or closed. Wher already in the position requirec safety analysis.be OPERABLE in MODES 2 either be restored to I closed, the MSIVs are Jby the assumptions in the (conti nued)PALO VERDE UNITS 1,2,3 B3727RVSO B 3.7.2-7 REVISION Insert for page B 3.7.2-7 G..._With two or more MSIVs inoperable, the Required Action is to restore all but one MSIV to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of main steam line isolation.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of sufficient required MSIVs. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when two or more MSIVs are intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one MSIV is inoperable for any reason and additional MSIVs are found to be inoperable, or if two or more MSIVs are found to be inoperable at the same time.

MS IVs B 3.7.2 ACTIONS and H (continued)(continued)

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is consistent with that allowed in Condition F.Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must be verified on a periodic basis to be closed. This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgment, MSIV status indications availIable in the control room, and other administrative controls, to ensure these valves are in the ti on.*1and If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must be placed in a MODE in which the LCD does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .The allowed Completion Times are reasonable, based on operating experience, to reach the requi red unit conditions from MODE 2 conditions in an orderly manner and without challIengi ng unit systems.SURVEILLANCE SR 3.7.2.1 REQU IREM ENTS This SR verifies that the closure time of each MSIV is within the limit given in Reference 5 with each actuator train on an actual or simulated actuation signal and is within that assumed in the accident and containment analyses.

This SR also verifies the valve closure time is in accordance with the Inservice Testing Program. This SR is normally performed upon returning the unit to operation following a refueling outage. The MSIVs should not be full stroke tested at power.The Frequency for this. SR is in accordance with the Inservice Testing Program. This Frequency demonstrates the valve closure time at least once per refueling cycle.(continued)

PALO VERDE UNITS 1,2,3B372-REION4 B 3.7.2-8 REVISION MFIVs B 3.7.3 BASES (continued)

APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam generators.

This ensures that, in the event of an HELB, a single failure cannot result in the blowdown of more than one steam generator.

In MODES 1, 2, 3, and 4, the MFIVs are required to be OPERABLE, except when they are closed and deactivated or isolated by a deactivated and closed power operated valve, in order to limit the amount of available fluid that could be added to containment in the case of a secondary system pipe break inside containment.

When the valves are closed or isolated by a closed power operated valve, they are al ready performing thei r safety functi on.In MODES 5 and 6, steam generator energy is low. Therefore, the MFIVs are not required.ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each penetration flow path.A. ! and ,Insertthe inoperable v-alv-es w.ithin 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . When these valves are closed or isolated, they are performing their required safety function (e.g., to isolate the line).The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and the low probability of an event occurring during this time__period that would require isolation of the MFW flow paths.IA.2.1" In ~ra le MFIVs that are closed to comply with Required Action .must be verified on a periodic basis to be reasonable closed. This is necessary to ensure that the assumptions in (editorial) afety. analysis remain valid. The day completion tmisbased on engi in judge .t, MFIV status indications availabl li he control room and other administrative contro , ensure these valves ire in the Ifollowing isolation

-(conti nued)PALO VERDE UNITS 1,2,3 B 3.7.3-3 REVISION Insert for page B 3.7.3-3)A.1, A.2.1, and A.2.2 With one or more MFlIVs inoperable, action must be taken to restore the MFlIV(s) to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or in accordance with the Risk Informed Completion Time Program OR to close or isolate the inoperable valves within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

MFl Vs B 3.7.3 (conti nued)..f..ore.th.n.one........n..h...ame.flo.

path cannot be operate au-tomatically and perform the required safety path isolate within 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ... This actio returns th sys temn to th condtio where... at lea. t one valve in each 8 hou-r Completion Time is reasonable to close an MFIV or Inoperable MFIVs that cannot be restored to OPERABLE status within the Completion Time, but are closed or isolated, must be verified on a periodic basis that they are closed or isolated.

This is necessary to ensure that the assumptions in the safety analysis remain valid. The 7 day Completion Time is reasonable, based on engineering judgme #, in view of valve status indications availIable in the co trol room, and other administrative controls to ensure tha these valves are closed or isolated.l Ifollowing isolation C.1 and C.2 If the MFIVs cannot be restored to OPERABLE status, closed, or isolated in the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .The allowed Completion Times are reasonable, based on operating experience, to reach the requi red unit conditions from full power conditions in an orderly manner and without challenging unit systems.(continued)

PALO VERDE UNITS 1,2,3 B3734RVSO B 3.7.3-4 REVISION Insert for page B 3.7.3-4 B.1. B.2.1, and B.2.2 With two valves in the same flow path inoperable, action must be taken to restore one valve to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or in accordance with the Risk Informed Completion Time Program OR isolate the affected flow path. If more than one MFIV in the same flow path cannot be restored to OPERABLE status, then there may be no system to operate automatically and perform the required safety function.

Under these conditions, valves in each flow path must be roetored to OPER.ABLE statu-s, closed or the flow path isolated within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . This action returns the system to the condition where at least one valve in each flow path is performing the required safety function.The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is reasonable to restore an MFIV to OPERABLE status, or to close an MFIV or otherwise isolate the affected flow path.

Alternately, a Completion Time can be /ADVs determined in accordance with the Risk B 3.7.4 Informed Completion Time Program.BASES ACTIONS A. 1 The condition for this ACTION is modifi by a Note that states separate Condition entry is alloyed for each SG.This is acceptable because only one SG is required for RCS heat removal after a design basis accid, nt, and because this Condition provides the appropriate Required Action and Completion Time for one inoperable ADV l ne on each SG.With one ADV line on a SO inoperable, ac ion must be taken to restore that ADV line to OPERABLE sta us within 7 days to meet the LCO for each SG that has red this Condition.

The 7-day Completion Time tales into consi derati on the redundant capabi li ty a iforded by the remaining OPERABLE ADV lines, the safety grade MSSVs, and the non-safety grade backup of the SBCS.y B.1 With two or more ADV lines inoperable with both ADV i nes inoperable on one or more SGs, action must be taken to restore one ADV line on each SG to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable to repair inoperable ADV i nes, based on the availIabi li ty of the Steam Bypass Control System and MSSVs, and the low probability of an event occurring during this period that requires the ADV* lines.Ilnsert NOTE : Entry Condition B for all four ADV lines simultaneously is not intended for voluntary removal of redundant systems or components from service in lieu of other alte natives that would not result in redundant systems or being inoperable.(conti nued)PALO VERDE UNITS 1,2,3 B3745RVSO B 3.7.4-5 REVISION Insert for page B 3.7.4-5 (Second paragraph for Action B. 1)The Condition is modified by a Note stating the Risk Informed Completion Time is not applicable when all ADVs are intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two or more ADV lines are found inoperable with both ADV lines inoperable on one or more SGs and the last ADV line is found to be inoperable, or if all ADV lines are found to be inoperable at the same time.

AFW System B 3.1.5 BASES APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE and to function in the event that the MFW System is lost. In addition, the AFW System is required to supply enough makeup water to replace steam generator secondary inventory, lost as the unit cools to MODE 4 conditions.

In MODE 4, the AFW System may be used for heat removal via the steam generator.

In MODES 5 and 6, the steam generators are not normally used for decay heat removal, and the AFW System is not required.A note prohibits the application of LCD 3.0.4.b to an inoperable AFW Train. There is an increased risk associated with entering a MODE or other specified condition in the applicability with an AFW train inoperable and the provisions of LCD 3.0.4.b which allows entry into a MODE or other specified condition in the Applicability with the LCD not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this ci rcumstance.

/or in accordance with the Risk Informed ACTIONS A. 1 lCompletion Time Program If one of the two s eam supplies to the turbine driven AFW pumps is inoperable, or if a turbine driven pump is inoperable while in MODE 3 immediately following refueling (prior to MODE 2), # tion must be taken to restore OPERABLE status within 7 day .The 1 day Completion Time is reasonable based on the following reasons: a. For the inoperability of a steam supply to the turbine-driven AFW pump, the 1 day Completion time is reasonable since there is a redundant steam supply line for the turbine driven pump.b. For the inoperability of a turbine-driven AFW pump while in MODE 3 immediately subsequent to a refueling outage, the 7 day Completion time is reasonable due to the minimal decay heat levels in this situation.

c. For both the inoperability of a steam supply line to the turbine-driven pump and an inoperable turbine-driven AFW pump while in MODE 3 immediately following a refueling outage, the 7 day Completion time is reasonable due to the availability of redundant OPERABLE motor driven AFW pumps.(continued)

PALO VERDE UNITS 1,2,3B375-REION4 B 3.7.5-5 REVISION 42-AFW System B 3.7.5 BASES ACTIONS TSTF-505 states that it is necessary to adopt TSTF-439,"Eliminate Second Completion Times..." in order to adopt TSTF-505 for those RAs that are affected by both travelers.

APS has submitted an LAR adopting TSTF-439 (ML1 5065A031).

These marked-up pages reflect the deletions that will be made when the TSTF-439 LAR is approved by the NRC.A marginal note of"TSTF-439" will be added where deletions are made to reflect TSTF-439 on the following pages.A.1 (continued)

'Thc sc-.-ond Cor.mpletionr,, Timc. -for Act.ion`v A.1 cst'abihl cs a limit on thc m.ximu tim.c.,- allo....d for ..ny of,.Condition.,,, to bc,'i,"pr.blc during 14.,,4- any-I4, continuous faiur to -m-,.c.,- ct,., thi.,,44,,. Ih 1 dII CII TImI c p. r o%.vIdIc.

s a. 1, im%%i %tation timc#%. , allowed in thiIsr TpcfidCnditionm aftc ,-is,,'vr,,'

of, reazonaDic tor situations in wnicn uonaitions

~ ana b arc 1l" ~,4=1 ,4M,-~.4s-n, +-h 2+ kM`-in T~mne, 2n.1 4-au-~...mu.taneou.ly.

an the... ,orer, titiemutb met.......

.....Condition A is modified by a Note which limits the appl icabiIi ty of the Condi ti on to when the unit has not entered MODE 2 fol lowing a refuel ing. Condition A al lows the turbine-driven AFW pump to be inoperable for 7 days vice the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time in Condition B. This longer Completion Time is based on the reduced decay heat following refuel ing and prior to the reactor being critical.It should be noted that when in this Condition with one steam supply to the turbine driven AFW pump inoperable, that the AFA train of AFW is considered to be inoperable.

B. 1Completion Time Program With one of the /equired rains, pump or fow inoperable, act i/on must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This Condi ti on includes the loss of two steam supply lines to the turbine driven AFW pump. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on the redundant capabilities afforded by the AFW System, the time needed for repairs, and the low probability of a DBA event occurring during this period. Two AFW pumps and flow paths remain to supply feedwater to the steam generators.

1hae~-nr,.,.,,, /""m,'1n4-4n,"', 4:,,,, DP A,,-t4i ,,- R 1 ,- =,.---1-.. -- -.-----~1 4n.4+ an 4kn m,,rv 4 nIufh +4 rnn ~1 ln,.,nrl fnr. ~Vn, r.nrnkn+,nn nf....... n,- 4-h -4.. ... ... ... .... .. A r n -n+ i nm 4 1 u.*;me L mn O v-I ** .** S PP I~AP u*ln n* n .-"lPl_ _ J___.... I- -" ...... "!=2---- ...... 2 J "1 2--2 .L -- .k =" ---- --" -- --i~f~uu~..~iIiL

.S ..... ..... ... ...... ......n... ........"1"I J 2__44.4 ,....saa4

.~. aA f'anA4 4.4 an -..P4.an A4 aiwan., a.F.. J I.P u p t,,....~ .u u I~. SI 5 5 V'-'~t~Cn i na 4, .u mnn4' 4wl.k nI A , Th4,- 14.,.44. 4,-,,.,,.,,,-,.

ap4 a .,,4 I I--2 ..-- 2 ....___ .L .L-" ..L-" L l J -- A m...J f'l~ m,,p T ' ** '. ,__.r.1T~in ,n .I .'r. ri n ,,,at n na ,A iv ,.

T. n hiu.= n kit a. , a. a l ,h n.p Tfl L.:'T:: ='7-:':: : ..... ... ...... ...: :::- .-%:-.;:= : :::::i: .: ::: : .. ..... ... .. ....... 3.(co1nayticaestatinCmpeioeimsapl (continued)

Insert PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 4&PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION Insert for page B 3.7.5-6 0._1 With two AFW trains inoperable in MODE 1, 2, or 3, the Required Action is to restore at least one AFW train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a method of decay heat removal. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one AFW train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second AFW train is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one AFW train is inoperable for any reason and a second AFW train is found to be inoperable, or if two AFW trains are found to be inoperable at the same time.In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO.Although it is not required, the unit may continue to cool down and start the SDC.

AFW System B 3.7.5 BASES ACIN(conti nued) __ ln72 A DWhen either Requi red Acti on A.1 1pB, cannot be compl eted within the required Completion Time, or if t';'o ,AFW, trains; .... unr¢ -unit must be placed inacthe LCOdosntapy Reviewer's note: To achieve this status, the unit must be placed in at least this is deleted in the MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .TSTF asesThis Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply to the turbine driven AFW pump i s i noperabl e, coi ncident with another ("B" or "N") AFW train inoperable.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power condi ti ons i n an orderly manner and wi thout challIengi ng unit systems.Included as last paragraph in new "0.1" above.Tn 1, ,.ith t',.,,- AFW, -trains inopr,-bl-, o,-,rat,-,, i,-11alod 1 ontI1,inu bccausc16 I onlyq. on., e ,AFW pump1 , start thc SDC. i *Reuired Acti on 1 i s modi fi ed by a Note i ndi cati ng that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.Completion Times are also suspended at the time the conditions is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.With all three AFW trains inoperable in MODES 1, 2, and 3.the unit is in a seriously degraded condition with no TS related means for conducting a cooldown, and only limited means for conducting a cooldown with nonsafety grade equipment.

In such a condition, the unit should not be perturbed by any action, including a power change, that might result in a trip. The seriousness of this condition requires that action be started immediately to restore one AFW train to OPERABLE status. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.(conti nued)PALO VERDE UNITS 1,2,3 B3757RVSO B 3.7.5-7 REVISION 9 AFW System B 3.7.5 BASES ACTIONS ___.(c~tinedr~F Required Action- l.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended until one AFW train is restored to OPERABLE status.Completion Times are also suspended at the time the Condition is entered. The Completion Time is resumed with the time remaining when the Condition was entered upon restoration of one AFW train to OPERABLE status.With one AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status or to immediately verify, by administrative means, the OPERABILITY of a second train. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.

In MODE 4, either the reactor coolant pumps or the SDC loops can be used to provide forced circulation as discussed in LCO 3.4.6, "RCS Loops -MODE 4." SURVEILLANCE SR 3.7.5.1 REQU IREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW water and steam supply flow paths provides assurance that the proper flow paths exist for AFW operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulations; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required developed head ensures that AFW pump performance has not degraded during the cycle. Flow and differential head are (conti nued)PALO VERDE UNITS 1,2,3B3.58REION 6 B 3.7.5-8 REVISION BCST B3.7.6 BASES APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the CST is required to be OPERABLE.In MODES 5 and 6, the CST is not required because the AFW System is not required.ACTIONS _AI and _A.? / is inoperablel If the CST level ,is not ,within the limit, the OPERABILITY of the backup water supply (RMWT) must be verified within 4 and nce er 1 '

of the RMWT must include initial alignment and and oce pe 12 verification of the OPERABILITY of flow paths from the RMWT hours thereafter

.to ntvthe AFW pumps, and availability of sufficient total water inventory using the combined CST and RMWT inventories to satisfy the requirements of l ong-term cool ing event which includes both LOCA Long-Term Cooling and Reactor Systems Branch Technical Position 5-1 (RSB 5-1). The CST must be to OPERABLE status within 7 days, as the RMWT m y<e performing this function in addition to its normal Irestored (editorial) functions. 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based' on operatid experience, to verify the OPERABILITY of the RMWT. The 7\day Completion Time is reasonable, based on an OPERABLE RMW being availIable, and the low probabilIity of an event requiriM the use of the water from the CST occurring during this pe iod.\ IAlternately, a Completion Time can be L-Idetermined in accordance with the Risk Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3763RVSO B 3.7.6-3 REVISION 5-5 EW System B 3.7.7 BASES LCO (continued) not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.APPLICABILITY In MODES 1, 2, 3, and 4, the EW System must be prepared to perform its post accident safety functions, primarily RCS heat removal by cooling the SDC heat exchanger.

When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EW System shall be consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its related support function(s).

1or in accordance with the Risk Informed Completion Time Program ACTIONS A.1 Required Action A.1 is modiT Led by a Note indicating the requirement of entry into the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -MODE 4," for SDC made inoperable by EW. This not is only applicable in Mode 4. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these compon ts.With one EW train inoperable, action be taken to restore OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .In this Condition, the remaining OPERABLE EW train is adequate to perform the heat removal function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this period.IInsert2B.1 and/B.2 If the EW train c be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .(conti nued)PALO VERDE UNITS 1,2,3B3.7-RVSO 4 B 3.7.7-3, REVISION Insert for page B 3.7.7-3 B.1 With two EW trains inoperable, the Required Action is to restore at least one of the required EW trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety related components.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train.Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second EW train is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one EW train is inoperable for any reason and a second EW train is found to be inoperable, or if two EW trains are found to be inoperable at the same time.

LW System B 3.7.7 BASES ACTIONS nS2(continued)

Te allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EW flow path provides assurance thatthe proper flow paths exist for LW operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation:

rather, it involves verification that those valves capable of potentially being mispositioned are in their correct position.This SR is modified by a Note indicating that the isolation of the LW components or systems renders those components or systems inoperable but does not necessarily affect the OPERABILITY of the LW System. Isolation of the LW System to the Essential Chiller, while rendering the Essential Chiller inoperable, is acceptable and does not impact the OPERABILITY of the LW System. Isolation of the LW System to the SDC system heat exchanger is not acceptable and would render both the LW System and the SDC system inoperable (Ref. 3). The LW System is inoperable in this situation because it is operating outside of the acceptable limits of the system.The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.SR 3.7.7.2 This SR verifies proper automatic operation of the LW valves on an actual or simulated actuation signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under (conti nued)PALO VERDE UNITS 1,2,3B37.-REION 6 B 3.7.7-4 REVISION ES PS B 3.7.8 BASES ACTIONS A.1 With one ESPS train inoperable, actionA\iust be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE ESPS train is adequate to perform the heat removal function.

However, the overall reliability is reduced because a single failure in the ESPS train could result in loss of ESPS function.

Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions of LCO 3.8.1, "AC Sources -Operating," must be entered when the inoperable ESPS train results in an inoperable emergency diesel generator.

The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops -MODE 4," should be entered if an inoperable ESPS train results in an inoperable SDC System. This note is only applicable in MODE 4. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low[InsertI probability of a DBA occurring during this time period.If the ESPS train ant be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE REQUIREMENTS SR 3.7.8.1 Verifying the correct alignment for manual and power operated, valves in the ESPS flow path ensures that the proper flow paths exist for ESPS operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This (conti nued)PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION Insert for page B 3.7.8-3 B.1 With two ESPS trains inoperable, the Required Action is to restore at least one of the required ESPS trains to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety related components.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration Of at least one train.Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second ESPS train is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one ESPS train is inoperable for any reason and a second ESPS train is found to be inoperable, or if two ESPS trains are found to be inoperable at the same time.

UHS B 3.7.9 BASES LCO The UHS is required to be OPERABLE.

The UHS is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the ESPS to operate for at least 26 days with no makeup following the design basis LOCA without the loss of net positive suction head (NPSH), and without exceeding the maximum design temperature of the equipment served by the ESPS. To meet this condition, the UHS temperature should not exceed 89°F and the level of each ESP should not fall below 12 ft usable water depth during normal unit operation.

Since the bottom 1.5 ft of the ESPS is required to meet pump submergence requirements, an actual depth of 13.5 ft is needed to meet the 26 day requirement for inventory purposes.The 12' is the water volume that would be depleted over 26 days following a design basis LOCA if no makeup were available.

The thermal performance analysis utilizes the entire volume inventory of the pond(s) since the entire volume is always available as a heat sink.APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.When the plant is in other than MODES 1, 2, 3, or 4, the requirements for the UHS shall be consistent with the definition of OPERABILITY, which requires (support)equipment to be capable of performing its related support ACTIONS A-an4 ^ --AI nd .2 Tf ',-e U i ii opT~bethe unit must be placed in a MODE lllfte Reqiredin whi LCO does not apply. To achieve this status, If he equre th /nit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months IAction and I in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times lassociated

--are reasonable, based on operating experience, to reach the ICompletion Time Irequi red uni t condi ti ons from full power condi ti ons 1in an are ot etorderly manner and without challenging unit systems.(conti nued)PALO VERDE UNITS 1,2,3B379-REION4 B 3.7.9-2 REVISION 44 Insert for page B 3.7.9-2 A.1 and A.2 If the UHS is inoperable, the Required Action is to restore the UHS to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months completion time is acceptable because it minimizes risk while allowing time for restoration.

Alternatively, a Completion time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating the Risk Informed Completion Time is not applicable when the UHS is intentionally made inoperable.

The Required Action is not intended for voluntary removal of systems or components from service. The Required Action is only applicable if the UHS is found to be inoperable.

EC System B 3.7.10 P I or in accordance with the RisklIlnformed Completion Time Program BASES APPLICABILITY (conti nued)When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EC System shall .Le consistent with the definition of OPERABILITY which requires (support) equipment to be capable of performing its relate support function(s).

EDITORIAL:

ACTIOS A.1should read EC If one EC train is in erable, action Jst be taken to restore OPERABLE s JTtus within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .In this condition, one OPERABLE is adequate to perform the cooling function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based IInser / on the low probability of an event occurring during this t,,ime and the 100% capacity OPERABLE EC train.3/.1 at least oneI'-' If rain cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.SURVEILLANCE REQU IREMENTS SR 3.7.10.1 Verifying the correct alignment for manual, power operated, and automatic valves in the EC flow path provides assurance that the proper flow paths exist for EC operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since they are verified to be in the correct position prior to locking, sealing, or securing.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct posi ti on.(conti nued)PALO VERDE UNITS 1,2,3 B371- EIIN1 B 3.7.10-3 REVISION Insert for page B 3.7.10-3 B.1 With two EC trains inoperable, the Required Action is to restore at least one train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain a heat sink for safety-related air handling systems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second EC train is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one EC train is inoperable for any reason and a second EC train is found to be inoperable, or if two EC trains are found to be inoperable at the same time.

CREATCS B 3.7.12 BASES (continued)

LCO Two independent and redundant trains of the CREATCS are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other train. Total system failure could result in the equipment operating temperature exceeding limits in the event of an accident.The CREATCS is considered OPERABLE when the individual components that are necessary to maintain the control room temperature are OPERABLE in both trains. These components include the cooling coils and associated temperature control instrumentation.

In addition, the CREATCS must be OPERABLE to the extent that air circulation can be maintained.

APPLICABILITY In MODES 1, 2, 3, 4, 5, and 6, and during movement of irradiated fuel assemblies, the CREATCS must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY requirements following isolation of the control room.Movement of spent fuel casks containing irradiated fuel assemblies is not within the scope of the Applicability of this technical specification.

The movement of dry casks containing irradiated fuel assemblies will be done with a single-failure-proof handling system and with transport equipment that would prevent any credible accident that could result in a release of radioactivity.

ACTIONS A.1 With one CREATCS train inoperable, action must be taken to restore OPERABLE status within 30 days. In this Condition, the remaining OPERABLE CREATCS train is adequate to maintain the control room temperature within limits. The 30 day Completion Time is reasonable, based on the low probability of an event occurring requiring control room isolation, consideration that the remaining train can provide the required capabilities, and the alternate safety or nonsafety related cooling means that are available.

L ~I7J>(conti nued)PALO VERDE UNITS 1,2,3 B371- EIIN2 B 3.7.12-2 REVISION 2-$

Insert for page B 3.7.12-2 B.1 With two CREATCS trains inoperable in MODE 1, 2, 3, or 4, the Required Action is to restore at least one CREATCS train to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain temperature control for the control room following isolation of the control room. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second CREATCS train is intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one CREATCS train is inoperable for any reason and a second CREATCS train is found to be inoperable, or if two CREATCS trains are found to be inoperable at the same time.

CR EATC S B 3.7.12 BASES (continued)and,.,B.2-

}oB.11 ACTIONS.1ad 2 (continued)

/i / /In MODE 1, 2, 3, or 4, when Required Action A.1 cannot tbe be placed in a MODE that minimizes the accident risk. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challIengi ng unit systems.In MODE 5 or 6, if Required Action A.1 cannot be completed D wthin the required Completion Time, the OPERABLE CREATCS train must be placed in operation immediately (including supporting systems. This action ensures that the remaining train is OPERABLE, that no failures preventing automaticactuation will occur, and that any active failIure willI be readily detected.IiJngovement of i rradi ated fuel assembl ies, i f Requi red Action A.1 cannot be completed within the Required Completion Time, the OPERABLE CREATCS train must be placed in operation immediately (i ncl udi ng supporting systems) or movement of irradiated fuel assemblies must be suspended immediately.

The first action ensures that the remaining train is OPERABLE, that no undetected failIures preventing system operati on wiIll occur, and that any active failIure wilIl be readily detected.If the system is not immediately placed in operation, this acti on requi res suspensi on of the movement of i rradi ated fuel assemblies in order to minimize the risk of a release of radi oacti vi ty that might requi re i sol ati on of the control room. This does not preclude the movement of fuel to a safe posi ti on.In MDE bor 6, or during movement of irradiated fuel assembl ies with two CREATCS trains inoperabl e, action must be taken immediately to suspend activities that could result i n a rel ease of radi oacti vi ty that might requi re i sol ati on of the control room. This places the unit in a condition that minimizes the accident risk. This does not preclude the movement of fuel to a safe position.(conti nued)PALO VERDE UNITS 1,2,3B37123RVSO B 3.7.12-3 REVISION 5-5 CREATCS Reviewer's Note: The B 3.7.12 TSTF-505 Bases state that this action is not applicable for plants with a RICT Program.BASES I ACTTIOlS V "r'*" CP~ATr~i t"~n~ ~m 4"cm.~h'r' 4 p Mflfl~ 1, ?, '~, ~ A function and thc unit iz in a condition outzidc thc accidcnt~ia4y&i-s~-

Thcrcforc, LCO 3.0.3 muzt bc cntcrcd imnicdiatcly.

SURVEILLANCE SR 3.7.12.1 REQU IREMENTS This SR verifies that the heat removal capability of the system is sufficient to meet design requirements.

This SR consists of a combination of testing and calculations.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.REFERENCES

1. UFSAR, Section 9.4.PALO VERDE UNITS 1,2,3 B371- EIIN~B 3.7.12-4 REVISION AC Sources -Operating R 2P 1 Alternatively, a Completion T~~imcabedtridincodne I LI 'J.LJ.+/-I ACTIONS TSTF-439 deletions A.2 (continued)

/Additionally, the/24 hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time/for repairs, and the low probability of a DBA occurring ring this period.A.3" According t/Regulatory Guide 1.93 (Ref. 6), operation may continue il Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . vWi th one offsi te ci rcui t i noperabl e, the rel iabi1i ty of the offsi te system i s degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class lE Distribution System.The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.The secondA Completion Time for Requi. red Action. A.3 establishes~t a1limit the maximum ti;me for~ any, co,-mbination of coniguus "ccurence failn to4 mee the. LCO. 44 meet the LCO, to restore the offsite circuit. At this time, a hOPERBE, an d an additional 10 days. (for. 0a tota of 23 days)Completion....Time prvides._

a limit onl the, time.......

4r alloe in..,4 a conmnecto between the, 12 hor., and 13 day Completion.

Time. mans As in Requ~i",red Action A.2, the. Completiorn Time allow for. an..exceptio÷4n to. t"he nor~mal "ti4mezro" "f or~/'i beginningad t-he outage'r time.

This will result÷ in (conti nued)PALO VERDE UNITS 1,2,3B3819REION4 B3.8.1-9 REVISION 42=

AC Sources -Operating B 3.8.1 IAlternatively, a Completion Time can be determined in accordance BASES Iwith the Risk Informed Completion Time Program.ACTIONS B.3.1 and B.3.2 (continued)

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months i reasonable to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.B.4 In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to th onsite Class 1E Distribution System. The 10 day Compi tion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, a, the low probabiIi ty of a DBA occurri ng during this period.When utiIi zing an extended DG Compl eti on Time (a Compl eti on Time greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and less than or equal to 10 days), the compensatory measures listed below shall be implemented.

For planned maintenance utiIi zing an extended Completion Time, the compensatory measures shall be implemented prior to entering Condition B. For an unplanned entry into an extended Completion Time, the compensatory measures shall be implemented without delay.1. The redundant DG (along with all of its required systems, subsystems, trains, components, and devices)will be verified OPERABLE (as required by TS) and no discretionary maintenance activities will be scheduled on the redundant (OPERABLE)

DG.2. No discretionary maintenance activi ties wilIl be scheduled on the station blackout generators (SBOGs).3. No discretionary maintenance activi ties wilIl be scheduled on the startup transformers.

4. No discretionary maintenance activi ties wilIl be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a Si ne outage or challIenge offsi te power availIabiIi ty to the unit utilizing the extended DG Completion Time.5. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled.

Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded approach according to risk significance.

6. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).(continued)

PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-12 REVISION 4@

AC Sources -Operati ng B 3.8.1 BASES ACTIONS B.4 (continued)

7. Weather condition:

DG from service dd Addi ti onal ly, DG severe weather cot conditions are 8. All maintenance ac is utilizing the assessed and mana 9. The functionality ensuring that the successful ly compl before entering th 10. The OPERABILITY of pump will be verif C'nmnlptfinn will be assessed prior to removing a ring planned maintenance acti vi ties.utages will not be scheduled when ditions and/or unstable grid dicted or present.tivities associated with the unit that Ktended DG Completion Time will be_d per 10 CFR 50.65 (Maintenance Rule))f the SBOGs will be verified by onthly start test has been ted within the previous four weeks extended DG Completion Time.the steam driven auxiIi ary feedwater ed before entering the extended DG 11. The system dispatc 1er will be contacted once per day and informed of the DG status, along with the power needs of the facilIi ty.12. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the extended DO Completion Time, an operator will be av ilable locally at the SBOG should local operation of ;he SBOG be required as a result of on-site weather rel damage.13. No discretionary ma ntenance will be allowed on the main and unit auxi li ary ransformers associated with the uni t.If one or more of the a ove compensatory measures is not met while in the extended c impletion time, the corrective action program shallI be entere l, the risk managed in accordance with the Maintenance Ru , and the compensatory measure(s) restored without delay.TSTF-439 deletions Thc ...o.d Completion Time for ,,uicdAtin,.

during.any..ingle contguou oinurrenc offailin to LCO to restore he nG. ,At this time an. offsite circuit (conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-13 REVISION 48 AC Sources -Operating B 3.8.1 BASES ACTIONS TSTF-439 deletions B.4 (continued) could# .g.n..c....

np..bcth.DGr....d....BEan an.additional 72 ,4--a total o-,f 416 , day,) al,- lowed"AND conccor ctwcn te 1 da and 13 day, Competio alloe time'4"÷' "clock." This will resul t in establishing the C.1 and C.2 Requi red Acti on C. 1, which appl ies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions.

The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed for one train without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two requi red offsite ci rcuits inoperable, based upon the assumption that two complete safety trains are OPERABLE.When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate.

These features are powered from redundant AC safety trains. These features requi re Class lE power from PBA-S03 or PBB-S04 ESF buses to be OPERABLE, and are identical to those specified in ACTION A. 2. Mode appl icabi li ty i s as specified in each appropriate TS section.The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock.' In this Required Action, the Completion Time only begins on discovery that both: a. All required offsite circuits are inoperable; and b. A required feature is inoperable.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-14 REVISION 48 AC Sources -Operating B 3.8.1 BASES ACTIONS C.1 and C.2 (continued)

If at any time during the existence of Condition C (two offsite circuits inoperable) and a required feature becomes inoperable, this Completion Time begins to be tracked.According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This level of degradation means that the offsite electrical power system does not have the capability to effect a safe shutdown and to mitigate the effects of an accident;however, the onsite AC sources have not been degraded.

This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more DGs inoperable.

However, two factors tend to decrease the severity of this level of degradation:

a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or switching failure; and Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.b.The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite Wtbo othe required offsite circuits inoperable, sufficient ksite AC sources are available to maintain the unit in a safe shut n condition in the event of a DBA or transient.

In fac 1a simultaneous loss of offsite AC sources, a LOCA, and a worst c msingle failure were postulated as a part of the design basis safety analysis.

Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provide of time to effect restorati on of one of the offsit ci rcuits commensurate with the importance of maintaining an AC e gtrical power system capable of meeting its design cri teri According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources, two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue.

If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-15 REVISION 48 AC Sources -Operating B 3.8.1 BASES ACTI ONS Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.C.1 and C.2 (continued)

Condition C applies only when the offsite circuits are unavailable to commence automatic load sequencing in the event of a design basis accident (DBA). In cases where the offsite circuits are available for sequencing, but a DBA could cause actuation of the Degraded Voltage Relays, Condition G applies.D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable in de-energization.

Therefore, the Required Xctions of Condition D are modified by a Note to indicatewhen Condition D is entered with no AC source to a t amn, the Conditions and RequiredActions for LCO 3.8.9,"D~stribution Systems -Operating," must be immediately en red. This allows Condition D to provide requirements for \the loss of one offsite circuit and one DO without regad to whether a train is de-energized.

LCO 3.8.9 provi es the appropriate restrictions for a de-energizedAccordin Regulatory Guide 1.93 (Ref. 6), operation may continue ~n Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is providedby two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits).

This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period, Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-16 REVISION AC Sources -Operating B 3.8.1 BASES ACTIONS (conti nued)Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk sociated with continued operation for a short time could b ess than that associated with an immediate controlled shdwn (the immediate shutdown could cause grid is ility, which could result in a total loss of AC poe) Since any inadvertent generator trip could al so result total loss of offsite AC power, the time allowed for conti operation is severely restricted.

The intent here is to ~void the risk associated with an immediate contr~olle~d s ~utdown and to minimize the risk associated with this level of egradation.

According to Reg atory Guide 1.93 (Ref. 6), with both DGs inoperable, operat qn may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .'P.1 and F.2 The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given [SF bus.Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated

[SF bus. Therefore, loss of an ESF bus sequencer affects every major [SF system in the load group. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining sequencer OPERABILITY.A This time period also ensures that the probability of an ac ident (requiring sequencer OPERABILITY) occurring durnn periods when the sequencer is inoperable is minimal. Re luired Action F.2 is intended to provide assurance that a s ngle failure of a DG Sequencer will not result in a loss of safety function of critical redundant requi rec features.Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-17 REVISION Insert for page B 3.8.1-17 G.1 With three or more required AC sources inoperable, the Required Action is to restore the required AC source(s) to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain some level of redundancy in the AC electrical power supplies.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of required AC sources. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when three or more required AC sources are intentionally made inoperable.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two required AC sources are inoperable for any reason and additional required AC sources are found to be inoperable, or if three or more required AC sources are found to be inoperable at the same time.

AC Sources -Operating B 3.8.1 BASES ACTIONS JG.1 and G.2 (continued) 7ensure offsite circuits will not be lost as a consequencea DBE, certain conditions must be maintained.

Failure to H-- -maintain these conditions may result in double sequencing should an accident requiring sequencer operation occur.An offsite circuit meets its required capability by maintaining either of the following conditions:

1. Steady-state switchyard voltage at or above the minimum level needed to support the offsite circuit's functions.

The minimum allowable voltage is the value calculated as follows or 528.5 kV, whichever is less: Base minimum voltage (provides for emergency loads on PBA-S03 or PBB-S04 and house loads on NAN-S01 or NAN-S02)If the offsite circuit is connected to 1-E-NAN-S05 or 1-E-NAN-S06 If the house load group associated with the offsite circuit is connected to both NBN-S01 and NBN-S02 (tie breaker NBN-S01C closed)If the offsite circuit is connected to another unit's PBA-S03 or PBB-S04 518 kV add 6.5 kV add 4 kV add 1.5 kV This option does not apply if the unit under review is the only Palo Verde unit synchronized to the 525 kV switchyard and its main generator gross MVAR output is >0 or if the offsite circuit is connected to both PBA-S03 and PBB-S04 in the same unit.The values used to calculate minimum allowable voltage are based on calculations 01, 02, 03-EC-MA-0221 that analyze many different bus alignment conditions.

The values are conservative, with sufficient margin to account for analytical uncertainties and to provide assurance that the degraded voltage relays will not actuate as a result of an accident.(conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-18 REVISION AC Sources -Operating B 3.8.1 BASES ACTIONS G.I an Q_.2 (continued)

"--" The highest minimum voltage of 528.5 kV is based on management of the loading of the startup transformer secondary windings to not exceed their rated 70 MVA capacity during a design basis event. When two units are sharing a secondary winding, the associated tie breaker NAN-SO3B or NAN-SO4B must always be open and fast bus transfer control switch NAN-HK-SO3B or NAN-HK-S04B in "Manual" position in at least one of the units.Meters A-E-MAN-EI-O01 and A-E-MAN-EI-002 are used to monitor switchyard voltage. The allowable values take into account metering uncertainties.

A voltage dip lasting 35 seconds or less is considered a transient, rather than steady-state condition based on the credited 35 second time delay of the degraded voltage relay. The time delay feature on the meters' alarms may be set up to 35 seconds to avoid nuisance alarms.2. Associated tie breaker NAN-SO3B or NAN-SO4B to house load buses NAN-S01 or NAN-S02 open and fast bus transfer control switch NAN-HK-SO3B or NAN-HK-SO4B in "Manual" position.

When two units are sharing a startup transformer secondary winding, this condition must be met in both units.If the required capability in is not met, the effects of an AO0 or DBA could cause further depression of the voltage at the ESF bus and actuation of the degraded voltage relays. These actuations would result in disconnection of the bus from the offsite circuits.Regulatory Guide 1.93 (Ref. 6) defines this condition as"The Available Offsite Power Sources Are One Less Than the LCO" or "The Available Offsite AC Power Sources Are Two Less Than the LCO," depending on the number of affected circuits.However, degraded post-trip voltage could also cause ESF electrical equipment to be exposed to a degraded condition during the degraded voltage relay time-out period. There is a risk that equipment misoperation or damage could occur during this time. In this scenario, the [SF equipment may not perform as designed fol lowi ng an automatic di sconnecti on of the offsite circuits and reconnection to the diesel generators (DGs), even though adequate power is available from the DG. For certain DBAs, an additional consideration (conti nued)PALO VERDE UNITS 1,2,3 B3811 EIIN4 B 3.8.1-19 REVISION AC Sources -Operating B 3.8.1 BASES ACTIONS r~ .Ian d_$.2 (continued) is that the initial sequencing of the ESF equipment onto the offsite circuits, subsequent tripping of the degraded voltage relays, and interrupti on i n equipment credi ted i n the UPSAR Chapter 6 and 15 safety analyses could challenge the credited equipment response times. Therefore, it is appropriate to implement Required Actions that are more stringent than those speci fi ed in Condition A or C.If the required capability in Condition G is not met, the following options are available to restore full or partial Operability.

Options are listed in their order of preference.

1. Achieve Condition 1 as discussed above (switchyard voltage at or above the minimum allowable value). This i s accompl ished by either of the fol lowi ng:*Increase switchyard voltage. If more than one Palo Verde unit is operating, switchyard voltage i s increased by increasing MVAR output of any Palo Verde unit, or by any number of methods implemented by the Energy Control Center. If only one Palo Verde unit is operating, switchyard voltage is increased by any number of methods implemented by the Energy Control Center while maintaining the generator gross MVAR output of the Pal o Verde unit to-<O.* Reduce minimum allowable voltage as calculated above. This is achieved by realignment of equipment power sources, if such an option is available.

2. Achieve Condition 2 as discussed above. This is accomplished by ensuring the affected tie breaker (NAN-SO3B or NAN-SO4B) is open and the fast bus transfer control switch (NAN-HK-SO3B or NAN-HK-SO4B) is in the "Manual" position.

If two units are sharing a startup transformer secondary winding, this condition must be achieved in both units. Although Palo Verde has no formal restrictions on the amount of time that fast bus transfer can be out of service, this option should be used judiciously in order to maintain forced ci rcul ati on capabiIi ty.(continued)

PALO VERDE UNITS 1,2,3 B3812 EIIN4 B 3.8.1-20 REVISION AC Sources -Operating B 3.8.1 BASES ACTIONS G~ l.l an (continued)

3. Transfer the safety bus(es) to the diesel generator(s).

This is less desirable than option 2, because it would perturb the plant. It would cause the plant to remain in an LCO 3.8.1 condition (A or C, depending on whether one or two buses are transferred).

Options 1 and 2 satisf~y Requi red Actior#.1, and Option 3 satisfies Required Action-.2.

With more than one offsite ci rcuit does not me~t the requi red capability, could be satisfied for each offsite circuit by te use of Required Actior# .1 or-G .2. The Completion Time for both Required 1 anG. 2 is one hour. The one nour time 7imit is appropriate and consistent with the need to remove the unit from this condition, because the level of degradation exceeds that descri bed i n Regulatory Guide 1.93 (Ref. 6) for two offsite circuits inoperable.

The regulatory guide assumes that an adequate onsite power source is still available to both safety trains, but in a scenario involving automatic load sequencing and low voltage to the ESF buses, adequate voltage is not assured from any of the power sources for the following systems immediately after the accident signal has been generated (i .e., while the degraded voltage relay is timing out): radiation monitors Train A RU-29 or Train B RU-30 (TS 3.3.9), Train B RU-145; ECCS (TS 3.5.3); containment spray (TS 3.6.6);containment isolation valves (TS 3.6.3); auxiliary feedwater system (TS 3.1.5); essential cooling water system (TS 3.7.7); essential spray pond system (TS 3.7.8);essential chilled water system (TS 3.7.10); control room essential filtration system (TS 3.7.11); [SF pump room air exhaust cleanup system (TS 3.1.13); and fuel building ventilIati on.Required Action G.2 is modified by a Note. The reason for the Note is to ensure that the offsite circuit is not inoperable for a time greater than the Completion Time allowed by LCO 3.8.1 Condition A or C. Therefore, if Conditions A or C are entered, the Completion Time clock for Conditions A and C would start at the Time Condition G was entered.(conti nued)PALO VERDE UNITS 1,2,3B381-1RVSO4 B 3.8.1-21 REVISION AC Sources -Operating B 3.8.1 BASES ACTIONS (conti nued)Reviewer's Note: The TSTF-505 Bases state that this action is not applicable for plants with a RIOT Program.If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the requi red unit conditions from full1 power condi ti ons i n an orderly manner and without challenging unit systems.inth AC,4,,4.., elcetrica power .,1.tem wil-l c.au,.sc a-..1.* loss of -,e.,49,,,,., ,,,e,,.forc, no aditona tim, is,,.. ,justified for, commence a controlled shutdow:n.

SURVEILLANCE REQU IREMENTS The AC sources are designed to permit inspection and testing of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SR for demonstrating OPERABILITY of the the recommendations of Regulatory Guide 1.9 otherwise noted in the Updated FSAR Section DGs are based on (Ref. 3), unless 1.8.The DG capabilities (starting and loading) are required to be met from a variety of initial conditions such as DG in standby condition with the engine hot (SR 3.8.1.15) and DG in standby condition with the engine at normal keep-warm conditions (SR 3.8.1.2, SR 3.8.1.1 and SR 3.8.1.19).

Although it is expected that most DG starts will be performed from normal keep-warm conditions, DG starts should be performed with the jacket water cooling and lube oil temperatures within the lower to upper limits of DG OPERABILITY, except as noted above. Rapid cooling of the DG down to normal keep-warm conditions should be minimized.(conti nued)PALO VERDE UNITS 1,2,3 B3812 EIIN4 B 3.8.1-22 REVISION DC Sources -Operating B 3.8.4 BASES LCO Channel B includes 125 VDC bus PKB-M42, 125 VDC battery bank (continued)

PKB-F12, and normal battery charger PKB-H12 or backup battery charger PKB-H16.Channel D includes 125 VDC bus PKD-M44, 125 VDC battery bank PKD-F14, and normal battery charger PKD-H14 or backup battery charger PKB-H16.An OPERABLE DC electrical power subsystem requires all required batteries and respective chargers to be operating and connected to the associated DC bus(es).APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided, and containment integrity and other vital functions are maintained in the event of a postulated DBA.The DC electrical power requirements for MODES 5 and 6, and during movement of irradiated fuel assemblies are addressed in the Bases for LCO 3.8.5, "DC Sources -Shutdown." ACTIONS A.1, A.2, and A.3 Condition A represents one subsystem with one battery charger inoperable (e.g., the voltage limit of SR 3.8.4.1 is or in accordance not maintained).

The ACTIONS provide a tiered response thaton returning the battery to the fully charged state with the Risk a mLrestoring a fully qualified charger to OPERABLE status Informed in a heasonable time period. Required Action A.1 requires Completion Time that the lattery terminal voltage be restored to greater Program than or equa o the minimum established float voltage (2.17 volts per 11~ (Vpc) times the number of connected cells or 130.2 V fo 60 cell battery at the battery terminals) within 2 hou .This time provides for returning the inoperable charger to OPERABLE status or providing an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage. Restoring the battery terminal voltage to greater than or equal to the minimum established float voltage provides good assurance that, within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition(cnnud PALO VERDE UNITS 1,2,3B384-REION I B 3.8.4-5 REVISION DC Sources -Operating B 3.8.4 BASES ACTIONS (Required Action A.2) from fully charged condition (condition) any discharge that might have occurred due to the charger inoperability.

A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the or in accordance recharge characteristic of the battery. Thus there is a good assurance of fully recharging the battery within 12 with the Risk hours, avoiding a premature shutdown with its own attendant Informed ri sk.Completion If esta battery terminal float voltage cannot be Program restored to grea a equal to the minimum established float voltage within 2 o , and the charger is not operating in the current-limiting mode, a faulty charger is indicated.

A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action A.2).Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it is now fully capable of supplying the maximum expected load requirement.

The 2 amp value is based on returning the battery to 95% charge and assumes a 5% design margin for the battery. If at the expiration of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and the battery must be declared inoperable.(conti nued)PALO VERDE UNITS 1,2,3B3.4-REION6 B 3.8.4-6 REVISION DC Sources -Operating B 3.8.4 Alternately, a Completion Time can be determined inlaccordance with the Risk Informed Completion Time I--BASES Program. i I ACTIONS (conti nued)Required Action A.3 limits the restoratjIgn time for the inoperable battery charger to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used. The backup class 1E charger is used to restore OPERABILITY as no balance of plant non-class lE battery charger exists. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.B.1 Condition B represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation.

This condition is exclusive of the status of. one battery charger.It is therefore, imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected subsystem.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an i noperabl e DC di stri buti on subsystem.

If one of the required DC electrical po er subsystems is inoperable for reasons other than Condition A, the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition.

Since a subsequent worst case single failure would\ however, result i n the complete loss of the remaining 125 VC el ectrical power subsystem with attendant loss of ESF fnctions, continued power operation should not exceed The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory\Guide 1.93 (Ref. 8) and reflects a reasonable time to ass ss unit status as a function of the inoperable DC elect ical power subsystem and, if the DC electrical power subsys em is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

.......- .....Mlterna~ely, a Lomple~ion Time can be determined in accordance with the Risk Informed Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3847RVSO B 3*8*4-7 REVISION @-]:

Insert for page B 3.8.4-7 0.1 With two DC electrical power subsystems inoperable, the Required Action is to restore at least one DC electrical power subsystem to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain control power for the AC emergency power system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required DC electrical power subsystem.

Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when the second DC electrical power subsystem is intentionally made inoperable resulting in loss of safety function.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one DC electrical power subsystem is inoperable for any reason and a second DC electrical power subsystem is found to be inoperable, or if two DC electrical power subsystem are found to be inoperable at the same time.

DC Sources -Operating B 3.8.4 ACTIONS .1 and .2 (conti nued)If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. The Completion Time to bring the unit to MODE 5 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the battery chargers, which support the ability of the batteries to perform their intended function.

Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem.

On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.17 volts per cell (Vpc) times the number of connected cells or 130.2 V for a 60 cell battery at the battery terminals).

This voltage maintains the battery plates in a condition that supports maintaining the grid life. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.SR 3.8.4.2 Del eted SR 3.8.4.3 Del eted SR 3.8.4.4 and SR 3.8.4.5 Del eted (continued)

PALO VERDE UNITS 1,2,3 B3848RVSO B 3.8.4-8 REVISION Inverters

-Operating B 3.8.7 BASES (continued)

LCO disconnected.

All other i nverters must be connected to (continued) their associated batteries and aligned to their associated AC vital instrument buses.APPLICABILITY The i nverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to ensure that: a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of AOOs or abnormal transients; and b. Adequate core cooling is provided, and containment OPERABILITY and other vital functions are maintained in the event of a postulated DBA.Inverter requirements for MODES 5 and 6, and during movement of irradiated fuel assemblies are covered in the Bases for LCO 3.8.8, "Inverters

-Shutdown." ACTIONS A. 1 With a requi red inverter inoperable, i ts associated AC vital instrument bus becomes i noperabl e untilI i t i s re-energi zed from its Cl ass lE constant voltage source regulator.

edo n d atcombninatioefnse Requi red Acti on A. 1 i s modi fi ed by a Note, which states to~f dterinitic efese- enter the appl i cabl e condi ti ons and Requi red Actions of in-depth and safety LCO 3.8.9, "Di stri buti on Systems -Operating," when margin inherent in the Condi ti on A is entered with one AC vital instrument bus electrical distribution de-energized.

This ensures the AC vital instrument bus is system with risk insights re-energi zed wi thin 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months vi a the Cl ass lE constant from the station's internal vol tage regul ator.~IevenatsPRAmdl R ui red Acti on A.1i all ows 7 days to fix the inoperable Altrntivly ain ter and return it to service. The 7 day limit is ~Completion Time can be ,4 .... ,- r- l -÷ 1 T- 4 .... .-÷ .... -L-(determined in accordance with the Risk Informed Completion Time Program.anyisr ll,lllr t in rint con.. ider... tion.. the.. time..required...t

.repair an inverter and the additional risk to ".'hich the u-nit.....exposed ... beas of th in..rt. inoper.. bi. it, This has to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a shutdown might entail. When the AC (conti nued)PALO VERDE UNITS 1,2,3B387-REION 3 B 3.8.7-3 REVISION Inverters

-Operating B 3.8.7 BASES (continued)

ACTIONS A.1 (continued) vital instrument bus is powered from its constant voltage source, it is relying upon interruptible AC electrical power sources (offsite and onsite). The uninterruptible inverter source to the AC vital instrument buses is the preferred source for powering instrumentation trip setpoint devices.Planned inverter maintenance or other activities that require entry into Required Action A.1 will not be undertaken concurrent with the following:

a. Planned maintenance on the associated train Diesel Generator (DG): or b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.

These actions are taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that IInser 1 train is dependent on power from the associated DG following"a loss of offsite power event.and _.B.2 If the inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.PALO VERDE UNITS 1,2,3 B3874RVSO B 3.8.7-4 REVISION Insert for page B 3.8.7-4 B,1 With two or more required inverters inoperable, the Required Action is to restore all but one required inverter to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to regain AC electrical power to the vital buses. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required inverter.

Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a Note stating it is not applicable when two or more required inverters are intentionally made inoperable resulting in loss of safety function.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one required inverter is inoperable for any reason and additional required inverters are found to be inoperable, or if two or more required inverters are found to be inoperable at the same time.

Distribution Systems -Operating B 3.8.9 With one or mo e required AC buses, load centers, or motor control cente s (see Table B 3.8.9.-i), except AC vital instrument b 'ses, in one subsystem inoperable, the remaining AC electricaI power distribution subsystem in the other train is ca able of supporting the minimum safety functions necessary shut down the reactor and maintain it in a safe shutdown c ndition, assuming no single failure. The overall reliabilit/

is reduced, however, because a single failure in the remai ing power distribution subsystems could result in the mini [um required ESF functions not being supported.

Therefor , the required AC buses, load centers and motor control\ must be restored to OPERABLE status within Condition A worst scenario is one train (PBA or PBB) without AC power (i.e., no offsite power to the train and the associated DG inoperable).

In this condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be focused on minimizing the potential for loss of power to the remai ni ng train by stabiIi zi ng the uni t, and on restoring power to the affected train. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this condition is acceptable because of: a. The potential for decreased safety if the unit operator' s attention i s diverted from the evaluations and actions necessary to restore power to the affected train, to the actions associated with taking the unit to shutdown within this time limit; and b. The potential for an event in conjunction with a single failure of a redundant component in the train with AC power.TSTF-439 .h codCmito im o curdAto ....deletions combinatio of..... rcgu"" c "ub" y tem to bc'" (conti nued)PALO VERDE UNITS 1,2,3 B3894RVSO B 3.8.9-4 REVISION 0 Distribution Systems -Operating B 3.8.9 BASES ACTIONS AP-_ rfee.t-.... TSTF 439 for.. intnc a...C.bu...

i... n............nd

..ub.equ ..ntly deletions r-as-tor.ad OPE.RABLEc, t÷he uCO ..ay al rcady, hav b... not.. ÷c ,,..4e.÷--he0 h-,., Thiscould-, , r lead a totall of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ,-sl-nec -nitia.÷lr fa.lure ofI tlhci "LCQ, to rcsor thc;,iil ACill bccomc...

ino.c..b....an....di.tributon re.tored OPERABLE.Thc Completion Timc allo..s fo an. Ccception to thc nor.mal this' will1 rosultl -in establis't.hing.t,'

lhe "time zero" at tlhe timern Condition A was. entered. The 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Completion Time is an B.1 With AC vital instrument bus(es) (Channels A or C, or Channels B or D) (see Table B 3.8.9-1) in one train i noperabl e, the remai ning OPERABLE AC vital bus el ectrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition.

Overall rel iabi1i ty is reduced, however, si nce an additional singl e failure could result in the minimum required ESF functions not being supported.

Therefore, the required AC vital instrument buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated inverter via inverted DC voltage or the Class lE constant voltage regul ator./Condition B represents one train without adequate AC vital instrument us power; potentially both the DC source and the associated A source are nonfunctioning.

In this situation, the unit is ;ignificantly more vulnerable to a complete loss of all nonin1 erruptible power. It is, therefore, imperative that the oper ator's attention focus on stabilizing the unit, minimizing potential for loss of OPERABILITY to the remaining vit 1 instrument buses, and restoring power to the affected el ec ri cal power di stri buti on subsystem.

\ Alternatively, a Completion Time lcan be determined in accordancethe Risk Informed______________________Completion Time Program. (conti nued)PALO VERDE UNITS 1,2,3 B3895RVSO B 3.8.9-5 REVISION 0 Di stri buti on Systems -Operating B 3.8.9 BASES ACTIONS B.1 (continued)

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components that are without adequate AC vital instrument power. Taking exception to LCO 3.0.2 for components without adequate AC vital instrument power, which would have the Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if declared inoperable, is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)and not allowing stable operations to continue;b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required Actions for components without adequate AC vital instrument power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time takes into account the importance to safety of restoring the AC vital instrument bus to OPERABLE status, the redundant capability afforded by the other OPERABLE vital instrument buses, and the low probability of a DBA occurring during this period.Th nsccond Coimnletioni Timc~l for Rnquire Acton cstablishc a limit on the maximum for an ominatin uiue io subsystcu to ben inoperabl duin an...... contguou ourr........of failng o mct hc CO.If CndiionB i cncrc whle, fo mminstancle, an ACm bus inopcrabl and subscquaentl rcturne OPEll BLE thc~ LCmO mlrcd h bccn nots forn TSTF-439 deletions (conti nued)PALO VERDE UNITS 1,2,3 B3896RVSO B 3.8.9-6 REVISION 0 Di stri buti on Systems -Operating B 3.8.9 BASES ACTIONS 8- .... TSTF-439 deletions This- Co-,npiction Timc, allow0..S for .... excetio t-o thc norm....... ..... fo bc in in thc..... ...o.... ou g t...... c.oc.".....

This,- rcsult inm4 sabihing ,tinicm cr ,', at, the t-mc t..... wa init........ll

.. ....not.. met, inea of t ti ....e.C.1 With DC bus(es) in one train (see Table B 3.8.9-1)inoperable, the remaining DC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure.The overall reli abi lity is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported.

Therefore, the required DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated battery or battery charger./Condition\C represents one train without adequate DC power;potenti al both wi th the battery significantly degraded and the associ ted charger nonfunctioning.

In this situation, the unit is significantly more vulnerable to a complete loss of all D C po er. It is, therefore, imperative that the operator's ai tention focus on stabilizing the unit, minimizing potential for loss of power to the remaining DC buses and estoring power to the affected DC electrical power di stribu in subsystem.a Completion Time can be in accordance with the Risk Completion Time Program.(conti nued)PALO VERDE UNITS 1,2,3 B3897RVSO B 3.8.9-7 REVISION 0 Di stri buti on Systems -Operating B 3.8.9 BASES ACTIONS C. 1 (continued)

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the vast majority of components which would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)whilIe all owing stable operations to continue;b. The potential for decreased safety by requiring entry into numerous appl icable Condi ti ons and Requi red Actions for components without DC power and not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected train; and c. The potential for an event in conjunction with a single fai lure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).ITSTF-439

... ... ... .... ... .. .... .... .deletions Li7nser t nnm.hinmtinn nf dimtrih,,tion r.,,hm,-rtem" to he rtrned....

tODEDA\ILE, the IC may a...lredy hav beenI,` not met for since failueo the ...,to .esto ..te..distribut+ion syste. ÷ t thi ti°-me, an AC train cou.ld agai This ..ould continu indefinitely. , This Completion Time allow fo.. r an exceptio to- t he normal"time zero" for beginning.

th allwd.uag .im. clc.".This will resu.lt in e~stalishing "time zero" at tlhe time, the LCO was. initially not met, instead of the time Condition C w.as entered. The` 16 hour1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Co.

Time -is an-~(conti nued)PALO VERDE UNITS 1,2,3 B3898RVSO B 3.8.9-8 REVISION g Insert for page B 3.8.9-8 D.1I With two or more electrical power distribution subsystems inoperable, the Required Action is to restore electrical power distribution subsystem(s) to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration.

Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.The Condition is modified by a NOTE stating it is not applicable when the two or more electrical power distribution subsystems are intentionally made inoperable resulting in a loss of safety function.

This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one electrical power distribution subsystem is inoperable for any reason and a second electrical power distribution subsystem is found to be inoperable, or if two or more electrical power distribution subsystems are found to be inoperable at the same time.

Di stri buti on Systems -Operating B 3.8.9 BASES ACTIONS QD.1 and_.2 (continued)

_El If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.Condition E corresponds to a level of degradation in thc ci cctri cal distribution system that causes a regui red safety function to be lost. When more than one Condition is (conti nued)PALO VERDE UNITS 1,2,3 B3899RVSO B 3.8.9-9 REVISION 0 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 4 List of Regulatory Commitments Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times List of Regulatory Commitments

1. Plant procedures needed to implement the Risk-Informed Completion Time Program shall be in place before the risk-informed completion times (RICTs) can be used.2. APS will notify the NRC by letter within 60 days of the first use of a RICT in each unit.3. To ensure the current baseline probabilistic risk assessment (PRA) core damage frequency and large early release frequency values meet Regulatory Guide 1.1 74 risk limits for small changes in risk, the following will be performed prior to use of the RICT Program in each unit: a. Install fuses in Control Room DC ammeter circuits to prevent secondary fires due to multiple fire induced faults.b. Install fuses in non-class DC motor circuits to prevent secondary fires due to multiple fire induced faults. Alternatively, post continuous fire watches in FZ1 4 -Lower Cable Spreading Room, COR2 -Corridor Building 120 ft., and TB-4B -Turbine Building Station DC Equipment Room, and prohibit welding or cutting activities in these areas, any time a RIOT is in effect. The alternative would only be credited in lieu of the modification if confirmed to meet Regulatory Guide 1 .174 risk limits for the specific plant configuration.

c. Replace RCP control cables with one-hour fire rated cables. Alternatively, stage an operator at the RCP switchgear to trip the ROPs upon direction from the Control Room, any time a RICT is in effect. The alternative would only be credited in lieu of the modification if confirmed to meet Regulatory Guide 1.174 risk limits for the specific plant configuration.

d. Install an additional Steam Generator makeup capability to reduce Internal Fire PRA risk.e. Implement recovery procedures for breaker coordination on class and non-class motor control centers/distribution panels that impact risk significant functions in the Internal Fire PRA.4. Supporting requirements of ASME/ANS RA-Sa-2009 SY-C1 and SY-C2 shall be fully met at Capability Category II prior to use of the RICT Program.5. Validate that the Unit 1 Internal Fire PRA model is bounding for Units 2 and 3 to reflect field-routed cabling or create unit-specific internal fire models for Units 2 and 3 prior to use of the RICT Program at Units 2 and 3.6. Implementing procedures will prohibit RICT entry, or a RICT entry made shall be exited, for any condition involving a TS loss of function if a PRA functionality determination concludes that compliance with the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.4-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTAC H MENT 5 List of Revised Required Actions to Corresponding Probabilistic Risk Assessment Functions Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times List of Revised Required Actions to Corresponding Probabilistic Risk Assessment Functions Section 4.0, Item 2 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (Reference 2 of this Attachment) identifies the following needed content:* The license amendment request ([AR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.* The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.* The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent

[with]licensing basis assumptions

[i.e., 10 CFR 50.46 emergency core cooling system (ECCS)flow rates] for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.This attachment provides confirmation that the Palo Verde Nuclear Generating Station (PVNGS)PRA models include the necessary scope of SSCs and their functions to address each proposed application of the Risk-Informed Completion Time (RIOT) Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation.

The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RIOT Program. The PVNGS PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RIOT Program.Table A5-i, In Scope TS/LCO Conditions to Corresponding PRA Functions, lists each TS LCO Condition to which the RIOT Program is proposed to be applied, and documents the following information regarding the TS with the associated safety analyses, the analogous PRA functions, and the results of the comparison:

Column "TS LCO/Condition":

Lists all of the LCOs and condition statements within the scope of the submittal* Column "SSCs Covered by TS LCO/Condition":

Lists the SSCs addressed by each action requirement

Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO/Condition are included in the PRA* Column "Function Covered by TS LCO/Condition":

Contains a summary of the required functions from the design basis analyses* Column "Design Success Criteria":

Lists a summary of the success criteria from the design basis analyses* Column "PRA Success Criteria":

Lists the function success criteria modeled in the PRA* Column "Comments":

Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria.5-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A.The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria.

Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RIOT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than overly conservative, whereas design basis criteria are necessarily conservative and bounding.The use of realistic success criteria is necessary to conform to Capability Category II of the PRA standard as required by NEI 06-09-A.Examples of calculated RIOTs are provided for each individual condition to which the RIOT applies (assuming no other SS~s modeled in the PRA are unavailable) in this Attachment under Table A5-2, Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate.

Actual RIOT values will be calculated based on the actual plant configuration using a current revision of the PRA model which represents the as-built/as-operated condition of the plant, as required by NEI 06-09-A and the NRC Final Safety Evaluation, and may differ from the RIOTs presented.

5-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Cmet Condition TS LCOI/oee T CICondition Criteria Criteria Condition in PRA 3.3.4 6 channels of RPS No Unit shutdown to protect 1 of 6 channels N/A Note 1 RPS Logic Matrix Logic core fuel design limits 3nd Trip and Reactor Coolant Initiation 4channels of RPS Partial System (RCS) pressure 2of 4 channels Same Note 1 initiating logic boundary 4channels of of 4 channels Same Note 1 RTCBs 4channels of No 2of 4channels N/A Notel1 manual trip 3.3.6 6 Matrix Logic Partial Initiate safety systems to 1 of 6 channels Same Note 2 ESFAS Logic Channels protect against violating and Manual design limits and Trip 4Initiating Logic Partial RCS pressure boundary, 2of 4 channels Same Note 2 Channels and to mitigate accidents 2Actuation Logic Partial 1 of 2 channels Same Note 2 Channels 4Manual Trip Yes 2of 4 channels Same Note 2 Channels 3.4.9 >_groups of No Maintain ROS subcooling 2of 8 groups N/A Note 3 Pressurizer heaters margin Heaters 5-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Condition TS LCOI/oee T CICondition Criteria Criteria Cmet_________

Condition in PRA __ _ _ _ _ _ _ _ _ ________3.4.10 SRVs Yes Prevent RCS pressure 4of 4 SRVs 4of 4 SRVs P~ressurizer from exceeding safety For limiting Safety limit anticipated

[Valves Iransient ithout scram (ATWS); 1 offor nion ATWS scenarios 3.4.12 4Pressurizer Yes Depressurize the RCS a Pressurizer Vent One of two Pressurizer Vents during a SGTR and LOP Path to parallel paths Vents Containment plus isolation calve 3.5.1 4SITS Emergency core cooling 3 of 4 SITs Same Note 4 Safety system (EGOS) injection Injection dluring a large loss-of-Tanks (SITs) soolant accident (LOCA)5-4 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Cmet Condition TS LCOI/oee T CICondition Criteria Criteria________ Condition in PRA 3.5.3 High Pressure Yes Injection from RWT into (a) 1 of 2 HPSI Same EGOS -Injection Pumps cold legs pumps for Operating (HPSI) Cold leg recirculation small/medium from containment sumps LOCA;SLow Pressure 1 of 2 LPSI pumps Injection Pumps for large LOGA (LPSI)Hot leg recirculation from (b) 1 of 2 HPSl Same Associated piping, containment sumps pumps for steamand heat generator tube e=xchangers rupture (SGTR) or main steam line break (MSLB)1 of 2 HPSI or LPSl Same pumps to supply other required EGGS pump suction and RCS cold legs 1 of 2 HPSI pumps Same to supply other required EGGS pumps suction and RGS hot legs 5-5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Condition TS LCOI/oee T CICondition Criteria Criteria Cmet_______ Condition in PRA 3.5.5 RWT Yes Supply borated water to RWT boron RWT level The PRA does not Refueling ECCS and CS system concentration, ithin limits explicitly model the N~ater Tank during LOCA injection temperature, and impact of out of limit IRWT) phase for: level within limits boron or temperature, but conservatively, (a) containment cooling these can be addressed and depressurization for the RIOT Program by failing the operator (b) core cooling and action to emergency replacement inventory borate for small boron concentration deviations i(c) negative reactivity for From required limits and reactor shutdown Fail the RWT for larger boron concentrations as appropriate per best-e=stimate analysis.Therefore, the LCO condition can be evaluated using the CRMP.3.6.2 2air locks No Post-accident 2of 2 N/A SSCs for the Dontainment (personnel and c'ontainment leakage containment air locks 4ir Locks emergency) ithin limits can be evaluated by a bounding assessment as permitted by NEI 06-09-A. In this case containment is conservatively

_____ ____ ____ ____ ____ _ ______ ___ ____ ____ _____ _ __ ____ ____ ___ __onsidereco sideed ifiled 5-6 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1 : In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Cmet Condition TS LCOI/oee T CICondition Criteria Criteria_________

Condition in PRA__________

3.6.3 2active

or passive !es Each containment 1 of 2 isolation 1 of 2 isolation Any individual Containment isolation devices penetration isolated devices per devices per penetrations not Isolation on each fluid within the time limits penetration isolate penetration explicitly modeled in the Valves penetration line assumed in the safety within required isolate within PRA have been analysis stroke time required evaluated to be less stroke time than the 1.27" diameter for: effective LERF containment for PVNGS. Multiple purge; open penetrations can radwaste be modeled by failing a drain; surrogate penetration charging; found in the PRA model.letdown;reactor drain tank (RDT)discharge; ROT Makeup;ROT vent;nitrogen supply;instrument air 5-7 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TSILCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Condition TS LCOI/oee T CICondition Criteria Criteria Cmet________ Condition in PRA 3.6.6 2CS trains Yes Containment atmosphere 1 of 2 CS trains Same Containment cooling to limit post-Spray accident pressure and Lemperature Iodine removal to reduce Lhe release of fission product radioactivity from containment to the environment

3.7.2 4MSIVs

Yes Isolate steam flow from MSIV on affected 1 of 4 MSIVs Main Steam the secondary side of the steamline closes, or fail to close Isolation SGs following a high remaining 3 MSIVs Valves energy line break (HELB) on unaffected (MS IVs) steamline close.3.7.3 8 MFlIVs No Isolate feedwater flow MFIV on affected N/A MFIVs are modeled to Main from the secondary feedwater path open for flow path to feed Feedwater feedwater to the SGs closes SG. As a surrogate the Isolation following a HELB RICT will conservatively Valves fail the check valve to steam generator closed (M FIVs) (for bypassed feed flow)and containment penetration failed open (for containment challenge of HELB).5-8 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO/ SSCs Covered by SSCs Function Covered by Design Success PRA Success Condition TLCI Mdld TS LCOCI Condition Criteria Criteria Cmet Condition in PRA________

3.7.4 ADV lines (one Yes Cool unit to RHR entry of 4 ADVs to cool 1 of 4 ADVs The difference between Atmospheric per SG, each with conditions, if preferred down unit to design the Design Success Dump ValvesADV and block heat sink via steam dump rate of 1 00°F per Criteria and PRA (ADVs) valve) to condenser not hour; 1 of 4 ADVs Success Criteria is due available permit 25°F per to the Design basis hour cooldown for a b~eing highly natural circulation conservative whereas cooldown event, the PRA is realistic.

Thermal-hydraulic Cool down RCS following 3 ADVs on intact 1 of 4 ADVs calculations have SGTR to permit SG lines on intact SG determined only 1 ADV termination of primary to lines is needed for adequate secondary break flow heat removal during the most limiting accident scenarios.

5-9 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Condition TS LCOI/oee T CICondition Criteria Criteria Cmet________ Condition in PRA 3.7.5 2motor-driven Yes Supply feedwater to the 1 of 3 pumps for the Same Auxiliary pumps and 1 SGs to remove RCS most limiting event Feedwater

urbine-driven decay heat (loss of main (AFW) pump feedwate r)System 3.7.6 1 CST Yes Safety grade source of 1 CST aligned with Same Condensate water to SGs for minimum water Storage Tank removing heat from RCS volume (CST)3.7.7 2trains Yes Heat transfer system to 1 of 2 loops with 1 1 of 2 loops The PRA also credits EW Essential the ultimate heat sink for of 2 EW pumps and with 1 of 2 EWto Nuclear Cooling as a Cooling the removal of process 1 of 2 heat pumps and 1 backup for cooling RCP Water (EW) and operating heat from exchangers of 2 heat seals.System selected safety related air exchangers handling systems during a DBA or transient.

5-10 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Cmet Condition TS LCOI!oee SLO Condition Criteria Criteria________ Condition in PRA 3.7.8 2trains 'es Heat sink for removal of 1 of 2 trains Same Essential process and operating Spray Pond heat from the EW System system.(ESPS)3.7.9 2trains No Heat sink for removal of 1 of 2 trains N/A Per TS Bases, this impacts Ultimate process and operating containment spray when Heat Sink heat from the EW going on recirculation.

This (UHS) system. is modeled for the RICT by railing the associated train's SoC HX, which fails containment spray recirculation.

Two trains inoperable is modeled for the RICT by failure of both spray pond trains.3.7.10 trains Yes Heat transfer system to 1 of 2 trains Same Essential EW for the removal of Chilled Water process and operating (EC) System heat from selected safety related air handling systems during a DBA or transient.

5-11 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success IPRA Success Cmet Condition TS LCO/ Modeled TS LCOI/Condition Criteria Criteria Cmet Condition in PRA 3.7.12 2trains Yes Provides temperature 1 of 2 trains Same Control control for the control Room room following isolation Emergency of the control room.,ir Temperature Control System (CREATCS)3.8.1 2offsite circuits, 2 Yes Source of power to ESE ,utomatically Same Two Station BlackoutSources -diesel generators system atssociated ESE Generators (SBOG) are Operating (DG), 2 supply b)uses also credited in the PRA trains of diesel fuel 1 of 2 trains model.oil transfer systems, Source of fuel oil to DGs 1 of 2 trains Same 3.8.4 4Class 1 E DC 'es P~rovide control power to ,lign to provide Same DC Sources -subsystems ,C emergency power power to Operating system, motive and e=quipment from control power to selected battery and safety related equipment associated charger and backup 120 VAC Jital bus power 5-12 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCOI SSCs Covered by SSCs Function Covered by Design Success PRA Success Cmet Condition TS LCOI/oee T CICondition Criteria Criteria________ Condition in PRA 3.8.7 4Class 1 E Yes Provide uninterruptible Ilign to associated Same Inverters

-Inverters power to reactor 120 VAC vital bus, Operating protection system (RPS) with input power and engineered safety From vial AC and Features actuation system associated battery (ESFAS)3.8.9 Class 1 E AC, DC, Yes Provide necessary power Align to provide Same Distribution and 120 volts, to ESF systems power to buses Systems -alternating (VAC)Operating ital bus electrical power distribution subsystems Notes: 1. Individual reactor trip system (RTS) instrumentation channels for input to the automatic RTS function will be evaluated using a bounding evaluation as permitted by NEI 06-09-A. The PVNGS reactor protection design uses four quality class input channels placed through six channels of matrix logic to develop a trip signal to the reactor trip circuit breakers (RTCBs). The design allows for any one channel to be placed in bypass or trip without impacting the ability to trip the plant or perform testing with the remaining channels.

Any channel which was unable to trip the circuitry at its required setpoint criteria would be both inoperable and non-functional for the RICT program. For the RICT Program, the risk for one or more inoperable instrument channels for one trip signal will be evaluated assuming that the probability of failure of all RTCBs has increased by a factor of two. This is a bounding conservative risk assessment as permitted by NEI 06-09-A. It is conservative because: (1) loss of one channel of matrix logic can only impact three of the contacts in the initiation circuit for a RTCB; any of the remaining three will trip the breaker, and (2) the reactor protection system (RPS) logic failure rate with one matrix relay bypassed is at least one order of magnitude less than the reactor trip switchgear (RTSG) breaker failure rate (CE NPSD-277) and is conservatively bounded by increasing the breaker failure rate. Therefore, the RPS is modeled in sufficient detail in the PRA model to capture the risk impacts from unavailability of any channel. The instruments and logic for control functions are separate from and do not impact the RPS. Some 5-13 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times quality class transmitters are shared by RPS and ESFAS, in which case the RIOT program would implement the equipment as being non-functional for both the RPS and ESFAS.2. The ESFAS is made up of 4 quality class input channels, 6 channels of Matrix Logic, 4 channels of Initiation Logic, 2 channels of Actuation Logic, and 4 channels of Manual Trip for 7 Functions; Safety Injection Actuation Signal (SlAS), Containment Isolation Actuation Signal (CIAS), Recirculation Actuation Signal (RAS), Containment Spray Actuation Signal (OSAS), Main Steam Isolation Signal (MSlS), Auxiliary Feedwater Actuation Signal to SG-1 (AFAS-1), and Auxiliary Feedwater Actuation Signal to SG-2 (AFAS-2).

Individual ESFAS instrumentation channels will be evaluated using a bounding evaluation as permitted by NEI 06-09-A. For one or more functions with manual trip or initiation logic channel inoperable, the actuation relays for one train of SlAS, OSAS, AFAS, or RAS will be assumed failed, 1 MSlV per steam generator will be failed for MSlS, and containment pressure mis-calibration will be set to logical True for CIAS. For one or more functions with two initiation logic channels inoperable or with one actuation logic channel inoperable, the initiated equipment for one train of SIAS, CIAS, OSAS, or MSIS is assumed failed, and the initiation relay for AFAS or RAS for one train is failed. For two actuation logic channels inoperable, both trains of the equipment actuated by the associated signal are failed. The train of EFAS taken as failed will be the one sharing power with the channel that is non-functional.

This is conservative because: (1) a full train of ESAS-actuated equipment is being assumed unavailable at a point downstream of the logic that is unavailable, (2) for multiple initiation channels or actuation logic inoperable, no credit is taken for operator recovery of the unavailable train except for AFAS and RAS, which have long recovery times, and (3) complete failure of the ESFAS function is assumed for two actuation logic channels inoperable.

Therefore, the ESFAS is modeled in sufficient detail in the PRA model to capture the risk impacts from unavailability of any channel. The instruments and logic for control functions are separate from and do not impact the ESFAS. Some quality class transmitters are shared by RPS and ESFAS, in which case the RIOT program would implement the equipment as being non-functional for both the RPS and ESFAS.3. Th~e pressurizer heaters will be evaluated for the RIOT Program by a bounding assessment as permitted by NEI 06-09-A. The function of the heaters is to maintain subcooled conditions in the ROS for decay heat removal using forced or natural circulation when cooling down to shutdown cooling conditions.

In the PRA, this is addressed by failing the operator action to align LPSI for shutdown cooling. This is conservative since it fails long-term cooling of the core.4. The success criteria in the PRA are consistent with the design basis criteria for large LOCA scenarios.

For medium LOCA scenarios, the PRA success criteria do not require SITs based on realistic analyses consistent with the PRA standards for Capability Category II. Boron concentration out of limits will be evaluated for the RIOT Program by a bounding assessment as permitted by NEI 06-09-A. This is conservative by failing the operator action to emergency borate for small boron concentration deviations from required limits and failing the SIT for larger boron concentrations as appropriate per best-estimate analysis.5-14 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-2: Units 112/3 In Scope TSILCO Conditions RICT Estimate TSILCO Condition RICT Estimate 1 3.3.4 RPS Logic and Trip Initiation Condition A -One Matrix Logic channel inoperable 30 days 3.3.6 ESFAS Logic and Manual Trip Condition A -One or more Functions with one Matrix Logic channel 2 days 2 inoperable

3.3.6 ESFAS

Logic and Manual Trip Condition B -One or more Functions with one Manual Trip or Initiation 2 days 2 Logic channel inoperable

3.3.6 ESFAS

Logic and Manual Trip Condition C -One or more Functions with two Initiation Logic channels 2 days 2 inoperable

3.3.6 ESFAS

Logic and Manual Trip Condition D -One or more Functions with one Actuation Logic channel 2 days 2 inoperable

3.3.6 ESFAS

Logic and Manual Trip 7dy Condition E -One or more Actuation Logic channels inoperable 7dy 3.4.9 Pressurizer30dy Condition B -One pressurizer heater group inoperable30dy

3.4.9 Pressurizer30dy

Condition C -Two pressurizer heater groups inoperable30dy 3.4.10 Pressurizer Safety Valves30dy Condition A -One pressurizer safety valve inoperable30dy 3.4.12 Pressurizer Vents30dy Condition A -Two or three pressurizer vents inoperable30dy 3.4.12 Pressurizer Vents 30 days Condition B -All pressurizer vents inoperable_________

3.5.1 Safety

Injection Tanks (SITs) 30 days Conditions A and B -One SIT inoperable

3.5.1 Safety

Injection Tanks (SITs)30dy Condition C -Two or more SITs inoperable30dy

3.5.3 Essential

Core Cooling System Condition A -One LPSI subsystem inoperable 30 days 5-!5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-2: Units 12123 In Scope TS/LCO Conditions RICT Estimate TS/LCO Condition RICT Estimate 1 3.5.3 Essential Core Cooling System 30 days Condition B -One or more trains inoperable

3.5.3 Essential

Core Cooling System Condition C -Less than 100% of ECCS flow equivalent to a single 10 days OPERABLE train available 3.5.5 Refueling Water Tank (RWT)Conditions A and B -RWT boron concentration or borated water 10 days temperature not within limits_________

3.6.2 Containment

Air Locks25dy Condition C -One or more containment air locks inoperable25dy

3.6.3 Containment

Isolation Valves Condition A -One or more penetration flow paths with one required 13 days containment isolation valve inoperable

3.6.3 Containment

Isolation Valves Condition B -One or more penetration flow paths with two 10 days required containment isolation valve inoperable

3.6.3 Containment

Isolation Valves Condition C -One or more penetration flow paths with one 16 days required containment isolation valve inoperable

3.6.3 Containment

Isolation Valves Condition D -One or more penetration flow paths with one 30 days or more containment purge valves not within leakage limits 3.6.6 Containment Spray System 30 days Condition A -One containment spray train inoperable

3.6.6 Containment

Spray System30dy Condition C -Two containment spray trains inoperable30dy 3.7.2 Main Steam Isolation Valves (MSIVs)30dy Condition F -One MISV inoperable30dy 3.7.2 Main Steam Isolation Valves (MSIVs)30dy Condition G -Two or more MISVs inoperable30dy 5-16 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-2: Units 112/3 In Scope TS/LCO Conditions RICT Estimate TSILCO Condition RICT Estimate 1 3.7.3 Main Feedwater Isolation Valves (MFlIVs) 16 days Condition A One or more ME! Vs inoperable 3.7.3 Main Feedwater Isolation Valves (MFlIVs)15dy Condition B -Two valves in the same flow path inoperable15dy

3.7.4 Atmospheric

Dump Valves (ADVs) 30 days Condition A -One ADV line inoperable

3.7.4 Atmospheric

Dump Valves (ADVs)Condition B -Two or more ADV lines inoperable with both ADV lines 30 days inoperable on one or more SGs 3.7.5 Auxiliary Feedwater System (AFW)30dy Condition A -One steam supply to turbine driven AFW pump inoperable30dy

3.7.5 Auxiliary

Feedwater System (AFW) 22 days Condition B -One AFW train inoperable

3.7.5 Auxiliary

Feedwater System (AFW) 2 days Condition C -Two AFW trains inoperable

3.7.6 Condensate

Storage Tank (CST) < 1 hr 3 Condition A -CST inoperable

3.7.7 Essential

Cooling Water System (EW) 30 days Condition A -One EW train inoperable

3.7.7 Essential

Cooling Water System (EW) 30 days Condition B -Two EW trains inoperable

3.7.8 Essential

Spray Pond System (ESPS) 30 days Condition A -One ESPS train inoperable

3.7.8 Essential

Spray Pond System (ESPS) 28 days Condition B -Two ESPS trains inoperable

3.7.9 Ultimate

Heat Sink (UHS) 30 days Condition A -UHS inoperable 3.7.10 Water (EC) System 30 days Condition A- One EC train inoperable 3.7.10 Water (EC) System 30 days Condition B -Two EC trains inoperable 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS) 30 days Condition B -Two CREACTS trains inoperable

________5-17 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-2: Units 1/213 In Scope TS/LCO Conditions RICT Estimate TS/LCO Condition RICT Estimate 1 3.8.1 AC Sources -Operating30dy Condition A -One required offsite circuit inoperable30dy 3.8.1 AC Sources -Operating Condition B -One Diesel Generator (DG) inoperable 30 days 3.8.1 AC Sources -Operating Condition C -Two required offsite circuits inoperable 30 days 3.8.1 AC Sources -Operating Condition D -One required offsite circuit inoperable AND one DG 30 days inoperable 3.8.1 AC Sources -Operating 3dy Condition E -Two DGs inoperable 3dy 3.8.1 AC Sources -Operating Condition F -One automatic load sequencer inoperable 22 days 3.8.1 AC Sources -Operating 3dy Condition G -Three or more required AC sources inoperable 3dy 3.8.4 DC Sources -Operating Condition A -One battery charger on one subsystem inoperable 30 days 3.8.4 DC Sources -Operating Condition B -One DC electrical power subsystem inoperable 3 days 3.8.4 DC Sources -Operating

<1h4 Condition C -Two DC electrical power subsystems inoperable<1h

3.8.7 Inverters

-Operating30dy Condition A -One required inverter inoperable30dy

3.8.7 Inverters

-Operating Condition B -Two or more required inverters inoperable 30 days 3.8.9 Distribution Systems -Operating Condition A -One AC electrical power distribution subsystem inoperable 7 days 3.8.9 Distribution

-Operating Condition B -One AC vital instrument bus electrical power distribution 30 days subsystem inoperable 5-18 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A5-2: Units 1/213 In Scope TS/LCO Conditions RICT Estimate TS/LCO Condition RICT Estimate 1 3.8.9 Distribution Systems -Operating 6dy Condition C -One DC electrical power distribution subsystem inoperable 6dy 3.8.9 Distribution Systems -Operating Condition 0 -Two or more electrical power distribution subsystems 6 hrs inoperable Notes: 1. RICTs are based on the internal events, internal flood, internal fire, and seismic PRA model calculations.

RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest number of days for illustrative purposes.2. This was evaluated with all of the EFAS signals being impacted to account for the "or more" condition of the LCO and thus, is a bounding value.3. The evaluation did not credit using the Reactor Makeup Water Tank to back up the Condensate Storage Tank, as it is not currently not credited in the PRA model due to lack of testing of the flow path.4. The evaluation assumed the worst case of Train A and B batteries and chargers out of service concurrently.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071 200238) dated May 17, 2007 2. Nuclear Energy Institute (NEI) 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0-A, (ADAMS Accession No. ML12286A322) dated November, 2006 5-19 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACH MENT 6 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Introduction NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (Reference 1 of this Attachment), Section 2.3.4 states that the probabilistic risk assessment (PRA) shall be reviewed to the guidance of Regulatory Guide (RG) 1.200, Revision 2 (Reference 2 of this Attachment), for a PRA which meets Capability Category II for the supporting requirements (SRs) of the internal events at power PRA standard, and that deviations from these capability standards shall be justified and documented.

APS has performed its review of the PRA to the guidance in RG 1 .200, Revision 2. Section 4.0, Item 3 of the NRC Final Safety Evaluation (Reference 3 of this Attachment), for NEI 06-09-A requires the license amendment request (LAR) to include a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RMTS, including the resolution or disposition of any identified deficiencies (i.e., findings and observations from peer reviews).

The scope of this information includes the internal events PRA model and other models for which additional standards have been endorsed by a revision to RG 1.200.This attachment provides information on the technical adequacy of the PVNGS PRA internal event, internal flood, internal fire, and seismic models which support the Risk-Informed Completion Time (RIOT) Program, in support of the LAR to revise Technical Specifications (TS)to implement NEI 06-09-A. This information is consistent with the requirements of Item 3 of Reference 3 of this Attachment and addresses each PRA model for which a RG 1 .200-endorsed standard exists. The information is provided as follows:* Table A6-1 Internal Events PRA Peer Review A & B Findings* Table A6-2 Internal Events PRA Self-Assessment ASME SRs Not Met to Capability Category II*Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category II*Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II*Table A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to Capability Category II Note that the other external hazards have been screened out in accordance with RG 1.200, were peer reviewed in accordance with RG 1.200, Revision 2, and are further discussed in Attachment 8 of this Enclosure.

Shutdown modes of operation are not in the scope of the RICT Program and thus, low power and shutdown PRA models are not addressed.

No other PRA standards are endorsed by RG 1.200, Revision 2.All peer review findings associated with not-met ASME SRs are identified in this attachment and those not yet met will be fully addressed prior to use of the RIOT Program, therefore satisfying the technical adequacy requirements of NEI 06-09-A. This attachment indicates the only two SRs in ASME/ANS RA-Sa-2009 (Reference 4 of this Attachment), associated with the PVNGS PRA models that are currently not fully met at Capability Category II are SY-O1 and SY-C2.6-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times APS has committed in Attachment 4 of this Enclosure to fully meet these SRs at Capability Category II prior to use of the RIOT program.Since the associated peer review(s), no changes have been made to the internal event, internal flood, seismic, or internal fire PRA models that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009; thus no additional peer reviews are required to support implementation of the RIOT Program. PVNGS has a PRA model maintenance process consistent with ASME/ANS RA-Sa-2009 reflecting the as-built, as-operated station and ensures future changes (i.e., design changes, procedure changes, and equipment performance monitoring) are periodically reflected in the PRA models. The PRA model maintenance program was previously described in the RlITS 5b license application which was approved by Reference 5 of this Attachment.

Internal Events PRA A peer review of the PVNGS internal events PRA was conducted in April 1999 in accordance with the reactor owners group peer review process (References 6 and 7 of this Attachment).

APS subsequently performed a self-assessment of the PVNGS internal events models in December 2010 consistent with RG 1 .200, Revision 2, using the current endorsed standard ASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix B.Internal Flood PRA A peer review of the PVNGS internal flood PRA was conducted in October 2010 (Reference 8 of this Attachment) consistent with RG 1.200, Revision 2, using the current endorsed standard ASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix A.Seismic PRA A peer review of the PVNGS seismic PRA was conducted in December 2013 (Reference 9 of this Attachment) consistent with RG 1 .200, Revision 2 and the current endorsed standard ASME/ANS RA-Sa-2009 and exceptions/objections in RG 1.200 Revision 2 Appendix A.Internal Fire PRA A peer review of the PVNGS internal fire PRA was conducted in October 2012 (Reference 10 of this Attachment) consistent with RG 1.200, Revision 2, using the current endorsed standard ASME/ANS RA-Sa-2009.

Subsequently, a focused-scope peer review of the internal fire PRA was conducted in December 2014 (Reference 11 of this Attachment) to address ASME PRA Standard SRs not-met to Capability Category II requirements and those SRs not-reviewed in the prior October 2012 internal fire PRA peer review.6-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times_________Table A6-1 Internal Events PRA Peer Review A and B Level Findings ,Observation Sub- Level Status Finding(s)

Disposition ID element(s)

SY-lO SY-20 A Closed Demand failures of batteries are not considered (i.e., if The finding has been there is a demand for [direct current] DC, battery failure resolved and closed by is more likely). Only charger failures, bus faults, circuit an update of the PRA breaker failures, battery faults, maintenance and failure model.to restore after maintenance are modeled. Demand failure of batteries has been added to the model.DA-04 DA-8 A Closed The following common cause factors are significantly The finding has been lower than Idaho National Engineering Environmental resolved and closed by Laboratory (IN EEL) recommended values: pumps an update of the PRA gamma and delta factors, [emergency diesel generator]

model.EDG failure to start beta, and auxiliary feedwater]

AFW The PRA model common pumps failure to run beta generic pumps -beta. Note: cause factors have been these are based on generic sources; therefore there is a revised consistent with concern that the values are significantly different from the NRC common cause I NEEL generic data. A sensitivity evaluation was database.performed which put these values to those similar to INEEL recommended values caused a ODE increase of approximately 7%.DE-07 DE-7 A Closed In general, human actions across systems appear to The finding has been treat dependency appropriately.

There are some cases resolved and closed by where dependencies across systems are not properly an update of the PRA addressed.

RE-AFA-LOCAL is used redundantly to model.1ALFW-2HRS-HR in sequences 7634, 14966, etc. [per The PRA model human PRA Study, 13-NS-C29 Rev. 3, PRA Change action dependencies Documentation]

per C-29 Rev. 3 across systems have been addressed.

6-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table .A6-1 Internal Events PRA Peer Review A and B Level Findings __________

Observation Sub- Level Status Finding(s)

Disposition ID element(s)

QU-03 QU-18, QU-19 A Closed Currently, RE-AFA-LOCAL is being used to recover The finding has been 1AFAP01-TPAFS.

This is a hardware failure basic resolved and closed by event. An evaluation should be done to determine the an update of the PRA fraction of the basic event that is recoverable.

This model.appears in numerous sequences (e.g. 7830 & 14989 The PRA model recovery[per PRA Study 1 3-NS-C29 Rev.3] [per C-29 Rev.3]). action for the AFA pump has been modified to appropriately consider the fraction of recoverable events.QU-04 QU-1 8, QU-1 9 A Closed Currently, RE-AFA-LOCAL is inappropriately being used The finding has been to recover some [Stuck Open Safety Valve] SOSV resolved and closed by events. The initial failure of the AFW Pump A causes a an update of the PRA primary safety lift. The recovery of AFW Pump A would model.not prevent a lift. Therefore, RE-AFA-LOCAL should not The PRA model recovery be used when the primary safety valves lift, has been removed from stuck open safety valve__________

_____________________________________events.

HR-04 HR-9 A Closed It was stated in the opening presentations that the The finding has been operators would take manual control of the AFW flow resolved and closed by path globe valves. This action is not modeled. The an update of the PRA current model appears not to include any action to model.control flow with the exception of local manual control. The PRA model now credits remote manual operation of the AFW______f low path valves.SY-12 SY-18 A Closed Batteries C and 0 appear to have at least a 24-hour The finding has been mission time prior to depletion.

This results in resolved and closed by instrumentation being available to adequately control an update of the PRA AFW. The bases for the 24-hour mission time are not documentation.

The documented.

basis for the 24 hour________ _______________mission time is provided.6-4 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)__________________________________

HR-06 HR-20 A Closed The cycling of the AFW flow path globe and gate valves The finding has been to maintain AFW flow is not modeled. resolved and closed by an update of the PRA model.The PRA model now includes cycling of the_________

______________________________________AFW flow path valves.IE-7 IE-12 B Closed The Interfacing Systems Loss of Coolant Accident The finding has been (ISLOCA) treatment for the shutdown cooling suction resolved and closed by line appears to have some questionable assumptions.

an update of the PRA First, it is assumed that the Low Temperature Over model which now Pressure (LTOP) valve would always open. While this is includes failure of the the most likely scenario, the LTOP valve can fail to LTOP valve to open and open. Qualitative arguments were made that should this includes the shutdown happen, the resulting LOCA would be inside cooling warm up containment (primarily based on relative pipe lengths).

crossover piping.This ignores the fact that the high stress points and stress concentration points are outside containment.

Furthermore, the shutdown cooling warmup crossover piping was not considered.

IE-8 IE-5 B Closed Loss of multiple vital 125 VDC and loss of multiple vital The finding has been 120 VAC buses are not considered as initiators, resolved and closed by an update of the PRA model which now includes loss of multiple vital 125 VDC and 120 VAC buses as initiators.

6-5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

___AS-02 AS-04 B Closed A discussion of Reactor Vessel Rupture was not found. The finding has been An internal fire PRA was not performed so accident resolved and closed by sequences were not generated to capture the impact of an update of the PRA a fire. Also there does not appear to be coding of model which now locations for basic events. (FIVE methodology was used includes reactor vessel to assess fire impact). Internal flooding is also not rupture event. Separate specifically included in the accident sequences and no internal fire and internal spatial data appears to have been developed (same flood models have could be used for fire and flooding).

Industry Degraded subsequently been Core Rulemaking (IDCORE) methodology was used to created to address the perform flooding evaluation and this determined that remainder of the finding.there are no critical flooding areas.AS-5 AS-24 B Closed The Modular Accident Analysis Program (MAAP) The finding has been analyses used to support timing for human actions look resolved and closed by only at a selected set of parameters of interest and an update of the PRA neglect to look at the status of other systems which may model. Additional MAAP affect timing and/or success criteria.

One particular analyses have been example is that the Turbine Bypass System is assumed performed and to "always work" when evaluating the time available for associated human recovery of AFW. reliability actions added to the PRA model to address the status of other systems which_________

________________

______ ______________________________m__act__eimpattevntmtming 6-6 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times_________Table A6-1 Internal Events PRA Peer Review A and B Level Findings __________

Observation Sub- Level Status Finding(s)

Disposition ID elemnent(s)

SY-02 SY-1 B Closed There is no document that specifies the content, The finding has been requirements, and formatting for each system study. resolved and closed by This would aid external observers and newcomers in an update of the PRA understanding the intent of the system analysis documentation.

The PRA documentation.

model system studies have been abandoned and replaced with more specific documentation of how systems are modeled in the PRA.SY-03 SY-3 B Open, but Many of the assumptions contained in the AFW analysis The specific issue of will be address plant phenomena, but contain no plant AFW diversion flow closed by references.

For example, AF024, states no significant paths has been meeting diversion paths were identified.

But no detailed addressed and ASME discussion is provided.

There are several piping taps documented.

However, iPRA Std from the condensate storage tank (CST). From a the more general issue SR SY- walkdown some of these taps occur high in the tank, of references for system C1 while others associated with the condensate transfer analysis modeling is a pumps are low in the tank. It is not clear that potential subset of meeting the diversions through the condensate transfer pumps have requirements of ASME been examined.

The drawings that illustrate the flow SR SY-C1, which is destination for the pumps are not referenced in the AFW listed as "Open" in Table system study: DGP-001, ECP-001, and EWP-001. It A6-2.also appears that the assumptions themselves are not independently reviewed.

As a result, the independent See Table A6-2 item SR reviews of the system studies are not complete.

Each SY-C1 for disposition of individual assumption should have plant documentation the more general issue and an independent review. The system study associated with this independent review would then only need to ensure that finding.the assumption is applicable to and reflects the model itself. This appears to be what is done now, but without an independent review of the assumptions.

6-7 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

__________

SY-05 SY-4 B Open, but It is difficult to verify that the systems are in agreement This issue is part of will be with the as-built conditions.

The current software is only ASME SR SY-C1, which closed by capable of displaying a two by three portion of the fault is listed as "Open" in meeting tree. When attempting to verify the AFW system, only a Table A6-2. See Table ASME sample of the fault tree was examined.

From the portion A6-2 item SR SY-C1 for PRA Std examined no discrepancies were identified.

There were disposition of this finding.SR SY- no direct references between the fault tree supports and C1 the plant drawings.

For example the power supplies to the motor driven pumps are contained in the fault tree, but a plant drawing reference is not directly linked to this dependency.

The back of the system study does provide i a list of references, but the specific references are not linked to dependencies.

Not only does this make review by outside personnel difficult, it makes internal independent reviews difficult as well.IDA-01 DA-4 B Closed In quantifying the failure rate of the turbine driven AFWV The finding has been Spump to start and run, failures were not considered resolved and closed by based on modifications to prevent turbine overspeed an update of the PRA trips due to excessive condensation in steam lines. That documentation.

is, failures that occurred prior to 1995 (that were Sufficient plant operating determined to be due to excessive condensation), were experience has elapsed removed from consideration.

A reduction in the impact of since this finding was these failures would be more appropriate than provided to substantiate eliminating these failures from consideration.

exclusion of condensate line overspeed events from the failure rate of the AFA pump. This evidence was documented as part of the data update.6-8 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

DA-02 DA-06 B Closed Currently for demanded components, the failure The finding has been likelihood is assumed directly related to the surveillance resolved and closed by interval.

The equation used is 1 -exp(- an update of the PRA lambda*(interval)/2).

This assumption is predicted on the documentation.

This assumption that the likelihood of failure on demand is issue has been resolved purely proportional to the hourly failure likelihood.

This is by providing the not necessarily true. Analysis should be done to ensure requested evidence in that the demand failure likelihoods are appropriately the PRA documentation.

calculated.

There are components of the demand failure rate that are not proportional to time such as shock and human errors.DA-9 DA-9 B Closed When grouping components together for data, are The finding has been component specific data differences reviewed. (i.e. are a resolved and closed by disproportionate number of failures attributed to one an update of the PRA component but spread out over several)?

Also are the documentation.

This numbers of demands/run hrs comparable?

issue has been resolved by considering component specific differences in the grouping of components.

DA-07 DA-1 3 B Closed The NSAC document referenced in evaluating the loss The finding has been of offsite power (LOSP) frequency and duration (NSAC- resolved and closed by 203, "Losses of Offsite Power at U.S. Nuclear Power an update of the PRA Plants thru 1993") is not current. More recent NSAC and model and EPRI documents are available as a reference source. documentation.

These documents have the potential to increase the Subsequent updates of likelihood of offsite power recovery since LOP events the PRA model have and their duration have trended downward.

used the current EPRI loss of offsite power_________

_________

_____ ___________________________________________data.

6-9 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times________Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

DA-08 General B Closed Plant specific data was derived from a limited number of The finding has been years data (1994 thru 1996) resolved and closed by an update of the PRA model and documentation.

Plant specific data has subsequently been updated up to 2013.HR-01 HR-i, HR-i14 B Closed Guidance effectively describes the quantification The finding has been process. Two areas were identified for possible resolved and closed by improvements:

1. The process and degree of operation an update of the PRA input and review is not documented.

Operation input as documentation.

This described appears to be marginal.

It was stated that issue has been operator input was always obtained for knowledge addressed by upgrading based actions and was obtained as required for the human reliability complete skill and rule-based actions. A better practice analysis documentation would be to have all actions developed with operator to address the issues.input. 2. The process for selecting Human Reliability The HFEs have been Analyses (HRAs) was not described.

A process is placed into the EPRI identified in Systematic Human Action Reliability HRA calculator, which Procedure (SHARP). It appears that the SHARP process provides a consistent was not used. However, an undocumented, iterate and detailed process between the system analyst and the human documentation of the_____action analyst appears to be adequate.

HRAs.6-10 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

_______________________

IHR-08 HR-25 B Closed A sensitivity study to determine human action The finding has been dependencies was not performed nor documented with resolved and closed by the PRA results. This is considered to be a good an update of the PRA practice to ensure dependent human actions are not documentation.

The inappropriately used. A sensitivity analysis was requested sensitivity performed during this review. No issues were noted. analysis was performed and documented on human action dependencies.

6-11 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- [Level [Status TFinding(s) 1 Disposition ID element(s)___I HR-09 HR-20 B Closed Human Action (HA) 1AFN-MSIS-....HR is failure of the operator to override [main steam isolation signal] MSIS and align the N pump. This action includes diagnosis error. The action 1AFN-MSIS-ND-HR, is a modification factor to remove the diagnosis component of 1AFN-MSIS-....HR.

In the quantification of these two elements [PRA Study 13-NS-B62, Human Reliability Analysis]

(1 3-NS-B62, p90 and 91 ) it is stated that 1AFN-MSIS-ND-HR is to be used with 1AFN-MSIS-....HR when it occurs in conjunction with failure to align or utilize the code pumps, i.e., in conjunction with another human action (HA) that had an equivalent diagnosis element. This is considered appropriate.

However, as seen in cutset 10 and others, these two HAs are being used together in cutsets which do not include another HA with the equivalent diagnosis element. This is inappropriate.

In cutset 10, the initiator is loss of 125 VDC PKB-M42 which results in loss of one AFW pump, an MSIS, failure of the downcomer valves, failure of the turbine-driven AFW pump and the 1AFN-MSIS

....HR/i1AFN-MSIS-ND-HR combination.

This does not appear to be appropriate because there is no other HA which includes the requisite diagnosis error. This is contrary to the stated application conditions in 13-NS-B62.

The above discussion also applies for the 1AFW-MFW-...HR/1 AFW-MFW-ND-HR combination and any other equivalent combinations.

After looking at models in more detail, found that there was another Human Action in the chain. Direct solution of the trees would yield a cutset with two [Human Error Probabilities]

HEPs. A recovery analysis pattern removed the two related Human actions and replaced them with the pairings discussed above. The concept appears to be appropriate but the manner in which it is applied is confusing at least in this case.The finding has been resolved and closed by an update of the PRA documentation.

The subject human reliability analysis and associated documentation for override of the MSIS and aligning the N pump has been revised to account for this issue.6-12 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings _________Observation~

Sub- ILevel IStatus [Finding(s)

[Disposition ID J element(s)

_ _ I_ _ _ _ _ _ _ __ _ __ _ _ _DE-02 DE-l, DE-3, DE-5 B Closed As mentioned earlier there is no guidance for the system analysis process. This applies to the dependency aspect of the process as well. Section 3.3 of a system study lists the dependencies associated with the system. In general, the table appears to completely describe the dependencies associated with the system. I did notice several cases in the high pressure safety injection (HPSl) system study where the component numbers were not identified:

1PHAM37-480-1 PW/GHLIA1-2, 1 PHBM38-480-1 PW/GHI2-9, 1 SAARAS-TRA--

1AT/GRASA-K405

[MOV 674], etc. In some cases, it was possible to determine the component dependency.

In other cases, it was not. Each component and its associated dependency should be explicitly identified.

The dependencies associated with hot leg injection appear to be improperly identified.

MOV-321 should be 4PKCM43-125--1PW and MOV-331 should be 4PKDM44-125--1 PW. The plant references for the dependencies are not directly linked to unique component dependencies.

Instead, the references are listed in a single large mass in Appendix D. It would probably save time and lead to better traceability if the references are directly associated with each dependency.

There are no plant references associated with the [heating, ventilation and air conditioning]

HVAC dependencies dedicated to the HPSI system. This applies to 1 EWAECOOLWA--10OP, 1 EWBECOOLWB--

10OP, 1 PHBM38-480-1 PW, 1 SPAESPA---10OP, etc. The plant references could be a simple as [Updated Final Safety Analysis Report] UFSAR text if direct failure is assumed to be as complicated as design heat-up calculations.

The finding has been resolved and closed by an update of the PRA documentation.

References for dependencies and HVAC success criteria have been added to the PRA documentation.

6-13 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B3 Level Findings Observation I Sub-i Level IStatus [Finding(s)

I Disposition ID element(s)

___ _______________________

__ ______DE-05 DE-4 B Closed Although dependencies are identified in the system analysis, there is no dependency matrix. A dependency matrix is a valuable tool for reviewers and newcomers to the group. I believe that our evaluation of Accident Sequences would have been much more comprehensive with a dependency matrix. There are no plant references associated with the HVAC dependencies dedicated to the HPSl system. This applies to 1 EWAECOOLWA--10OP, 1 EWBECOOLWB--

lOP, 1PHBM38-480-1PW, 1SPAESPA---1OP, etc. The plant references could be a simple as UFSAR text if direct failure is assumed to as complicated as design heat-up calculations.

The finding has been resolved and closed by an update of the PRA documentation.

A dependency matrix has been added to the PRA documentation.

B Closed Since the general rule is documented as one-recovery action per sequence [13-NS-B62] (B-062), exceptions should be noted and justified.

For example, the GT recovery and the AFW PP A recovery actions are credited redundantly.

This is probably appropriate, but the paragraph in B-062 indicates this is not typically done. Therefore justifying the exceptions is probably appropriate.

The finding has been resolved and closed by an update of the PRA documentation.

Exceptions to the recovery actions were justified.-f f I , B Open, but will be closed by meeting ASME PRA Std SR SY-C1 The documentation is considered marginal largely based on the lack of traceability of the system studies to plant documentation for each component dependency.

This issue is part of ASME SR SY-C1, which is listed as "Open" in Table A6-2. See Table A6-2 item SR SY-Ci for disposition of this finding.6-14 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings __________

Observation Sub- Level Status Finding(s)

Disposition ID element(s)

__________

QU-01 QU-1 B Closed The quantification report describes the quantification, but The finding has been the process is difficult to follow unless knowledgeable resolved and closed by about the code used and the specific steps to follow. It is an update of the PRA sometimes hard to determine the basis for the delete documentation.

term logic and the recovery patterns.QU-05 QU-1 8, QU-1 9 B Closed It would probably be a good idea to delete the front *s in The finding has been the recover search equations.

I did not find any resolved and closed by instances where this caused a problem in the existing an update of the PRA model, but it could be causing problems by accidentally model recovery selecting the middle of a basic event verses the instructions.

beginning.

QU-07 QU-25, QU-26, B Closed Even though the data bases contain error factors and This issue has been QU-28 their code has the capability to easily perform numerical addressed by performing uncertainty analyses, APS did not perform any and documenting the uncertainty analyses for this update of the Probabilistic quantitative uncertainty Safety Assessment (PSA) and they did not document analysis.any sensitivity studies on the impact of key assumptions

__________

~~~as part of this PSA update. __________

MU-03 iMU-4 B Closed The types of changes tracked by the PRA and how this The finding has been information is obtained are not specified in enough detail resolved and closed by within the procedure.

an update of the PRA________ __________

_____model update procedure.

MU-08 MU-li, MU-12 B Closed There is limited guidance on what needs to be The finding has been considered for reevaluation when a significant change to resolved and closed by the PRA models takes place. an update of the PRA_________model update procedure.

6-15 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)

HR-03 HR-4, HR-5, B Closed In the HRA document (862), Section 4.2, concludes that The finding has been HR-6, HR-7 miscalibration and common cause miscalibration of resolved and closed by critical sensors is negligible at PVNGS. This is not an update of the PRA consistent with the results from other PRAs. Specifically, model common cause the first supporting paragraph of dedicated teams does modeling to match the not minimize exposure to common cause, it actually NRC common cause maximizes common cause. PVNGS's staff previously database treatment.

identified this item.AS-03 AS-6, AS-7, B. Closed There are some differences between treatment of a The finding has been AS-8, AS-24 small LOCA associated with a pipe break and an resolved and closed by induced small LOCA (pressurizer safety valve reclosure) an update of the PRA in the transient event trees. For example: model and*In the small LOCA event tree, successful high pressure documentation.

injection and recirculation lead to questioning whether containment heat removal is successful.

In the Transient Type 2 and Transient Type 3 event trees, RCS integrity can be lost if pressurizer safety valves do not reset after lifting. In the sequences from these event trees where high pressure injection and recirculation are successful, the question relating to containment heat removal is not asked.* In the small LOCA event tree, RCS depressurization and use of low pressure injection and recirculation are considered if high pressure injection or recirculation fails.In the Transient Type 2 and Transient Type 3 event trees, consideration of RCS depressurization and use of low pressure systems is not included because the likelihood of high pressure injection or high pressure recirculation are small. It would seem that this_________

_______________

______assumption should apply to both cases, or not.6-16 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-1 Internal Events PRA Peer Review A and B Level Findings Observation Sub- Level Status Finding(s)

Disposition ID element(s)__________________________________

SY-13 SY-17, SY-20 B Closed The control system study states that only single failures The finding has been that cause the failure mode of interest are considered.

resolved and closed by For the Auxiliary Feed Actuation System (AFAS) an update of the PRA generated signals, which results [these result] in model and modeling common cause only. Although this approach documentation to add may provide a good estimate of the failure rate of these the indicated control safety signals, it does not necessarily provide the system dependencies.

confidence that the signals are appropriately modeled.For AFAS, it appears that since the AFW flow path valves must cycle that control system dependencies may have been missed. That is, normally engineered safety features actuation system] (ESFAS) relays appeared to be locked-out following actuation, but for the AFAS valves, the relays need to react to the process system steam generator (S/G) low and high level. It is likely that 120 VAC Vital Bus A and B are needed.6-17 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-2 Internal Events PRA Self-Assessment of ASME SRs Not Met to Capability Category II SR Status Self-Assessment Comments Disposition 3Y-C1 Open System analysis documentation developed during the This SR will be fully met by updating the system analysis Individual Plant Examination (IPE) was abandoned documents per the requirements of SR SY-C1 prior to use prior to issuance of the ASME PRA. Key elements of of the RIOT Program.the system analysis documentation have been subsequently captured in other PRA documentation that is not designated as system analysis documentation.

SY-C2 Open the following subsections of SR SY-C2 are not met: ,s indicated, most elements of this SR are addressed in ic, e, j, o, p. The original system analysis PRA model documentation.

However, there is no single documentation developed during the IPE PRA document which captures all of the elements and includes development was abandoned prior to the issuance of the not met subsections of SR SY-C2.!the ASME PRA Standard.

Other subsections of SR SY-C2 (a, b, d, f, g, h, i, k, I, m, n, q, r, s) are met by This SR will be fully met by updating the system analysis alternate documentation generated when the system documents per the requirements of SR SY-C2 prior to use analysis documentation was abandoned.

of the RIOT Program.6-18 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition IFSO- Closed As noted in SRs IFSO-A1, IFSO-A3, and lFSO-A5, some areas This finding has been resolved by a B2 of the documentation do not provide sufficient detail about the documentation update. The following PRA process used. Specific items for which improved documentation studies have been revised to provide detail is needed include: about the specific items needed for a. Documentation of sources in the Turbine Building.

improvement:

b. The basis for screening sources in the Fuel, Radwaste, and Turbine Buildings (i.e., the way in which the specified criteria a. PRA Study 13-NS-C094 section 4.2.6 was are met for each source is not documented).

For example, a revised to include the flooding sources in the walkdown during the peer review revealed that there is Turbine Building.section of the wet pipe fire protection (FP) system running b. Revised PRA Study 13-NS-C094 sections above the turbine cooling water (TO) pumps that could 4.2.5 and 4.2.6 to include justification for potentially spray both pumps. It is not clear based on 1 3-NS- screening sources in the Fuel, Radwaste, and 0093 and 1 3-NS-C094 that this impact was considered and Turbine Building.dispositioned.

Likewise, feedline breaks in the turbine c. The temperatures and pressures of the plant building are assumed to be bounded by the loss of main fluid systems do not need to be defined as all feedwater initiating event, but may have different impacts flooding impacts are inherently considered such as loss of instrument air due to humidity impacts. due to the Assumption 2 in PRA Study 13-c. The temperature and pressure of flood sources. NS-C096 which identifies that all equipment in the flood area in which a flood initiates, is assumed failed. Therefore it is not necessary to describe systems in terms of pressure and temperature to determine potential flood induced failure modes.IFEV- Closed Potential flooding mechanisms are primarily limited to failures of This finding has been resolved by a A7 components.

Human-induced flooding is screened based on documentation update. PRA Study 13-NS-C097 plant maintenance practices (see 13 NS-C093, Section 3.2, Section 4.1 was revised to document the review Item 4 and 13-NS-C097, Section 3.5). This does not indicate of human and maintenance induced flooding that there was any search of plant operating experience and events. A review of PVNGS maintenance plant maintenance procedures to verify no potential for human- guidance documentation and procedures via induced flood mechanisms.

plant personnel discussions did not identify any maintenance procedures which would lead to an internal flooding scenario.6-19 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition IE-C5 Closed Generic pipe failure frequencies from EPRI TR-1 0131 41 were This finding has been resolved by a not converted to a per reactor-year basis as required by SR IE- documentation update. PVNGS has revised the 05. quantification studies tO clarify that the results are specifically in units of "per critical-reactor year" that is directly applicable to At-Power operating plant states. In addition, to support PRA applications that relate to risk in terms of annualized risk, the engineering studies documenting the quantification and results were revised to also provide converted core damage frequency (ODE) and large early release frequency (LERF) in units of "per reactor-year"_____ _____ _______________________________________[per calendar-year].

IFQU- Closed Sources of model uncertainty and related assumptions for the This finding has been resolved by a A7 Internal Flooding (IF) quantification are documented in 13-NS- documentation update. PRA Study 13-NS-C099 0099, Section 3.1.3. As noted in other SRs related to Section 4.4 was revised to incorporate the assumptions and sources of uncertainty, there is no characterization of model uncertainty sources.characterization of the impact of these assumptions and Each assumption and source of model sources of uncertainty on the IF model as would be required by uncertainty has been characterized according to backward reference to SRs QU-E4 and QU-F4 in SR IFQU-A7. the draft Pressurized Water Reactor Owners_____Group (PWROG) PA-RMSC-0594.

6-20 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition IFSN- Closed Based on the decision trees in the Scenario document 13-NS- This finding has been resolved by a A16 096 Revision 0, (example Figure 4.2.1.1-1, Sequence documentation update. PRA Study 13-NS-C096 040A1 S02), many flood sources that can be isolated have been section 3.1 .1 was revised to describe the reason screened out based a simple assertion that the flood can be for screening out successfully isolated floods.isolated without documenting any of the following:

a. Whether flood indication is available in the control room, b. How and where the flood source can be isolated, and c. Whether procedures exist for isolation and how much time is available for isolation.

Based on a discussion with the plant PRA personnel, the peer review team judged the screening to be reasonable, but documentation is not adequate.

The review team judged this to be met at [Cat] C I, but even for this, proper documentation is______ ~needed as noted in the finding. ____________________

IFSN- Closed RG 1.200 Revision 2 documents a qualified acceptance of this This finding has been resolved by a A6 SR. The NRC resolution states that to meet Capability Category Idocumentation update. Assumption 2 in PRA II, the impacts of flood-induced mechanisms that are not study 13-NS-C096 was rewritten to clarify that formally addressed (e.g., using the mechanisms listed under all components within a flood area where the Capability Category Ill of this requirement) must be qualitatively flood originates were assumed susceptible and assessed using conservative assumptions.

failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., water-proofing), spatial effects, low pressure source potential or other reasonable judgment could be used for limiting_____________the effect.6-21 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-3 Internal Flood PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition I FEV- Closed There is no evidence in 13-NS-C097 that a search was made This finding has been resolved by a A6 for plant-specific operating experience, plant design features, documentation update. PRA Study13-NS-C097 and conditions that may impact flood likelihood and no Section 4.1 was revised to add evidence of the Bayesian updating was performed.

However, adjustments are search for plant specific operating experience.

made to some initiating event frequencies based on system run The PVNGS Site Work Management System times to account for differences between impacts when the database and License Event Reports were pumps are running or in standby. searched for flood type events. Additionally, the PVNGS maintenance procedures were reviewed for flood prevention guidelines.

It was determined that none of the flood events identified represented a credible internal flooding scenario which would require additional modeling efforts. Additionally, the lack of internal flooding events does not provide sufficient information to perform a Bayesian update to the initiating event data, and therefore, no update was performed.

6-22 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SHA-E1 Closed Insufficient site-specific velocity profile documentation exists to This issue was resolved and reflected in the review the base case profile and possible uncertainties in the PRA model and documentation.

New site site shear-wave velocity profile. Because the site fundamental specific data was subsequently collected as part soil resonance may be near 1 second, a period that may be of the NTTF 2.1 analysis.near a critical structural resonance, documentation of the epistemic uncertainty and aleatory variability of the site velocity profile should be developed.

SHA-E2 Closed The evaluation and incorporation of uncertainties in the site A SSHAC L3 analysis was performed response velocity profile may not be properly incorporated subsequent to the seismic PRA development as because of insufficient or unreviewable site-specific data and/or part of the NTTF response to the NRC 50.54f its documentation.

Also, the site response evaluation was letter on Fukushima.

The SSHAC L3 analysis completed using a Senior Seismic Hazard Analysis Committee produced a site hazard curve which is bounded (SSHAC) Level 1 (Li) process which does not meet the ASME by the SSHAC Li hazard curve developed and general Capability Category II guidelines, used in the Seismic PRA model. Therefore, the issue is resolved by the updated SSHAC L3 hazard analysis.SFR-A1 Closed Some of the dispositioning in the complete seismic equipment This issue was resolved and reflected in the list (SEL) does not have adequate documentation to justify PRA model and documentation.

Contractor screening of selected components.

For example, component performed walkdown and screening evaluation 1 ENANS01 (13.8 kV Non-Class 1 E Switchgear 1 ENANS01) is to compare the estimated seismic capacities of dispositioned (screened) by the statement "Seismically induced selected Non-Safety Related equipment to the failure of NA system (non-seismic class) assumed addressed capacity assigned to loss of offsite power through seismic LOSP." The median fragility of seismic LOSP is (LOSP).0.3 g. For this screening to be viable, APS should demonstrate that the median fragility of 1 ENANS01 is significantly higher Re-quantification was performed to reflect than 0.3 g. However, these are non-Class 1 E electrical updated hazard, updated fragility information components.

This type of screening argument is used many and updated S-PRA modeling following the times within the complete SEL presented in Appendix B of CN- resolution of Findings and Observations from____RAM-i12-015.

the industry peer review.6-23 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SFR-C6 Closed The CDF is dominated by peak ground acceleration (PGA) in This issue was resolved and reflected in the the range of about 0.3 g. Therefore, the effect of using input PRA model and documentation.

Contractor motion at the 0.3g PGA level should be examined.

Contrary to performed evaluation of increased uncertainty the self-assessment, the soil data is not sufficient to justify a Cv for soil properties.

= 0.5. The effect of using Cv = 1.0 should be examined.Re-quantification was performed to reflect updated hazard, updated fragility information and updated S-PRA modeling following the resolution of Findings and Observations from the industry peer review.SFR-F2 Closed The top seven cutsets involve seismic failure events. (SF- This issue was resolved and reflected in the TBBLD, SF-SOIL, and SF-ME) that are potentially conservative PRA model and documentation.

Contractor with respect to seismic fragility and may be resulting in a performed seismic fragility investigation for seismic CDF that is not accurately reflecting the true plant PVNGS Unit 1 Main Feedwater (FW) system.response to seismic events. More analysis is required to either justify the seismic fragilities presented or to refine those values. Re-quantification was performed to reflect updated hazard, updated fragility information Event SF-TBBLD represents structural failure of the turbine and updated S-PRA modeling following the building, resulting in collapse onto the underground pipe tunnel resolution of Findings and Observations from from the CST. The concrete cover over the pipe tunnel is the industry peer review.postulated to fail, resulting in failure of the AFVW piping from the CST to the AFW pumps. There is the potential that the turbine building failure might not fail the pipe tunnel.Event SF-ME involves seismic failure of main feedwater piping outside of containment (balance of plant). The fragility of this piping is based on a "generic" evaluation of SC-Il components and is given a median acceleration of 0.21 g.6-24 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SFR-F3 Closed The draft report LTR-RAM-II-12-074 indicates that the draft This issue was resolved and reflected in the relay assessment uses the IPEEE relay assessment as the PRA model and documentation.

LTR-RAM-starting point but accounts for the updated seismic hazard curve 11-12-074, Revision 2 incorporated the 69 at the site. However, the report includes the following statement previously unaddressed relays.in Section 2.3 (Unaddressed Relays): Re-quantification was performed to reflect"This list [unaddressed relays] included 69 such relays. Of the updated hazard, updated fragility information relays that have been included in the SPRA, their seismic and updated S-PRA modeling following the fragility events are found in many of the dominant ODE cutsets", resolution of Findings and Observations from the industry peer review.6-25 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SPR-B1 Closed CN-RAM-12-015, Rev. 0, Palo Verde SPRA Model The first part of this finding is considered Development, identifies the followring for the Self-Assessment resolved based on conducting a RG 1.200 self-for SPR-B1 : "The S-PRA relies on an internal events model that assessment of the internal events PRA model is assumed to be compliant with CCII of the PRA described elsewhere in this Enclosure and Standard." subsequent peer reviews of the internal flood and internal Fire PRA models which are based It is understood that the PVNGS PRA model received an on the internal events PRA model.industry PRA peer review in 1995 per the CEOG guidelines when the PRA model existed in the Risk Spectrum software The second part of this finding is considered environment.

The current PVNGS PRA model has since been resolved by CN-RAM-12-024 Revision 1 that converted to the CAFTA software environment.

APS has since updated the seismic HEPs based on timing and performed a self-assessment of the PVNGS FPIE PRA model closed all open items from Revision 0.against the ASME/ANS Standard, but a number of SRs do not meet Capability Category I1. Re-quantification was performed to reflect updated hazard, updated fragility information Furthermore, as discussed in Section 4.2 of CN-RAM-12-024, and updated S-PRA modeling following the there are five (5) open items from the FPIE HRA. Open Item #5 resolution of Findings and Observations from addresses that many values of T1/2 were not provided in the the industry peer review.HRA Calculator, which indicates that the time required to perform the actions may not be accurate (FPIE SR HR-G5).In addition, Section 4.3.1.4 identifies that PVNGS only uses the Cause-Based Decision Tree Method, which is known to underestimate the impact of time constrained HEPs and as a result, current expectation for meeting supporting requirement HR-G3 is to use a combination of CBDTM and HCR methods to ensure that timing is accurately reflected.

6-26 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SPR-B6 Closed The review team could find no evidence that operator actions This issue was resolved and reflected in the following relay chatter events were reviewed to ensure task PRA model and documentation.

LTR-RAM-does not change (e.g., additional execution steps to reset relay) 11-12-074, Revision 2 performed a if action is in response to relay chatter-induced failure. comprehensive relay assessment to address this finding.Re-quantification was performed to reflect updated hazard, updated fragility information and updated S-PRA modeling following the resolution of Findings and Observations from the industry peer review.SPR-B7 Closed Complementary success logic is added in the SPRA logic on a This finding is considered resolved based on sequence basis for the SIET via the SHIP software, but not for meeting Addendum B of the ASME PRA Std, each basic event that represents a seismically-induced failure. which changed the requirement for this This is a limitation of the PRA technology and software which supporting requirement.

was also noted in the Surry report. As such, this SR is assessed as Not Met.However, SR SPR-B7 has been modified in the proposed revision of the PRA Standard (i.e., Addendum B). At the moment this calculation note's publication CC I/Il of the equivalent SR in Addendum B (SPR-B5) reads as follows: "In the systems-analysis models, for each basic event that represents a significant seismically-caused failure, INCLUDE the complementary "success" state where applicable to a particular SSC, and DEFINE the criterion used for the term"significant" in this activity".

Based on the wording of the new version, success logic addressing significant seismically caused failures are included in the model. With reference to the new wording of SR SPR-B5, this SR could be assessed as met at____________CCI/II.

_______________

6-27 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-4 Seismic PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition SPR-B10 Closed Row SPR-B10 in Table 4.5-2 of CN-RAM-12-015 (i.e., the CN-RAM-12-015 Revision 1 addressed this summary table of the SPRA self-assessment) identifies the finding.need to examine the effect of including a seismically-induced"small-small" LOCA. The self-assessment identifies that Section Re-quantification was performed to reflect 5.1.3.9 discusses modeling a concurrent "small" LOCA. updated hazard, updated fragility information and updated S-PRA modeling following the Section 5.1.3.9 identifies that a seismic-induced Small LOCA resolution of Findings and Observations from probabilistically models a seismic-induced LOSP. It is assumed the industry peer review.that this scenario would also address the scenario for a Seismic-induced LOSP with a potential for a "small small"_____ _____LOCA.

________________

6-28 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to Capability Category II SR Status Finding(s)

Disposition FSS-D2 Closed Generic HGL calculations were performed using OFAST This finding has been resolved by PRA model and documented in Hughes report 0001-0014-002-002, and documentation changes.Rev 1. The CEAST HGL results have not been applied in a manner consistent with the limitations and assumptions Generic CFAST evaluations were revised to be described in the report, specific to account for the limitations and assumptions of the area being modeled.EQ-El Closed Several Human Failure Events (HFEs) were discovered to This finding has been resolved by PRA model have a failure probability set to zero during the and documentation changes.quantification instead of the documented screening value of 1.0 developed during the HRA task. Having the HEPs HFEs documented to have a screening value of set to zero potentially impacts the quantification results and 1 .0 have been revised in the model to use this the ability to identify significant contributors to CDF, such screening value. All HEE tools were reviewed, as initiating events, accident sequences, equipment updated to be consistent with the HRA failures, common cause failures, and operator errors. Calculator source database, and validated.

There is no documentation that shows that a review of the A review of component and basic event importance of components and basic events to determine importance to ensure they make logical sense that they make logical sense was performed.

was subsequently conducted and documented.

There is no documentation that a review of nonsignificant Conduct of cutset reviews was added to the cutsets or sequences was performed.

PRA documentation.

6-29 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A6-5 Internal Fire PRA Peer Review ASME SRs Not Met to Capability Category II SR Status JFinding(s)

IDisposition UNC-A1 Closed The following statement was made after several sensitivity results tables: "Because of the way the cutsets were created, the numbers are not correct. The exercise here is to show the ratios." This negates any of the results reported in the results table.The uncertainty analysis, for the most part, does not include any review of the uncertainty results. Therefore, how the PRA model was affected and a check for the reasonableness was not documented.

Therefore it is not clear that a check for reasonableness was performed.

There is a statement in the Uncertainty Analysis notebook that this analysis was not performed for LERE. Upon review of the notebook it was found that for some uncertainty analyses were run for both ODE and LERF. A review of the uncertainty analysis should be performed and all uncertainty analysis should be performed for ODE and LERF.Many instances were found where assumptions were found in notebooks that were not documented in the assumption section. This could lead to missing an area that needs to be addressed in the uncertainty analysis. (Review documents and verify that where the word "assumes" is used that an actual assumption is being made.)This finding has been resolved by PRA model and documentation changes.The sensitivity results were reviewed and documented to show ratios of results.Documentation has been updated to include how the PRA model is affected by model uncertainty and related assumptions.

Sources of LERF uncertainty and assumptions have been identified and documented.

All assumptions used in the development of the PRA model have been reviewed and documented.

Instances of modeling simplification or conservatism were so noted versus declared as default assumptions.

Assumptions with the potential to significantly impact results were addressed in the Uncertainty and Sensitivity analyses 6-30 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times References

1. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)

2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009 3. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071 200238) dated May 17, 2007 4. ASME/ANS RA-Sa-2009, Standard for Levell/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009 5. NRC Letter Palo Verde Nuclear Generating Station, Units 1,2, And 3 Issuance of Amendments Re: Adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b" (ADAMS Accession No., ML1 12620293), dated December 15, 2011 6. Palo Verde Engineering Evaluation 3579223 Revision 1, dated April 10, 2011 7. ABB Combustion Engineering Owners Group Final Report, Palo Verde Nuclear Generating Station Units 1, 2, and 3 Probabilistic Safety Assessment Peer Review Report, dated November 1999 8. Westinghouse Letter LTR-RAM-II-10-082, Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Palo Verde Nuclear Generating Station Probabilistic Risk Assessment, dated November 5, 2010 9. Westinghouse Letter LTR-RAM-II-13-005, Peer Review of the Palo Verde Nuclear Generating Station Seismic Probabilistic Risk Assessment Against the Seismic PRA Standard Supporting Requirements of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 13, 2013 10. Westinghouse Letter LTR-RAM-1 2-13, Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS PRA Standard for the Palo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment, dated January 2, 2013 11. Hughes Associates Report 00101 4-RPT-01, Palo Verde Nuclear Generating Station Fire PRA Focused-Scope Peer Review Report, Revision 0, dated January 22, 2015 6-31 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 7 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This attachment is not applicable to the PVNGS submittal.

APS' proposal solely uses PRA models in its Risk-Informed Completion Time Program for which there are standards endorsed by the NRC in Regulatory Guide 1.200, Revision 2.7-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACH MENT 8 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models Introduction Section 5.0, Item 5 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a justification for excluding any risk sources determined to be insignificant to the calculation of configuration-specific risk, and provide a discussion of any conservative or bounding analyses to be applied to the calculation of risk-informed completion times (RIOTs) for sources of risk not addressed by the PRA models.Scope NEI 06-09-A and the associated Pressurized Water Reactor Owners Group (PWROG) guidance (Reference 2 of this Attachment) do not provide a specific list of hazards to be considered in an RIOT Program. However, NUREG-1 855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (Reference 3 of this Attachment), provides guidance on how to treat uncertainties associated with PRA in risk-informed decision making relative to hazards that are not considered in the PRA model. Specifically, Section 6.3.3.1 of NUREG-1 855 provides the following list of external hazards that should be addressed either via a bounding analysis or included in a PRA calculation:

Aircraft impacts* External flooding* Extreme winds and tornados (including generated missiles)* External fires (addressed in Table A8-1, Screening Summary of External Hazards, by the following two External Hazards: Forest or Range Fire and Industrial or Military Facility Accident)* Accidents from nearby facilities

Pipeline accidents (e.g., natural gas)* Release of chemicals stored at the site* Seismic events* Transportation accidents* Turbine-generated missiles The scope of this Attachment considers the above hazards for PVNGS, except for seismic events which are addressed by the PRA model.Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of risk-managed TSs. Consistent with NUREG-1 855, the process includes the ability to address external hazards by: 8-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times* Screening the hazard based on a low frequency of occurrence

Bounding the potential impact and including it in the decision-making

Developing a PRA model to be used to calculate RIOTs and associated Risk Management Action Times (RMATs)ASME/ANS PRA Standard RS-S-2008 (Reference 4 of this Attachment) has endorsed the following set of five external hazard screening criteria: 1) The hazard would result in equal or lesser damage than the events for which the plant has been designed.

This requires an evaluation of plant design bases to estimate the resistance of plant structures and systems to a particular external hazard.2) The hazard has a significantly lower mean frequency of occurrence than another event (taking into account the uncertainties in the estimates of both frequencies), and the hazard could not result in worse consequences than the other event.3) The hazard cannot occur close enough to the plant to affect it. Application of this criterion needs to take into account the range of magnitudes of the hazard for the recurrence frequencies of interest.4) The hazard is included in the definition of another event.5) The hazard is slow in developing, and it can be demonstrated that sufficient time exists to eliminate the source of the threat or to provide an adequate response.The review of external hazards considers two aspects of the contribution to risk. The first is the contribution from the occurrence of beyond design basis conditions (i.e., winds greater than design). These beyond-design-basis conditions challenge the functionality of the systems, structures, and components (SSCs) to support safe shutdown of the plant. The second aspect addressed are the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (i.e., high winds causing loss of offsite power). While the plant design basis assures that the safety-related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless causes a demand on these systems and can impact configuration risk.Note that when the effect of a particular hazard is not able to be mitigated using the plant SS~s, then there is no impact on the changes in risk calculated to support the RIOT Program, and these hazards can be screened out of the RIOT Program as well. Only events which create a demand for mitigation equipment are potentially relevant to the RIOT Program.The review and disposition of each external hazard is addressed in Table A8-1.8-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A8-1 Screening Summary of External Hazards Screening Result ExtenalHazrd SreeedScreening EtraHaad Sree? Criterion Comment (Y/N) (Note a)Airport hazard meets 1975 Standard Review Plan (SRP)( Reference 5*)Aircraft Impact Y PS2 requirements.

Additionally, airways P4 hazard bounding analysis per NUREG-1855 is < 1 E-6/y.AvalncheY 03 Not applicable to the site because of climate and topography.

Sudden influxes not applicable to the 03 plant design (closed loop systems for Biological Event Y C5 ECWS and CWS). Slowly developing C5 growth can be detected and mitigated by___________________surveillance.

Coastl ErsionY 03 Not applicable to the site because of____ ____ location.Drouht YPlant design eliminates drought as a concern and event is slowly developing.

Plant design meets 1975 SRP Extenal loodng YPS2 (Reference 5*) requirements.

The plant design basis tornado has a Extreme Wind or yPS2 frequency

<1 1E-7/y. The spray pond Tornado PS4 nozzles (not protected against missiles)have a bounding median risk < 1 E-7/y.Limited occurrence because of arid Fog Y C1 climate and negligible impact on the plant.Not applicable to the site because of Forest or Range Fire Y 03 litevgtaon FrostLimited occurrence because of arid____ ____ ____ ____climate.

Limited occurrence and bounded by C1 other events for which the plant is HalC 4 designed.

Flooding impacts covered under Intense Precipitation.

Plant is designed for this hazard.High Summer Y C1 Associated plant trips have not occurred Temperature and are not expected.High Tide, Lake Level, y 03 loctapion.

o h it eaueo or River Stage Notappicaloonh.iteaueo 8-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screened?

ScreeningComn (Y/N) (Note a)Covered under Extreme Wind or HurrcaneY 04 Tornado and Intense Precipitation.

Ice blockage causing flooding is not applicable to the site because of location Ic ovrC3 (no nearby rivers and climate C1 conditions).

Plant is designed for freezing temperatures, which are infrequent and short in duration.Explosive hazard impacts and control Industrial or Military yPS2 room habitability impacts meet the 1975 Facility Accident SRP requirements (Regulatory Guides 1 .91 and 1.78).PRAs addressing internal flooding have indicated this hazard typically results in Interal Foodig N one CD~s > 1 E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Flooding PRA.PRAs addressing internal fire have indicated this hazard typically results in Internal Fire N None CD~s > 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Fire PRA.LandlideY 03 Not applicable to the site because of topography.

Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these Lightning Y C1 events. However, other causes are also included.

The impacts are no greater than already modeled in the internal events PRA.Not applicable to the site because Lowe Ltake Levl rC3 cooling is provided by treated RiverStagewastewater piped from Phoenix.Extended freezing temperatures are Low Winter yC1 rare, the plant is designed for such Temperature C5 events, and their impacts are slow to____ ___ ___ ___ ___ _ __ ___ ___ __ ___ ___ develop.8-4 Enclosure and Assessment of Proposed Amendment for Risk-Informed Completion Times Description Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screened?

ScreeningComn (YIN) (Note a) ________________

The frequency of meteorites greater than Meteorite or Satellite P4 100 lb striking the plant is around 1 E-8/y Impact YP4 and corresponding satellite impacts is around 2E-9/y.Pipelines are not close enough to Pipeline Accident Y 03 significantly impact plant structures.

Re lease of Chemicals yP2 Plant storage of chemicals meets 1975 in Onsite Storage YP2 SRP requirements.

Rive Divrsio C3 Not applicable to the site because of location.The plant is designed for such events.San o Dut tor YC1 Also, a procedure instructs operators to 05 replace filters before they become inoperable.

Not applicable to the site because of Seiche Y 03 location.

Onsite reservoirs and spray Cl ponds designed for seiches.PRAs addressing seismic activity have indicated this hazard typically results in CD~s > 1 E-6/y. Also, the ASME/ANS Seismic Activity N None PRA Standard requires a detailed PRA or Seismic Margins Assessment (SMA)for this hazard which is addressed in the PVNGS Seismic PRA.The event damage potential is less than C1 other events for which the plant is SnwC4 designed.

Potential flooding impacts covered under external flooding.The potential for this hazard is low at the Soil Shrink-Swell yC1 site, the plant design considers this Consolidation 05 hazard, and the hazard is slowly_________________developing and can be mitigated.

Not applicable to the site because of Storm Surge Y 03 loain Toxic gas covered under release of chemicals in onsite storage, industrial or Toxi GasY 04 military facility accident, and transportation accident.8-5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A8-1 Screening Summary of External Hazards Screening Result External Hazard Screened?

Screening Criterion Comment (Y/N) (Note a)Potential accidents meet the 1975 SRP requirements.

Bounding analyses used PS2 for offsite rail shipment of chlorine gas Transportation yPS4 and onsite truck shipment of ammonium Accident C3 hydroxide.

Marine accident not C4 applicable to the site because of location.

Aviation and pipeline accidents covered under those specific categories.

Not applicable to the site because of Tsunami Y C3 loain Turbine-Generated Potential accidents meet the 1975 SRP Missiles S2 requirements.

Not applicable to the site because of Volcanic Activity Y C3 loain Waves associated with adjacent large C3 bodies of water are not applicable to the WaesYC4 site. Waves associated with external flooding are covered under that hazard.*See references of this Attachment Note a -See Table A8-2, Progressive Screening Approach for Addressing External Hazards, for descriptions of the screening criteria.8-6 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments N UREG/CR-2300 Initial Preliminary C1. Event damage potential is (Reference Sceein <events for which plant is 6*) and Sreigdesigned.

ASME/ANS Standard RA-Sa-2009 NUREG/CR-02. Event has lower mean 20 n frequency and no worse AM/N consequences than other Sadr A events analyzed.

Sa-2009 NUREG/CR-2300 and 03. Event cannot occur close AM/N enough to the plant to affect it. Sadr A Sa-2009 NUREG/CR-2300 and Not used to screen.04.Evet s icluedin he ASME/ANS Used only to include defiitin o anthe evnt. Standard RA- within another event.Sa-2009 05. Event develops slowly, allowing adequate time to ASME/ANS eliminate or mitigate the Standard threat.PrgrssvePSI.

Design basis hazard ASME/ANS Proresive cannot cause a core damage Standard RA-Screening accident.

Sa-2009 NUREG-1 407 P82. Design basis for the (Reference event meets the criteria in the 7*) and NRC 1975 Standard Review ASME/ANS Plan (SRP). Standard RA-Sa-2009 PS3. Design basis event NUE-40 as modified in mean frequency is < 1 E-5/y ASME/ANS and the mean conditional core Sadr A damage probability is < 0.1. -20 NUREG-1 407 PS4. Bounding mean CDF is and< 1E-6/y. ASME/ANS______________Standard RA-8-7 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Sa-2009 NUREG-1407 Screening not successful.an Detailed PRA PAnestmetASME/ANS requirements in the Sadr A ASME/ANS PRA Sta~ndard.

Standard RA-______*See references of this Attachment References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995), ML071 200238, dated May 17, 2007 2. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk-In formed Completion Time and Risk Managed Action Time for RITSTF Initiative 48, August 2010 3. NUREG-1 855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 2009 4. American Society of Mechanical Engineers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Leveil1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975 6. NUREG/CR-2300, PRA Procedures Guide, January 1983 7. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991 8-8 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 9 Baseline Core Damage Frequency and Large Early Release Frequency Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Baseline Core Damage Frequency and Large Early Release Frequency Section 4.0, Item 6 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide the plant specific total core damage frequency (ODE) and large early release frequency (LERE) to confirm that these are less than 1 E-4/year and 1 E-5/year respectively, thus assuring that the potential risk increases allowed under the RMTS program are consistent with Regulatory Guide (RG) 1.174, Revision 1 (Reference 2 of this Attachment).

RG 1.174, Revision 2 (Reference 3 of this Attachment) issued by the NRC in May 2011, did not revise these limits.This attachment demonstrates that the total ODE and total LERE are less than the guidance of RG 1.174, such that the risk metrics of NEI 06-09-A may be applied to the PVNGS Risk-Informed Completion Time (RIOT) Program.Table A9-1, Total Unit 1/2/3 Baseline Average Annual CDF/LERF, provides the ODE and LERE values that resulted from a quantification of the baseline average annual models (References 4, 5, 6, 7, and 8 of this Attachment), which include contributions from internal events, internal flooding, internal fire, and seismic hazards. Other external hazards are below accepted screening criteria and do not contribute significantly to the totals.The ODE and LERF for each unit at PVNGS are the same because each unit is nearly identical to the others by design and through the modification process. There are small differences between the units that have been evaluated and found to have minimal risk significance.

Examples include:* Unit 1 has a manual transfer switch between each of its four trains of safety-related inverters and their backup regulated power source, while the other two units have automatic transfer switches.* Field routed cabling As demonstrated in the table, the total ODE and total LERF are within the guidance of RG 1.174 to permit small changes in risk which may occur during implementation of RIOTs. Therefore, the PVNGS RIOT Program is consistent with NEI guidance.9-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A9-1 : Total Unit 112/3 Baseline Average Annual CDFILERF'(After Issues Listed in Attachment 4 are Resolved)Hazard CDF (per rx-yr) LERF (per rx-yr)Internal Events 1 .3E-6 4.3E-8 Internal Flooding 4.1E-7 1.9E-8 Seismic 2.8E-5 5.3E-6 Internal Fire 2.8E-5 2.4E-6 Total 5.8E-5 7.8E-6 Note: 1. The Baseline Average Annual CDF/LERF include average maintenance unavailability of structures, systems, and components (SSCs). The configuration risk management program model used for the RICT Program does not include maintenance unavailability of SSCs unless specific to the configuration.

References

1. NRC letter, Jennifer M. Golder to Buff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995), ML071200238, dated May 17, 2007 2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 November 2002 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. PVNGS Study 1 3-NS-B067, At-Power PRA Quantification, Revision 6 5. PVNGS Study 1 3-NS-C042, At-Power Level 2 PRA LERE Quantification, Revision 1 6. PVNGS Study 1 3-NS-F004, Fire PRA -Quantification and Screenings, Revision 0 7. PVNGS Study 13-NS-C099 "Internal Flooding PRA -PRA Modeling and Quantification, Revision 2 8. Westinghouse Calculation CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment

-Quantification, Revision 1 9-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 10 Justification of Application of At-Power PRA Models to Shutdown Modes Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Justification of Application of At-Power PRA Models to Shutdown Modes This attachment is not applicable to the PVNGS submittal.

APS is not proposing to apply the Risk-Informed Completion Time Program in shutdown modes, but only in Modes 1 and 2.10-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 11, Probabilistic Risk Assessment Model Update Process Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Probabilistic Risk Assessment Model Update Process Summary Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the probabilistic risk assessment (PRA)models which support the RMTS are maintained consistent with the as-built/as-operated plant. Palo Verde Nuclear Generating Station (PVNGS) Procedure 70DP-0RA03 Probabilistic Risk Assessment Model Control (Reference 2 of this Attachment), controls update and maintenance of the PRA models. This procedure is in full compliance with ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 3 of this Attachment) for PRA model maintenance and update.This attachment describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions, will be identified and reviewed prior to implementation to determine if they could impact the PRA models. The PRA Configuration Control Program will ensure these plant changes are incorporated into the PRA models as appropriate.

The process will include discovered conditions associated with the PRA models, which will be addressed through the PVNGS Corrective Action Program.Should a plant change or a discovered condition be identified that has a significant impact to the RICT Program calculations as defined by the Configuration Risk Management Program (CRMP), an interim update of the PRA model will be implemented.

Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic PRA model updates are performed no less frequently than every two refueling cycles (i.e., three years), consistent with the guidance of NEI 06-09-A.PRA Model Update Process The PRA Configuration Control Program ensures that the applicable PRA model used for the RICT Program reflects the as-built, as-operated plant for the three PVNGS units. The PRA Configuration Control Program delineates the responsibilities and guidelines for updating the full-power internal event, internal flood, internal fire, and seismic PRA models, and includes both periodic and interim PRA model updates. The procedure requires an update to be initiated at least once every three years to reflect industry operating experience (other than data), plant design and procedure changes. An update of PRA model data, including initiating event, component unavailability, component reliability, and common cause data is also required by the procedure to be initiated at least once every five years. The program includes guidance on identifying, evaluating, and documenting potential impacts (e.g., plant changes, plant/industry operational experience, or errors or limitations identified in the model). In addition, guidance is provided on assessing individual and cumulative risk impacts of pending changes. Finally, the PVNGS software quality assurance program records the controlled version of the PRA and CRMP 11-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times models and associated references.

Review of Plant Chanqes for Incorporation into the PRA Model 1) Plant changes or discovered conditions, as defined in the PRA Configuration Control Program, are reviewed for potential impact to the PRA models, including the CRMP model and the subsequent risk calculations which support the RICT Program.2) Plant changes that meet the criteria defined in the PRA Configuration Control Program (including consideration of the cumulative impact of other pending changes) will be incorporated in the applicable PRA model(s), consistent with the NEI 06-09-A guidance.

Otherwise, the change is assigned a priority and is incorporated at a subsequent periodic update consistent with procedural requirements.

3) PRA updates for plant changes are initiated at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A.4) If a change is required for the CRMP model, but cannot be immediately implemented for a significant plant change or discovered condition, either: A. Alternative analyses to conservatively bound the expected risk impact of the change will be performed.

In such a case, these alternative analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A.or B. Appropriate administrative restrictions on the use of the RICT Program will be put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.References

1. NRC letter, Jennifer M. Golder to Buff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995), ML071 200238, dated May 17, 2007 2. PVNGS Procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control 3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009 11-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 12 Attributes of the Risk Management Program Model Configuration Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attributes of the Configuration Risk Management Program Model Introduction Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support RMTS, including identification of how the baseline PRA model is modified for use in the Configuration Risk Management Program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. The scope of structures, systems, and components (SSCs) within the CRMP will be provided.

This item should also confirm that the CRMP tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant specific RMTS submittal.

This attachment describes the necessary changes to the peer-reviewed baseline PRA models for use in the CRMP software to support the Risk-Informed Completion Time (RICT)Program. The process employed to adapt the baseline models for CRMP use is demonstrated:

(1) to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; (2) to maintain the quality of the peer-reviewed PRA models; and (3) to correctly accommodate changes in risk due to time-of-year, time-of-cycle, and configuration-specific considerations.

Quality controls and training programs applicable for the CRMP are also discussed in this Enclosure.

Additional considerations regarding the Internal Fire PRA model to address implementation of National Fire Protection Association (NFPA) -805 as the licensing basis for the fire protection program are also discussed at the end of this attachment.

Translation of Baseline PRA Model for Use in CRMP: The baseline PRA models for internal events, including internal floods, internal fires, and seismic events, are the peer-reviewed models, will be updated as described in Attachment 11 of this Enclosure to reflect the as-built, as-operated plant. These models are modified to include changes that are needed to facilitate configuration-specific risk calculations to support the RICT Program implementation.

The baseline models and the changes made to create the CRMP model used in the RICT Program are controlled using plant calculations, which include the necessary quality controls and reviews.The changes to the models to account for variations in system success criteria based on time-of-year or time-in-operating cycle, and other specific changes needed to properly account for configuration-specific issues, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle, are described in Table A12-1, Changes Made for Configuration-Specific Risk.12-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times TABLE A12-1 CHANGES MADE FOR CONFIGURATION-SPECIFIC RISK DESCRIPTION BASIS FOR CHANGE Plant Availability The baseline PRA models account for the time the reactor operates at power by using a plant availability factor. This is appropriate for determining the average annual (time-based) risk, but the factor is not applicable to configuration-specific risk calculated for the RIOT Program.In order to account for the assumption that the plant is always operating in the RIOT Program, the frequency of initiating events which include an availability factor are adjusted.

This change is necessary to adjust the modeled initiating event frequencies from a "per year' to a "per reactor year" basis for use in the CRMP.Maintenance Maintenance alignment probabilities in the baseline PRA models have Alignment probabilities based on the fraction of the year the equipment is Probabilities unavailable.

For the CRMP model, the actual configuration of equipment is evaluated, so the maintenance alignment probabilities are set to zero. This is also done for the system initiating events, which include maintenance

______________

contributions.

Excluded The PRA models will not remove excluded maintenance combinations Maintenance allowed by the technical specifications (i.e., both trains of a single safety Combinations system being simultaneously unavailable).

Room Cooling The baseline PRA models include conservative success criteria for room Success Criteria cooling and do not use average annual criteria; therefore, no changes to the CRMP model for room cooling success criteria are required.Unfavorable The current PVNGS core design reflected in the baseline PRA model for Exposure Time ATWT events includes a UET for variable success criteria based on time (UET) for of core life (i.e., moderator temperature coefficient early in cycle life). The anticipated event is set to the fraction of the year for which the UET applies and will transient without be changed to a probability of 1 or 0 based on operator input using the trip (ATWT) CRMP tool, depending on the actual time in the operating cycle.Events Quality Recjuirements and Consistency of PRA Model and CRMP Tools The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA maintenance and update process described in Attachment 11 of this Enclosure and the use of self-assessments and independent peer reviews described in Attachment 6 of this Enclosure.

The information provided in Attachment 6 demonstrates that the PVNGS internal events, internal flood, internal fire, and seismic PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200, Revision 2 (Reference 2 of this Attachment).

This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.The current PRA models will either be combined into a single CRMP model for use in the CRMP software tool, or will be used to generate pre-solved solutions for routine plant configurations which will be entered into the CRMP software tool. PVNGS has been using a single CRMP model in EPRI EOOS for more than eight years based on combined internal events and internal fire models. The CRMP model is rigorously checked against the individual PRA model results to 12-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times validate the CRMP model quality. If a new CRMP model including the upgraded internal fire and new seismic PRA models cannot be developed that meets work management and scheduling needs for solution speed, PVNGS will take the approach used by South Texas Project by pre-solving thousands of routine expected configurations and saving the results of those solutions in the CRMP software tool. When unanalyzed configurations occur, PRA would promptly solve the PRA models to determine the RIOT as well as comply with existing Maintenance Rule configuration risk monitoring requirements.

PVNGS currently has and will continue to provide a qualified PRA engineer on call 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months a day, 7 days a week to support Operations and Work Management in assessing the risk of planned and emergent plant configurations.

Changes made to the baseline PRA model in translation to the CRMP model will be controlled and documented in accordance with PVNGS procedure 700P-0RA03, Probabilistic Risk Assessment Model Control, to maintain the existing CRMP model. An acceptance test is performed after every CRMP model update to verify proper translation of the baseline PRA models and acceptance of all approved changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components to the basic events in the CRMP model.Training and Qualification The PVNGS PRA staff is responsible for development and maintenance of the CRMP model.The PRA staff is trained in accordance with the site Engineering personnel training program and has passed specific qualifications on each major element of the PRA development and use.Operations and Work Control staff will use the CRMP tool under the RIOT Program and are trained in accordance with a program using National Academy for Nuclear Training (ACAD)documents, which is accredited by INPO.Application of the CRMP Tool to the RICT Program Scope PVNGS will use either the EPRI EQOS CRMP tool or the ERIN Engineering PARAGON CRMP tool for RIOT Program calculations.

The EPRI EOOS program already exists in an approved, issued version to support the RIOT Program. PVNGS currently uses an earlier version of the EPRI EQOS tool in the Maintenance Rule CRMP for at-power conditions and the PARAGON tool for low-power/shutdown conditions.

APS is transitioning to the PARAGON tool for Maintenance Rule CRMP use in all modes of operation.

ERIN Engineering is in the process of developing a new PARAGON version that will support the RIOT Program requirements.

PVNGS plans to select one of these programs for use in the RIOT Program. The selected program will meet RG 1.174 (Reference 3 of this Attachment) and PVNGS software quality assurance requirements.

12-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NE!) Topical Report (TR) NE! 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995), ML071200238, dated May 17, 2007 2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 12-4 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 13 Key Assumptions and Sources of Uncertainty 12-5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Key Assumptions and Sources of Uncertainty Introduction Section 4.0, Item 10 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a discussion of how the key assumptions and sources of uncertainty were identified, and how their impact was assessed and dispositioned.

This attachment provides that discussion.

Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1 .200, Revision 2, (Reference 2 of this Attachment) and the ASME/ANS RA-Sa-2009, Standard for Leveil/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 3 of this Attachment), have been identified for the PVNGS PRA models using the guidance of NUREG-1 855 (Reference 4 of this Attachment) and EPRI TR-1 016737 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 5 of this Attachment).

The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk. If the PVNGS model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on RIOT Program calculations.

Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.

The internal events PRA models are used to support the internal fire and seismic PRA, and so the assumptions and uncertainties evaluated would apply to these PRA models as well.Key assumptions and sources of uncertainty for the RIOT Program application are identified and dispositioned in Table Al13-1, Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations.

13-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT The only plant system SBOGs can be aligned to multiple units to supply The existing PRA model conservatively does modeled in the PRA that is limited loads, not credit SBOGs in more than one unit.shared between the three units Further, the plant design for FLEX and is the station blackout beyond FLEX modifications

/ capabilities generators (SBOGs). provide additional 480V and 4160V supplies Simultaneous multiple unit to safety buses not currently credited in the station blackout conditions are PRA models. For RICT Program screened out based on low implementation, PVNGS will consider, based probability.

SBOGs are on plant conditions and associated risk levels, assumed aligned to one unit risk management actions (RMAs) for use of only during an event. FLEX equipment such as 480V and 4160V generators when electric power systems to risk significant equipment are unavailable

____ ___ ___ ___ ____ ___ __ ___ ____ ___ ___ ___ ____ ___ ___ ___ ___ under a RIOT.13-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT Reactor Coolant Pump (RCP) RCP Seal Leak or Rupture is not modeled as a loss If flCP seal parameters are not within normal Seal Leak or Rupture of reactor coolant system (RCS) inventory safety limits indicating potential seal degradation function.

Based on Westinghouse WCAP-1 5749 while a RIOT is in effect, RMAs will be used (Reference 6 of this Attachment) and pump seal to ensure availability of charging pumps or vendor information, it was concluded that because of other plant SSCs which can mitigate the very tight clearances, leakage into the seal excessive RCP seal leakage.package from the RCS is limited to about 17 gpm per pump. Each of the four RCPs has a seal package which consists of three seals. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA. An analysis showed that continuing to model ROP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to ODE or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or____ ___ ___ ___ ___ ___ LERF.Loss of Coolant Accident NUREG/CR-6928 (Reference 7 of this Attachment)

The slight variance in the range of break (LOCA) Frequencies restated the results from NUREG-1 829 (Reference 8 sizes for different LOCAs is not significant of this Attachment).

The LOCA frequencies are and is judged to have minimal impact on based upon expert elicitations.

The LOCA sizes LOCA frequencies, within the uncertainties identified by the NRC are different from those associated with the expert elicitation values, estimated for PVNGS. and of insignificant impact to RICT calculations.

No special measures are____ ___ ___ ____ ___ ___ ____ ___ ___ ___ ____ ___ ___ ____ ___ ___ ___ required for the RIOT Program.13-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impactinq Confiquration Risk Calculations r R T = Assumption

/ Uncertainty Loss of Off-site Power (LOSP)Frequency Discussion Disposition for RICT The national LOSP data presented in the latest EPRI events reports (References 4 and 5 of this Attachment) were used to obtain point-estimates for switchyard-centered and severe weather-related LOSP frequencies.

The EPRI Reports indicate that the generic LOSP data is subject to user modifications and screenings to fit the local plant designs and environmental conditions.

This approach of LOSP screening is considered reasonable and necessary to avoid erroneous skewing of the LOSP data. The frequency of extreme weather LOSP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid-related LOSP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 9 of this Attachment).

The LOSP frequencies are based on recent industry data and are appropriate to represent plant-specific conditions.

SBOGs, as well as other additional electric power supplies, are available on site to mitigate LOSP. RMAs will consider, based on plant conditions and associated risk levels, these alternate AC sources for applications of the RICT Program where LOSP events significantly contribute to configuration risk.LOSP Associated Non- The probabilities of offsite power non-recoveries The offsite power non-recovery probabilities Recovery Probabilities were obtained from Table 4-1 of the draft NRC are based on the best available data and are NUREG/CR-INEEL/EXT-04-02326.

The error factors appropriate to represent plant-specific associated with LOSP frequencies and LOSP non- conditions.

SBOGs, as well as other recovery probabilities were obtained from additional electric power supplies, are NUREG/CR-INEEL/EXT-04-02326 (when provided);

available on site to mitigate LOSP. RMAs will otherwise, by using available in-house statistical consider, based on plant conditions and programs for Iognormal and Weibull distributions, associated risk levels, these alternate AC sources for applications of the RICT Program where LOSP events significantly contribute to_______________________configuration risk.13-4 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key AssumotionslSources of Uncertainty Imoactina Confiauration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT Battery Life Assumptions The PVNGS batteries are not credited in the long- Crediting the actual higher capacities of the term, because they are conservatively assumed to batteries and updated load shedding actions be discharged after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Although the IEEE from Fukushima-driven procedure changes Class 1 E batteries are designed to operate for 2 would result in longer RIOTs due to the hours, Engineering has determined that the class additional mitigation capabilities made batteries' life is at least 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . Thus they are available.

Therefore, the current PRA model available for power recovery at the 3-hour point on use for the RIOT Program is conservative and the incident timeline.

acceptable.

Human Failure Events (HFEs) Accessibility for completion of non-screened HFEs A sensitivity analysis was performed during a seismic event during a seismic event is assumed possible for all evaluating the impact of not crediting the non-screened HFEs other than those which are subject HFEs and there was minimal impact assumed to fail in the cases of corridor building or on the ODE and LERF. Therefore, the current turbine building collapse.

Both the collapse of the seismic PRA model used for the RIOT corridor building and turbine building and their impact Program is acceptable.

on the access to the Main Steam Support Structure (MSSS) is considered in the seismic PRA model.There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed.

____________________

Seismic performance shaping Seismic-only PS~s applied to the internal events This is considered a conservative factors (PS~s) with respect to human error probabilities (HEPs) will over-ride the assumption.

Therefore, the current seismic seismic-induced flooding flooding PS~s based on the consideration that the PRA model used for the RIOT Program is seismic events are more global events than the acceptable.

specific flooding events. No additional modifications are made to the internal events HEP to consider the possibility of seismic-induced flooding events._____________________

The seismic PRA HFE The seismic PRA dependency analysis assumes that The modification of the timing available due dependency analysis once an accident sequence is initiated, the operator to seismic considerations may result in a action timing for a seismically-induced event is longer response or identification time and similar to that of an internally-induced event for main consequently a higher HEP.control room actions.Therefore, the current seismic PRA model______________________used for the RIOT Program is acceptable.

13-5 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times T~hlp_ f_'isnosition of Key Assumotions/Sources of Uncertainty Imnactina Confiouration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Seismic PRA weighting factors There is no standardized method to calculate HEPs More emphasis was given to the Surry applied to three approaches in a seismic PRA. Therefore, a mean HEP for each method since it was a selective combination basic event was calculated by combining three of previous approaches and the most recently accepted approaches

[Surry, Kernkraftwerk performed and published method. However, Muhleberg (KKM), and Swiss Federal Nuclear Safety the Surry method has the potential to be the Inspectorate (ENSI) provided in Reference 10 of this least conservative approach among the three Attachment]

using weighting factors of 0.7, 0.15, and methods. A sensitivity analysis was 0.15, respectively, performed that ran the seismic PRA model using only the KKM and ENSI approaches, equally weighted.

The change in CDF and LERF was -1.63% and 0.42%. Therefore, the current seismic PRA model used for the RIOT______________________Program is acceptable.

Relay chatter correlation Relay chatter between relays of the same This is a conservative assumption because manufacturer, model number, and plant location (i.e., the demand experienced by a relay is building and elevation) was assumed to be fully dictated by in-cabinet response and not the correlated.

Also, each relay identified as a control in-structure response spectra (ISRS) upon switch, push button, or motor starter is fully which the binning is based. Therefore, the correlated with other generic, like components.

current seismic PRA model used for the RIOT Program is acceptable.

Simplified Relay Fragility Low-risk importance relays (based on Risk This assumption is reasonable given that Parameters Achievement Worth) were treated with a simplified none of the pc values for the relays evaluated fragility analysis and higher risk importance relays using the detailed fragility analysis were (10 different types) were treated with a detailed determined to have a 13c below 0.33 and most fragility analysis.

The simplified relay chatter fragility had pc of around 0.5. Therefore, the current analysis assumed a f3c of 0.35 based on engineering seismic PRA model used for the RIOT judgment.

Program is acceptable.

13-6 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption

! Uncertainty Discussion Disposition for RICT Seismic failure of relays and For the relays modeled in the seismic PRA, the basic PRA analyst experience is credited in the basic event mapping event associated with the seismic failure of the relay selection of the appropriate internal events must be mapped to an existing internal events target PRA model component failure modes to basic event. A key source of modeling uncertainty is reflect postulated seismic PRA model associated with the mapping of seismic basic events, component failure modes. This selection was Failure modes postulated for the PVNGS internal performed by Westinghouse PRA seismic events model may not fully align with their assigned experts and reviewed by APS PRA seismic counterparts, engineers.

Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

Seismic PRA uses internal The PVNGS seismic PRA assumes that the internal The internal events PRA that was used to events PRA as a starting point events PRA that is used as a starting point meets the develop the seismic PRA was evaluated requirements of Capability Category II of the PRA separately for its PRA quality and was standard.

determined to meet Capability Category II of the PRA standard with the exception of System Notebook documentation, which is a commitment herein to fully address prior to RIOT Program use. Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

Success criteria for seismic If not otherwise specified, the success criteria The base case seismic PRA uses a 24-hour PRA associated with the internal events PRA logic are mission time for the run time of mitigating considered valid and applicable to accident equipment.

A sensitivity case was developed sequences initiated by a seismic event. However, a to assess the impact of using a 72-hour standard 24-hour mission time may not be suitable mission time for equipment run failures.

The for a seismic-induced accident scenario because of change in overall ODE and LERF for this the longer time needed for offsite power recovery, case is 2.73% and 0.69%, respectively 13-7 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Seismic failure correlation Seismic failures are assumed to be completely The validity of this assumption of complete correlated.

This assumption implies that a single correlation is still being discussed at the basic event is used to model the seismic failure of industry level. This is considered a components that are identified as pertaining to the conservative assumption.

Therefore, the same fragility.

There is one exception to this where current seismic PRA model used for the RIOT failures in the steam path in the Turbine Building are Program is acceptable.

not considered correlated with failures of the______________________

feedwater lines.Seismically-induced LOSP The seismically-induced LOSP is assumed to bound The basis for this assumption is that the fragility of non-seismic class system. This seismically-induced LOSP has a generally assumption implies that a number of non-seismic low seismic capacity.

Scenarios where the class systems are not addressed with a specific non-seismic support systems incur seismic failure. seismically-induced failures while off site power is still available are considered realistic only for very low magnitude seismic events.Therefore, the most significant mitigating equipment will still be available.

This is considered a conservative assumption.

Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

Seismic PRA LOSP recovery In the seismic PRA, LOSP recovery is not credited It is realistic to consider that off site power for any seismic event above the safe shutdown recovery is available for low magnitude earthquake (SSE), while it is credited with seismic events. The selection of the SSE as a unchanged probability for a seismic event below the threshold between recovery/no-recovery of SSE. offsite power is arbitrary and conservative.

Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

13-8 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT Screening of equipment in the Screening of equipment in the SEL is based on Using a surrogate event for a number of Seismic Equipment List (SEL) fragility analysis.

Equipment screened by the fragility components that have been screened out team as inherently rugged is not modeled in the introduces a conservative failure mode. The seismic PRA for seismic-induced failure. In order to uncertainty introduced by the use of quantitatively capture the impact of screened out surrogate equipment for the seismic class I equipment, generic fragility parameters for the system is judged to have a limited impact on building that housed the screened out equipment the model. Therefore, the current seismic were used. The screened equipment is modeled PRA model used for the RIOT Program is through a surrogate basic event at a system level, acceptable.

Operators tripping the reactor It is assumed that the operators will always trip the This is considered a conservative above operating basis reactor in case of a seismic event above OBE even if assumption.

Therefore, the current seismic earthquake (OBE) the option for a controlled shutdown is allowed. PRA model used for the RIOT Program is acceptable.

Train N Auxiliary Feedwater The AFN pump is assumed to remain functional with A sensitivity case was developed to assess (AFN) pump is assumed to small breaks or leaks at instrument tubing. The the uncertainty in crediting the AFN pump remain functional following a fragility analysis associated with the AFN pump only and not the associated piping network. The design basis earthquake addresses the pump and not the entire piping capacity of the AFN pump was reduced to the network. same system level fragility parameters associated with the instrument air system.ODE and LERF increased by 0.08% and 0.03%, respectively, and indicated little significance of uncertainty in this simplification of the analysis.

Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

Main steam line relief valves Main steam line relief valves are screened out of the A sensitivity case is developed to assess the not explicitly included in the analysis on the basis that the steam generator and impact of this assumption.

A fully dependent SEL related piping and valves are considered very seismic failure across all 20 relief valves is rugged. For this reason, the seismic failure of the modeled. ODE and LERF values did not main steam line relief valves is not modeled. change when compared to the base case results. This indicates that no significant uncertainty.

Therefore, the current seismic PRA model used for the RIOT Program is acceptable.

13-9 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT Structural failures of buildings Structural failures of buildings are assumed to result This is a conservative assumption since the in major collapse and failure of all equipment inside fragility parameters provided are addressing the building.

the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited amount of equipment inside the building.

The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the OST tunnel. Therefore, the current seismic PRA model used for the RIOT Program is____________________________________acceptable.

The Anticipated Transient The ATWT logic for seismic PRA assumes that the Moderator temperature coefficient (MTC) and Without Trip (ATWT) logic for RCS pressure will be above the high-pressure safety ATWT pressure transient are not influenced seismic PRA injection pump shutoff head for only a short period of by the fact that the event is initiated by a time. seismic event rather than a spurious failure.Therefore, the success criteria developed for the internal events ATWT are considered valid for the seismic PRA. Therefore, the current seismic PRA model used for the RIOT_____________________Program is acceptable.

All flood scenarios on the 40-ft A cutset review showed that the contribution of Fire This is a conservative approach and should and 51 -ft elevations of the Protection (FP) initiators is very low and that the not have a significant impact on the baseline Auxiliary Bulilding assume that internal flood results are not being skewed by this internal flood model. This would not have a a pipe failure drains the conservatism.

significant impact on the RIOT Program.Refueling Water Tank (RWT).A single internal events PRA Since there are no significant differences between It is a realistic assumption that the Unit 1 SS0 model was developed to the units, the Unit 1 system, structure, or component designators are used, since there are no quantify the plant flood risk for (SS0) designators were used. It was therefore major differences between the three units in multiple units. assumed that the quantification results are terms of internal flood. This would not have a________________applicable to all units, significant impact on the RIOT Program.13-10 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT All components within a flood, This is a conservative assumption that simplifies the This is a conservative approach that area where the flood originates impacted component list. Uncertainty exists as to simplifies the impacted component list. This were assumed to be exactly where flooding would occur, the impact due would not have a significant impact on the susceptible and failed as a to the geometry of the room and equipment, and the RIOT Program.result of the flood, spray, direction of the spray or splash for a given scenario.steam, jet impingement, pipe This assumption raises ODE.whip, humidity, condensation and temperature concerns except when component design (e.g., waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect.________

______________

Block walls are not credited in Unless a treatment is non-conservative, the block This has no impact and is of low the analysis and are treated as walls are analyzed on an individual basis. The consequence to RIOT. This would not have a typical plant walls. amount of water that could flow through the gaps is significant impact on the RIOT Program.unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment.

13-11 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Breaks in pipes less than or The basis for this assumption is as follows: This is a conservative approach and is of low equal to two inches in 1. It provides a practical limit to bound the scope of consequence to RIOT.equivalent diameter were only the analysis to potentially large flow rate and considered if the break would significant consequence events.dirctl reultin plnt ripor 2. Pipe sizes of less than or equal to two-inch resut i a loodindceddiameter do not accurately reflect plant fluid system equimentfailre tat wuld flood impacts (i.e. two-inch diameter pipes produce result in a plant trip or significantly smaller flood rates).immediate shutdown.3. At low flow rates typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful.

Such conditions enhance operator actions significantly to successfully mitigate the breaks in small bore pipes.However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events. Specifically these events are considered in rooms without drains.Piping less than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented.

Closed-loop systems and This is a conservative approach that allows for the This is a conservative approach and is of low tanks were assumed to consideration of all consequences and does not consequence to RIOT. This would not have a instantaneously release the require time-based calculations, significant impact on the RIOT Program.entire system inventory._____________________

Control Room staff would be HEP and PSE adjustments were made during the This is a conservative approach and is of low unable to respond effectively early stages of a flooding event to account for the consequence to RIOT. This would not have a to multiple events immediately additional stress influencing factors. The ODE is significant impact on the RIOT Program.following the flooding event, higher with this assumption._____________________

13-12 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT No addition to the control room Operator actions to isolate the flood source are It is a realistic assumption that there would be crew is credited early into a required shortly after detecting that a Pressure no addition to the control room crew early into flood event when assessing Boundary Failure (PBF) has occurred.

Often when the flood event when assessing human human actions. responding to flood events, operators are responding actions. This would not have a significant to multiple alarms. impact on the RIOT Program.It is assumed that pipes that The assumption is conservative as it includes This is a conservative approach and is of low are larger than 3" were additional piping that may not be conducive to major consequence to RIOT. This would not have a capable of producing major flooding.

Since major floods are not a major significant impact on the RIOT Program.floods unless it was contributor to the PBF frequency, its contribution to determined that the piping was risk would be considered minimal.not capable of producing a major flood.External tanks were not External tanks that rupture would not normally There is no significant impact on the model.considered as a flood source propagate into the plant. There were no tanks This would not have a significant impact on unless there is a normally identified in the internal flood PRA that propagated the RIOT Program.available pathway into the into the plant. It was assumed that the impact of an plant whereby the tank external tank rupture was bounded by the evaluation contents could empty into a performed for internal events. Breach of an external room within the main plant tank was assumed to discharge to the yard area and structulres, there would be no flood-induced failures of PRA-______________________

related components.

Floods are assumed to fail all Oases in which equipment is deemed as sufficiently It is a realistic assumption and is of low equipment in the initiating high or flood barriers are not expected to retain water consequence to RIOT. This would not have a room and then propagate out to sufficient flood levels are treated on an individual significant impact on the RIOT Program.of the room to surrounding basis. Additionally, splitting the flood areas would flood areas. generate an unreasonable number of scenarios with no added insight. The top cutsets are not impacted, however if very specific isolation actions were taken_______________________this assumption could be significant.

13-13 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Floods are assumed to Water will flow down the path of least resistance; It is a realistic assumption and is of low propagate down pipe chases therefore a pipe chase is the preferred path rather consequence to RICT. This would not have a before stairwells in situations than a stairwell with a door. significant impact on the RIOT Program.where pipe chases are not surrounded by a curb and/or a door must be opened to enter into the stairwell.

Floods are assumed to The hydrostatic load that a door can handle is based It is a realistic assumption and is of low propagate through doorways on whether the door closes against the frame or consequence to RIOT. This would not have a which open out, away from the away (with relation to the room that the flood significant impact on the RIOT Program.initiating flood area more initiates).

A door that is against the frame can readily rather than doorways withstand a greater load as opposed to away from which open in, towards the the door frame.initiating flood area.Floor drains were assumed to This assumption is based on the expectation that a It is a realistic assumption and is of low be capable of controlling water spray event will not result in a significant consequence to RIOT. This would not have a levels for spray events, accumulation of standing water. During plant significant impact on the RIOT Program.walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. Drains were not credited for any flood or major flood events. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank. Such events were screened out as potential flood sources.Grouping boundary condition Grouping boundary condition sets for the LERF This is a conservative approach and is of low sets for the LERF analysis analysis is a conservative approach.

The LERF consequence to RIOT. This would not have a results in conservative contribution of sequences that have been grouped significant impact on the RIOT Program.modelin~g of the containment for the LERF analysis and involve failure of isolation valves, containment isolation valves is considered very low.13-14 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT The piping layout for flood To the extent possible, the similarities were It is a realistic assumption and is of low sources included in the internal confirmed during the plant walkdowns.

Therefore, consequence to RIOT. This would not have a flood PRA was shown and Units 2 and 3 pipe lengths were assumed to be significant impact on the RIOT Program.estimated to be similar for all identical to Unit 1 pipe lengths. There are no major three units. differences between the three units.It is assumed that if a PBF There are no operator procedures for isolating a This is a conservative assumption and is of were to occur in the Safety flood event; therefore the most conservative and low consequence to RIOT. This would not Injection (SI) or Chemical & bounding location to isolate a flood of the SI or OH is have a significant impact on the RIOT Volume Control (OH) system one of the two pipe headers. Isolating at this point Program.piping, the operator would results in the loss of at least one train of ECOS, isolate the flood at one of the causing a trip. Therefore, the overall impact on the two pipe headers connecting model is small.the RWT to the OH and SI systems.It is assumed that spurious Spurious actuation of a system relief valve was not This is of low consequence to RIOT. This actuation of system relief determined to be a credible flood source because would not have a significant impact on the valves would discharge a the inventory that was released would be retained RIOT Program.limited amount of inventory to within the flood area and would not lead to an a discharge tank and such applicable initiating event. The risk is considered events were screened out as negligible as this is not considered to be a significant potential flood sources. source of inventory.

Limited or no access to an There was no credit taken for mitigation when the This is of low consequence to RIOT. This area where flood initiation equipment relied on for mitigation was located in the would not have a significant impact on the occurs was assumed. flood initiation area. Operators cannot get into RIOT Program.flooded areas.Only one internal flood The occurrence of simultaneous multiple It is a realistic assumption and is of low initiating event is assumed to independent internal flood events were considered to consequence to RIOT. This would not have a occur at a time. be very unlikely and were not considered in this significant impact on the RIOT Program.evaluation._This is consistent withPRA modeling.

____________________

13-15 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Im pacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT The breach of isolation This is a simplifying assumption that has negligible This is a conservative assumption and is of barrier(s) that may result in a impact on the model. Propagation pathways were low consequence to RIOT. This would not maintenance-induced flood made to be conservative for all scenarios have a significant impact on the RIOT event was assumed to have no Program.impact on altering the propagation paths related to other flooding mechanisms (i.e., pipe failure) for the flood source. ________________________

The indirect effects of a PBF Closed looped systems were considered to be This is a conservative assumption and is of on the operability of a closed normally operating and providing cooling to low consequence to RIOT. This would not looped system were equipment that is relied on to maintain the plant in a have a significant impact on the RIOT considered to be immediate.

power production state. It was therefore assumed Program.that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity.

A PBF would drain the system and in most cases, operator action to isolate the PBF would not be feasible.

This assumption is conservative and raises ODE.The spill rate resulting from a For a potentially unlimited source, a PBF that It is a realistic assumption and is of low PBF of a potential unlimited resulted in a spray event (<100 gpm) would take an consequence to RIOT. This would not have a flood source that causes a extraordinary amount of time to cause a loss of that significant impact on the RIOT Program.spray event is low enough (i.e., system. Additionally, for most of the large nearly<100 gpm) to have no unlimited sources, the makeup capabilities of the significant impact on the system would generally exceed the flow rate operation of the affected generated by a spray event. It was therefore system. assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (e.g., the OH system) this______________________assumption was not valid. ____________________

13-16 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT The flow rate from a PBF is The spill rate for a particular break resulting from a This is a conservative assumption and is of assumed static at the piping PBF is assumed to be the highest flow rate low consequence to RIOT. This would not maximum possible rate and possible from the system or piping. For tanks, the have a significant impact on the RIOT the scenario is only ended break spill rate is assumed to be constant at an Program.when the source was assumed flow rate. For systems requiring pumps, the exhausted or isolated.

break spill rate is assumed to be the realistic pump flow rate. The spill is assumed to continue in the originating flood area until the flood source is isolated or its water supply is limited or exhausted..

The accumulation of flood water in a flood area was considered halted when the flood source was terminated, or when outflow from the flood area matches or exceeds the inflow of flood water to the flood area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding.Spill rates were assumed to fall within the following categories:

Spray events: 100 gpm* Flood events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)* Major flood events: greater than 2000 gpm (or the maximum capacity of the system, whichever________________________

is lower)13-17 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT The treatment of main Recovery of feedwater is important for secondary This is of low consequence to RIOT. This steamline break and main side heat removal. The internal events analysis was would not have a significant impact on the feedwater line break internal believed to provide sufficient analysis to be used in RIOT Program.events analysis was assumed the internal flooding PRA model.to address the impact of these events in assessing whether main feedwater can be recovered following a reactor trip.It was assumed that minimal or The flood Human Reliability Analysis (HRA) did not This is of low consequence to RIOT. This no dependency existed include large early release specific HFEs. HFEs would not have a significant impact on the between flood-specific and specific to large early releases (i.e., post-core RIOT Program.large early release specific damage operator actions) are generally performed Human Failure Events (HFEs). several hours after the initiating event occurs.No dependency between early and late operator_____________________actions.

There is no impact on the model.The fire areas defined by the Fire areas are required by regulation to be It is a realistic assumption and is of low Fire Hazards Analysis (FHA) "sufficiently bounded to withstand the hazards consequence to RIOT. This would not have a (which is contained in Updated associated with the area" as defined in Generic significant impact on the RIOT Program.Final Safety Analysis Report Letter 86-10 (Enclosure 1 Section 4). Fire zone Appendix 9B Sections 9B.2.1 boundaries are similarly assumed adequate;through 9B.2.22) will however, because fire zones have a lesser pedigree substantially contain the than fire areas, their boundaries are verified adverse effects of fires adequately in this notebook by a FHA review and originating from any currently plant walkdowns.

Fire zone boundaries that appear installed fixed ignition source unable to withstand the fire hazards within the zone or reasonably expected are combined.

The internal fire PRA utilizes fire transient ignition source. Fire compartments which generally align with fire zones, zone boundaries are similarly but may be a combination of several fire zones.assumed adequate or combined.____________________________________________

13-18 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Systems and equipment not The assumption that any fire fails all equipment It is a realistic assumption and is of low credited in the fire -induced lacking cable routing information has the potential to consequence to RIOT. This would not have a risk model (e.g., systems for affect the assessed fire risk. The assumption that significant impact on the RIOT Program.which cable routing will not be any fire will minimally result in a loss of main There are no systems/components that are performed) are assumed to be feedwater and subsequent reactor trip likely adds assumed failed in the Internal Fire PRA failed in the fire -induced risk conservatism to the internal fire PRA results, model that are within the RIOT Program.model. These systems and However, the degree of conservatism is relatively equipment are failed in the small compared with other modeling uncertainties, worst possible failure mode, since main feedwater will trip for most transient including spurious operation.

events.It is assumed that any fire will The impact of these assumptions was evaluated by a minimally result in a loss of sensitivity analysis case which concluded that the main feedwater and risk reduction due to crediting all components subsequent reactor trip. This is assumed always failed was small.a simplifying and conservative assumption and is typical of internal fire PRA s. However, it may not be true for all fires.It is assumed that the Reactor RPS design is sufficiently fail-safe and redundant to It is a realistic assumption and is of low Protection System (RPS) preclude fire -induced failure to scram: Consistent consequence to RIOT. This would not have a design is sufficiently fail-safe with the guidance in NUREG/CR-6850 (Reference significant impact on the RIOT Program. The and redundant to preclude fire 11 ) Section 2.5.1, types of sequences that can low frequency of a fire occurring coincident-induce failure to scram, or generally be eliminated from consideration in internal with the low probability of independent failure random failure to scram during fire PRA include sequences for which a low to scram results in a negligible contribution to a fire event, as a risk frequency argument can be made, and use ATWT as fire risk.significant contributor, a specific example, because fire -induced failures will almost certainly remove power from the control rods, resulting a trip, rather than cause a "failure to scram" condition._____________________

13-19 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key AssumptionslSources of Uncertainty Impactincl Confiauration Risk Calculations Assumption

/ Uncertainty Discussion Disposition for RICT Properly sized and coordinated Electrical protection design calculations provide the It is a realistic assumption and is of low electrical protective devices documentation of the electrical coordination between consequence to RIOT. Electrical coordination are assumed to function within overcurrent protective devices. An evaluation was will either be established or recovery their design tripping performed to assess the internal fire PRA power procedures will be implemented to correct the characteristics, thus preventing supply coordination requirements in accordance with coordination.

initiation of secondary fires NUREG/CR-6850, and provides a link to relevant through circuit faults created PVNGS electrical coordination calculations that by the initiating fire. demonstrate selective tripping capability for each credited internal fire PRA power supply (Reference 11 of this Attachment).

When selective tripping cannot be demonstrated, the internal fire PRA model will credit recovery procedures planned to correct the_____________________coordination._____________________

13-20 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty IDiscussion JDisposition for RICT It is assumed that internal fire PRA targets were assigned the appropriate radiant heat flux damage and temperature damage criteria depending on the cable insulation information available.

In other words, all raceways containing cables with thermoplastic or unknown cable insulation were assigned a radiant heat flux damage threshold of 6 kW/m 2 and 205 DC. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m 2 and 330 00, but have been initially assigned the thermoplastic damage thresholds.

All raceways containing cables were assigned a radiant heat flux damage threshold of 6 kW/m 2 and 205 00. Raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m 2 and 330 0C, but have been initially assigned the thermoplastic damage thresholds.

A brief review of the dominant scenarios identified the existence of thermoplastic insulated cables within the target raceways.It is a realistic assumption and is of low consequence to RIOT. It was concluded that minimal benefit could be obtained by further analysis to identify and model raceways containing only thermoset insulation.

13-2 1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption I Uncertainty Discussion Disposition for RICT Planned plant modifications This approach introduces uncertainty in the results This assumption that the planned plant and recovery actions are because the actual modifications may vary from modifications will be installed and assumed in the base case those assumed or they may not function as modeled. tested/operated as assumed in the Internal model. These modeled The assumed modifications are documented in the Fire PRA model has significant impact on the modifications are assumed to internal fire PRA studies. Plant and model RICT Program. The assumption is realistic correct the fire vulnerability configuration and control mechanisms are in place to since the PRA analysis will provide details to and not introduce any new ensure that the Internal Fire PRA model will be the design modifications group in developing failure modes. updated to correct the as-installed modifications, the plant modifications and procedures.

The One specific planned plant modification is the PRA model will reflect the as-built/as-installation of an additional Steam Generator operated plant configuration prior to makeup capability in each unit to address internal implementation of the RIOT Program, fire PRA risk. A sensitivity was performed that including the installation of an additional removes this modification from the model Steam Generator makeup capability in each unit.13-22 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995), ML071200238,dated May 17, 2007 2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009 3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009 4. NUREG-1 855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009 5. EPRI TR-1 016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008 6. WCAP-1 5749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008 7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007 8. NUREG-1 829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies through the Elicitation Process, Draft 9. NUREG/CR-INEEL/EXT 04-0236, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1 986-2003 (Draft), October 2004 10. Westinghouse Calculation Note CN-RAM-1 2-022, Revision 1, Palo Verde Seismic Probabilistic Risk Assessment

-Quantification, dated December 2, 2013 11. NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, September 2005 13-23 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 14 Program Implementation Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Program Implementation Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the RMTS implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT). This attachment provides the required description.

RICT Progqram Procedures A procedure will be developed to outline the requirements and responsibilities for the RICT Program. It will provide guidance on departmental responsibilities and management authority for RICT Program application, and for required training, implementation, and monitoring of the RICT Program, including development and maintenance of the Configuration Risk Management Program (CRMP) software tool and model reflecting the as-built, as-operated plant.The RICT Program will be implemented by site procedures, which will fully address all aspects of the guidance of NEI 06-09-A. Operations, specifically the control room staff, is responsible for compliance with Technical Specifications (TS) requirements, and will be responsible for implementation Of a RICT and any RMAs determined to be appropriate for the plant configuration.

Use of a RICT and associated RMAs will be approved by the Plant Manager prior to entering an extended completion time (CT) for pre-planned activities.

For emergent conditions requiring an extended CT, the use of the RIOT program will be approved by the applicable Operation's Shift Manager or Plant Manager.PVNGS Procedure 02DP-9RS01, Operational Risk Management, (Reference 2 of this Attachment) addresses existing site controls for risk management during equipment outages.This procedure will be supplemented to address the additional guidance of NEI 06-09-A for detailed implementation of the RICT Program. It will provide guidance to PVNGS personnel on the following topics:* Performing a Tier 2 assessment for a RICT prior to entry into the TS Limiting Condition of Operation (LCO)* Plant conditions for which the RICT Program is applicable

Conditions under which a RICT may not be used, or may not be voluntarily entered for the calculation of RICTs and RMA Times (RMATs).* Implementation of RICT Program front stops and 30-day back stop limit* Plant configuration changes, i.e., recalculating the RICT and RMAT within the lesser of the affected RA completion time or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of any change.* Conditions for exiting a RICT o Requirements to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded in accordance with PVNGS Protected Equipment procedure, 40DP-9AP21, and NEI 06-09-A 14-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times* The use of RMAs, including the conditions under which they may be credited in RIOT calculations

Crediting probabilistic risk assessment (PRA) functionality

Approval processes for use of a RIOT* Determining PRA availability from detailed PRA functionality characteristics for each Technical Specification LCO* A RIOT cannot be entered if PRA functionality must be lost in order to restore the LCO* Determining PRA availability of degraded SSCs consistent with NEI 06-09* Oases where ODE and/or LERF exceed 1 E-3Iyr and/or 1 E-4/yr as delineated in NEI 06-09* Analyzing conditions for Common Cause Failures (OCCs), planned and emergent configurations, in accordance with NEI 06-09-A and the guidance of Regulatory Guide 1.177 (Reference 3 of this Attachment).

RIOT Progqram Trainingq The scope of the training for the RIOT Program will include training on rules and processes for the new TS program, CRMP software, TS Actions included in the program, and procedures.

This training will be conducted for the following PVNGS personnel, as applicable:

Plant General Manager* Selected members of the PVNGS management and supervisory team* Unit Operations Managers* Operations Work Control Managers* Operations Personnel (Licensed and Non-Licensed)

Work Control Manager* Work Control Personnel* Work Week Managers* Operations Training* Nuclear Regulatory Affairs* Selected Maintenance Personnel* Site Engineering

Probabilistic Risk Assessment (PRA) Engineers* Fire Protection Personnel* Other Management (e.g., Outage Management)

Training will be carried out in accordance with PVNGS training procedures and processes.

These procedures were written based on the Institute of Nuclear Power Operations (INPO)Accreditation (ACAD) requirements, as developed and maintained by the National Academy for Nuclear Training.

PVNGS has planned three levels of training for implementation of the RIOT Program. They are described below: 14-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times User Training This is the most detailed training and is intended for the individuals who will be directly invoived in the implementation of the RIOT Program. This level of training includes the following attributes:

Specific training on the revised TS* Record Keeping Requirements

Case Studies* Hands-on time with the CRMP tool calculating a RMAT and RIOT* Identifying appropriate RMAs* Determining PRA Functionality

Other detailed aspects of the administration and deployment of the RIOT Program Management Training This training is applicable for supervisors, managers, and other personnel who need a broad understanding of the RIOT Program. It is significantly more detailed than Site Awareness Training (described below), but it is different from User Training in that hands-on time with the ORMP tool and case studies are not included.

The concepts of the RIOT Program will be taught, but this group of personnel will not be qualified to perform the tasks for actual implementation of the RIOT Program.Site Awareness Training This training is intended for the remaining personnel who require an awareness of the RIOT Program. These employees need basic knowledge of RIOT Program requirements and procedures.

This training will address RIOT Program concepts that are important to disseminate throughout the organization.

Training will include a site wide communication plan for the RIOT program coordinated through the PVNGS Communications Department.

References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071 200238, dated May 17, 2007 2. PVNGS Procedure 02DP-9RS01 Operational Risk Management, Rev 1 3. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-In formed Decision Making: Technical Specifications, Revision 1, May 2011 14-3 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 15 Monitoring Program Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Monitoring Program Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, (Reference 2 of this Attachment) and NEI 06-09-A. (Note that RG 1.174, Revision 2 (Reference 3 of this Attachment), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation for Section 4.0, Item 12.)This attachment provides a description of the process applied to monitor the cumulative risk impact of implementation of the Risk-Informed Completion Time (RICT) Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.The calculation of cumulative risk impact is required by the RICT Program at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEl 06-09, Revision 0. For the assessment period evaluated, data is collected for the risk increases associated with each application of the RICT Program for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk calculated by summing the contributors to risk associated with each RICT application.

This is the change in CDF or LERF above the zero maintenance baseline levels while a RICT was in effect (i.e., beyond the front-stop CT).The change in risk is converted to an average annual value.The total average annual change in risk for extended CTs is compared to the guidance of RG 1.174, Figures 4 and 5 for CDF and LERF changes, respectively.

If the actual annual risk increase is acceptable (i.e., not in Region I of the figures), then RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the RG 1.174 guidance and implementation of any necessary corrective actions to ensure future plant operation is within the guidance is conducted under the site Corrective Action Program.The assessment will identify areas for consideration during the evaluation, including, as examples:* Those SSCs where the application of a RICT dominated the risk increase* Contributions from planned vs. emergent RICT applications

Risk management actions (RMAs) implemented but not credited in the risk calculations

Offset risk due to RICT application by avoiding multiple shorter outages* Reductions in risk levels through improvements in SSC availability and reliability due to different maintenance strategies and the operational flexibility made possible through the RICT Program 15-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Based on the evaluation, any necessary corrective actions determined to be appropriate are developed and approved by the Plant General Manager or Unit Operations Manager. These may include:* Administrative restrictions on the use of RIOTs for specific high-risk configurations based on instantaneous risk levels* Additional RMAs for specific high-risk configurations

Rescheduling planned maintenance activities

Deferring planned maintenance to shutdown conditions

Use of temporary equipment to replace out-of-service systems, structures or components (SSCs)* Plant modifications to reduce risk impact of expected future maintenance configurations In addition to the cumulative impact of RICT Program implementation, the unavailability of SS~s is also potentially impacted.

The existing Maintenance Rule (MR) monitoring programs under 10 CER 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts that may be incurred by implementation of the RIOT Program. The use of the MR Program is acceptable since the SSCs in the scope of the RIOT Program are also in the scope of the MR. Using the existing MR monitoring for this program is explicitly discussed in RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, (Reference 4 of this Attachment), Section 3.2, "Maintenance Rule Control." The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serves as the "Implementation and Monitoring Program," defined as Element 3 of RG 1.174 for the RIOT Program.References

1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NE!) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAO No. MD4995), ML071 200238, dated May 17, 2007 2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-In formed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011 15-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 16 Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Risk Management Action Examples Introduction Section 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a description of the process to identify and provide compensatory measures and risk management actions (RMAs)during extended Completion Times (CTs), including specific examples.This attachment describes the process for identification of RMAs applicable during extended CTs and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities.

This procedure will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program and is consistent with the guidance provided in NEI 06-09-A.Responsibilities Work Planning / Work Management is responsible for identifying the need for RMAs for planned work and Operations is responsible for identifying the need for RMAs for emergent work.Operations, PRA and Fire Protection are responsible for developing the RMAs. Operations is responsible for implementation of RMAs.Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded.

The RMAs are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded as appropriate for the situation.

For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs, requiring recalculation of a RMAT already in place, the procedure requires a re-evaluation of the existing RMAs for the new plant configuration to see if new RMAs are appropriate.

These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A.RMAs are put in place no later than the point at which the incremental core damage probability (ICDP) of 1 E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. If as the result of an emergent event, the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF)exceeds 1 E-3 or 1 E-4 per year, respectively, RMAs are also required to be implemented.

These requirements are consistent with the guidelinies of NEI 06-09-A.By determining which structures, systems, or components (SSCs) are most important from a CDF and/or LERF perspective for a specific plant configuration, RMAs may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF and/or LERF allows development of RMAs that enhance the plant's capability to mitigate such events. System-specific Configuration Risk Management System Guidelines (CRMSGs) will be developed that will define the risk role of plant systems within the scope of the RICT Program, identify SSCs explicitly modeled in the system, and identify the key 16-1 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times SSC failure modes for equipment explicitly modeled. Approved system-specific RMAs will be contained in the CRMSGs and be available in each unit Control Room.It is possible to credit RMAs in the RICT calculations, but such quantification of RMAs is not required by NEI 06-09-A. Crediting RMAs in the RICT calculations is only done consistent with the guidance of NEI 06-09-A.NEI 06-09-A classifies RMAs into three categories, as described below: 1) Actions to increase awareness and control* Shift brief* Pre-job brief* Training (formal or informal)* Presence of system engineer or other expertise related to maintenance activity* Special purpose procedure to identify risk sources and contingency plans 2) Actions to reduce the duration of maintenance activities

Pre-staging materials* Conducting training on mock-ups* Performing the activity around the clock* Performing walk-downs on the actual system(s) to be worked on prior to beginning work 3) Actions to minimize the magnitude of the risk increase* Suspend/minimize activities on redundant systems* Suspend/minimize activities on other systems that adversely affect the CDF and/or LERF* Suspend/minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate* Use temporary equipment for backup power* Use temporary equipment for backup ventilation

Reschedule other maintenance activities Examples of RMAs that may be considered during a RICT Program entry for a diesel generator (DG) or a battery to reduce the risk impact and ensure adequate defense-in-depth are: A. Diesel Generator 1) The condition of the offsite power supply, switchyard, and the grid is evaluated prior to entering a RICT, and RMAs as identified below are implemented, particularly during times of high grid stress conditions, such as during high demand conditions.

2) Deferral of switchyard maintenance, such as deferral of discretionary maintenance on the main, auxiliary, or startup transformers associated with the unit.3) Deferral of maintenance that affects the reliability of the trains associated with the operable DGs.4) Deferral of planned maintenance activities on station blackout mitigating systems, and 16-2 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times treating those systems as protected equipment.

5) Contacting the dispatcher on a periodic basis to provide information on the DG status and the power needs of the facility.B. Battery 1) Limit the immediate discharge of the affected battery, if possible.2) Recharge the affected battery to float voltage conditions using a spare battery charger, if possible.3) Evaluate the remaining battery capacity and protect its ability to perform its safety function.4) Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries.

References 1NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NE!) Topical Report (TR) NE! 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071 200238, dated May 17, 2007 16-3

@@ Line 2: / Line 2: @@
 | number = ML15218A300
 | issue date = 07/31/2015
-| title = Palo Verde, Units 1, 2 & 3 - License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times
+| title = License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times
 | author name = Lacal M L
 | author affiliation = Arizona Public Service Co

v t e Letter Sequence Request
CAC:MF6576, Provide RISK-INFORMED Extended Completion Times - RITSTF Initiative 4B, Eliminate Second Completion Times Limiting Time from Discovery of Failure to Meet an LCO (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance Supplement, Supplement Administration Questions 26 February 2016 7 March 2016 4 April 2018 3 May 2018 23 August 2018 Answers 18 May 2018 21 September 2018 14 April 2017 Results Approval Other: ML18275A275
MONTHYEAR2018-10-05 [Table View]

ML15218A300: Difference between revisions

Revision as of 19:53, 28 January 2019

Text

Dear Sirs:

Subject:

Enclosure:

1.0 DESCRIPTION

2.0 ASSESSMENT

3.0 REGULATORY

1.0 DESCRIPTION

2.1 Applicability

3.5.3 Condition

4.0 ENVIRONMENTAL

3.3.4 Reactor

3.3.6 Engineered

3.4.9 ACTIONS

0.1 Restore

3.3.4 Reactor

3.3.6 Engineered

3.7 PLANT

3.6.3 2active

3.7.2 4MSIVs

3.3.6 ESFAS

3.3.6 ESFAS

3.3.6 ESFAS

3.3.6 ESFAS

3.4.9 Pressurizer30dy

3.5.1 Safety

3.5.1 Safety

3.5.3 Essential

3.5.3 Essential

3.6.2 Containment

3.6.3 Containment

3.6.3 Containment

3.6.3 Containment

3.6.3 Containment

3.6.6 Containment

3.7.4 Atmospheric

3.7.4 Atmospheric

3.7.5 Auxiliary

3.7.5 Auxiliary

3.7.6 Condensate

3.7.7 Essential

3.7.7 Essential

3.7.8 Essential

3.7.8 Essential

3.7.9 Ultimate

3.8.7 Inverters

3.8.7 Inverters

Navigation menu

Search