ML17307A188
ML17307A188 | |
Person / Time | |
---|---|
Site: | Palo Verde ![]() |
Issue date: | 11/03/2017 |
From: | Lacal M L Arizona Public Service Co |
To: | Document Control Desk, Office of Nuclear Reactor Regulation |
References | |
102-07587-MLL/TNW | |
Download: ML17307A188 (309) | |
Text
10 CFR 50.90 A member of the STARS Alliance LLC Callaway
- Diablo Canyon Palo Verde Wolf Creek Maria L. Lacal Senior Vice President, Nuclear Regulatory & Oversight Palo Verde Nuclear Generating Station P.O. Box 52034 Phoenix, AZ 85072 Mail Station 7605 Tel 623 393 6491 102-07587-MLL/TNW November 3, 2017 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
Dear Sirs:
Reference:
Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 [Agency Documents Access and Management System (ADAMS)
Accession Number ML15218A300]
Subject:
Palo Verde Nuclear Generating Station Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Renewed Operating License Nos. NPF-41, NPF-51, NPF-74 License Amendment Request Supplement for Risk-Informed Completion Times
In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), APS submitted in the referenced letter a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3.
This license amendment request (LAR) suppl ement replaces information provided in the referenced letter. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, Attachment 3 provides marked up pages of the existing TS Bases to show the proposed changes.
Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in the referenced letter. Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.
102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 2 The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (ADAMS Accession Number ML16300A245) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during th e review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.
APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) - A, Risk-Managed Technical Specifications (RMTS)
Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (ADAMS Accession Number ML12286A322).
Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (ADAMS Accession number ML15127A669) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.
This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR.
APS requests approval of the proposed license amendment within one year, with the amendment being implemented within 180 days of issuance.
In accordance with the PVNGS Quality Assurance Program, the Plant Review Board reviewed and approved this LAR supplement. By copy of this letter, this LAR supplement is being forwarded to the Arizona Radiation Regulatory Agency pursuant to 10 CFR 50.91(b)(1).
Should you have any questions concerning the content of this letter, please contact Matthew S. Cox, Licensing Section Leader, at (623) 393-5753.
I declare under penalty of perjury that the foregoing is true and correct.
Executed on ___November 3, 2017_______ (Date)
Sincerely,
MLL/TNW/NTA 102-07587-MLL/TNW ATTN: Document Control Desk U.S. Nuclear Regulatory Commission License Amendment Request Supplement for Risk-Informed Completion Times Page 3
Enclosure:
Description and Assessment of Proposed Amendment for Risk-Informed Completion Times cc: K. M. Kennedy NRC Region IV Regional Administrator S. P. Lingam NRC NRR Project Manager for PVNGS M. M. Watford O'Banion NRC NRR Project Manager C. A. Peabody NRC Senior Resident Inspector for PVNGS T. Morales Arizona Radiation Regulatory Agency (ARRA)
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times i Table of Contents
1.0 DESCRIPTION
2.0 ASSESSMENT
3.0 REGULATORY SAFETY ANALYSIS
4.0 ENVIRONMENTAL CONSIDERATION
ATTACHMENTS:
- 1. Proposed Technical Specification Changes (Mark-up) 2. Revised Technical Specification Pages (Clean Copy) 3. Technical Specification Bases Changes (Mark-up) 4. License Conditions and Regulatory Commitment 5. List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions 6. Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 7. Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 8. Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models 9. Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) 10. Justification of Application of At-Power PRA Models to Shutdown Modes 11. Probabilistic Risk Assessment Model Update Process 12. Attributes of the Configuration Risk Management Program Model 13. Key Assumptions and Sources of Uncertainty 14. Program Implementation 15. Monitoring Program 16. Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 1
1.0 DESCRIPTION
In accordance with the provisions of section 50.90 of title 10 of the Code of Federal Regulations (10 CFR), Arizona Public Service Company (APS) submitted in reference 1, a request for a license amendment to revise the technical specifications (TS) for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3. Reference 2 provided the APS response to a specific information request regarding instrumentation.
This license amendment request (LAR) suppl ement replaces information provided in reference 1. The enclosure to this letter provides an updated description and assessment of the proposed amendment for risk-informed completion times (RICT). Attachment 1 provides marked up pages of the existing TS to show the proposed changes. Attachment 2 provides revised (clean) TS pages. For information, Attachment 3 provides marked up pages of the existing TS Bases to show the proposed changes.
Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1. Attachments 5 through 16 of the enclosure provide updated probabilistic risk assessment information to support NRC review of this LAR supplement.
The changes in this supplement were made as a result of the concerns identified in NRC letter dated November 15, 2016 (Reference 5) where the NRC staff informed APS and other licensees of its decision to suspend NRC approval of TSTF-505-A, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, because of concerns identified during the review of plant-specific LARs for adoption of the TSTF-505 traveler. The letter also stated that the NRC would continue reviewing applications already received and site-specific proposals to address NRC staff concerns.
APS has been actively participating in the public phone calls related to the RICT initiative to ensure APS understands the NRC staff concerns and the related resolutions. In order to address NRC staff concerns within this LAR supplement, APS used the methodology described in Risk-Informed Technical Specifications Initiative 4b, NEI 06-09 (Revision 0) -
A, Risk-Managed Technical Specifications (RMTS) Guidelines, issued in November 2006 which incorporates the NRC final safety evaluation, dated May 17, 2007 (References 4 and 6). Finally, APS has reviewed and applied to the extent possible changes approved in the NRC safety evaluation issued on August 8, 2017 (Reference 3) for the lead plant for the RICT initiative. The approach used by APS and the changes included in this LAR supplement were described to the NRC staff in a pre-submittal phone call on August 31, 2017.
The LAR supplement involves TS completion times (CT) for required actions (RA) to provide the option to calculate a RICT. A new program, the risk informed completion time program , is added to TS Section 5, Administrative Controls. In addition as described in section 2.3 of this enclosure, this enclosure includes the addition of a license condition, to address the scope of the probabilistic risk assessment (PRA) methods approved by the NRC staff for use in the PVNGS RICT program. Additionally, APS Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 2 requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.
2.0 ASSESSMENT
2.1 Applicability
of Published Safety Evaluation APS reviewed the safety evaluation for NEI 06-09-A (Ref erence 4), and the safety evaluation for the lead plant for risk-informed completion times (Reference 3) and concluded that they are applicable to PVNGS Units 1, 2, and 3.
2.2 Verifications
and Regulatory Commitments The following attachments are provided in accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 06-09-A (Reference 4):
Attachment 4 to this enclosure lists the APS license conditions and regulatory commitment regarding changes necessary to support implementation of RICT.
to this enclosure identifies each of the TS required actions (RA) to which the RICT program will apply, with a comparison of the TS functions to the functions modeled in the PRA of the structures, systems and components (SSC) subject to those actions.
Attachment 6 to this enclosure provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT program, as required by regulatory guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009, Section 4.2.
Attachment 7 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC. Attachment 8 to this enclosure provides appropriate justification for excluding sources of risk not addressed by the PRA models.
to this enclosure provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.
Attachment 10 to this enclosure is a placeholder to retain the format since each APS PRA model used for the RICT program is addressed using a standard endorsed by the NRC. Attachment 11 to this enclosure provides a discussion of the programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.
Attachment 12 to this enclosure provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified for use in the configuration risk management program (CRMP) to assess real-time configuration risk, and describes the scope of and quality controls applied to the CRMP.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 3 Attachment 13 to this enclosure provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified for this LAR, and how their impact on the RICT program was assessed and evaluated.
Attachment 14 to this enclosure provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program, including risk management action (RMA) implementation.
Attachment 15 to this enclosure provides a description of the monitoring program as described in NEI 06-09-A (Reference 4).
Finally, attachment 16 to this enclosure provides a description of the process to identify RMAs and includes specific examples of RMAs.
2.3 Proposed
Technical Specification and License Condition Changes APS proposes the addition of the following conditions to the PVNGS renewed operating licenses of Units 1, 2, and 3 to address the scope of the PRA methods approved by the NRC staff for use in the PVNGS RICT program.
- 1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.
- 2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.
Additionally, APS requests that license conditions implemented by license amendment (LA) numbers 171 and 200 be deleted because these conditions are no longer applicable.
- LA number 171 adopted TSTF-448 which provided a schedule for implementation of various control room habitability tests. These tests have been completed therefore this license condition is no longer applicable.
- LA number 200 authorized the Unit 3 train B emergency diesel generator (EDG) extended required action completion time which is no longer applicable.
APS proposes certain changes to the original LAR (Reference 1). These proposed differences between the PVNGS original LAR and this LAR supplement are provided in Table 1 - Supplement Summary Table.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 4 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 1 1.3 Completion Times Changes to the example in TS section 1.3 reflect a loss of function similar to the RICT lead plant submittal.
2 3.3.4 Reactor Protective System (RPS) Logic and Trip Initiation This LCO is no longer included in the RICT LAR supplement, primarily since it is not modeled in PRA. This is consistent with how it was communicated to the NRC in reference 2.
3 3.3.6 Engineered Safety Features Actuation System (ESFAS)
Logic and Manual Trip This LCO is included in the RICT LAR supplement, with changes:
- Condition A (matrix logic) is no longer included since it is not modeled in PRA.
- Condition B is being kept (one channel of manual trip or ESFAS initiation logic).
- Condition C is no longer included (loss of function for instrumentation).
- Condition D is being kept (one channel of ESFAS actuation logic).
- Condition E is no longer included (loss of function for instrumentation).
4 3.4.9 Pressurizer This LCO is no longer included in the RICT LAR supplement since the pressurizer heaters are not modeled in PRA. 5 3.4.10 Pressurizer Safety Valves (PSV) - Modes 1, 2, and 3 This LCO is included in the RICT LAR supplement, similar to the RICT lead plant submittal.
- Condition A is for one PSV being inoperable and the appropriate loss of function (LOF) notes have been added.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 5 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 6 3.4.12 Pressurizer Vents This LCO is included in the RICT LAR supplement. The pressurizer vent paths are modeled in the PRA and credited in the PVNGS safety analysis for the steam generator tube rupture event as described in updated final safety analysis report (UFSAR) section 15.6.3. The pressurizer vent TS at PVNGS has similarities to the pressurizer power-operated relief valves (PORVs) TS 3.4.11 addressed in the RICT lead plant submittal:
- Condition A for two or three vents paths is being kept.
- Condition B for all vents paths inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the last pressurizer vent path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the last pressurizer vent path, as opposed to all vent paths, that renders the RICT not applicable.
7 3.5.1 Safety Injection Tanks (SIT) - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal Accumulator TS:
- Condition A for a SIT inoperable due to boron concentration not within limits is no longer in RICT scope since it is a parameter.
- Condition B for one SIT inoperable for reasons other than boron is also not in scope since the loss of a SIT is a loss of function condition which would be limited to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and PVNGS already has a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> completion time.
- Condition C for two or more SITs being inoperable for reasons other than boron is being kept similar to the RICT lead plant submittal approval. This is a loss of function condition with the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent SIT, as opposed to two or more SITs, intentionally made inoperable that render the condition being not applicable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 6 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 8 3.5.3 ECCS - Operating This LCO is included in the RICT LAR supplement but has changes:
- Condition A for one low pressure safety injection (LPSI) subsystem inoperable is kept. The RICT lead plant submittal did not have this condition in their TS.
- Condition B is kept but has changes. This is for one or more ECCS trains being inoperable AND at least 100% of the flow equivalent to one train being available. The portion after the AND is now kept in the TS similar to the RICT lead plant submittal to ensure it is not a loss of function.
- Condition C is no longer included since it is only for less than 100% of flow available.
9 3.5.5 Refueling Water Tank (RWT) This LCO is included in the RICT LAR supplement but has changes:
- Condition A for the RWT being inoperable for boron or temperature not within limits is no longer in the RICT scope since they are parameters.
- Condition B for the RWT being inoperable for reasons other than Condition A is being kept. It is a loss of function and all appropriate notes have been added, this is similar to the RICT lead plant submittal. 10 3.6.2 Containment Air Locks This LCO is included in the RICT LAR supplement without any changes:
- Only Condition C is in the scope of RICT and is for the airlock being inoperable for reasons other than Condition A (one door in the airlock inoperable) or B (interlock mechanism inoperable). There is already a required action in Condition C to evaluate overall containment leakage rate is per TS 3.6.1 so this is not a loss of function condition, this is similar to the RICT lead plant submittal.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 7 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 11 3.6.3 Containment Isolation Valves (CIVs) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one CIV inoperable is being kept.
- Condition B for two CIVs in the same penetration is being kept and the appropriate LOF notes have been added. The wording of note 2 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CIV is intentionally made inoperable since this condition is part of the current licensing basis. Also, the wording was changed to be more precise that it is the second CIV, as opposed to the first two CIVs, that renders the RICT not applicable.
- Condition C for one CIV inoperable in penetrations with only one CIV and a closed system inside containment is being kept. This is not a loss of function condition due to the closed system inside containment.
- Condition D for one or more containment purge (CP) valves having leakage above their limit is being kept in RICT scope. The loss of function notes have been added with a clarifier that the notes only apply when there is a loss of function condition since if there is one CP valve operable, it would not be a loss of function condition. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second CP valve is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second CP valve, as opposed to the first two, that renders the RICT not applicable. 12 3.6.6 Containment Spray System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one train of containment spray is being kept within the RICT scope.
- Condition C for two trains is no longer included. 13 3.7.2 Main Steam Isolation Valves (MSIVs) This LCO is included in the RICT LAR supplement but has changes:
- Condition F for one MSIV inoperable in MODE 1 is being kept with no changes.
- Condition G for more than one MSIV inoperable is being kept and the appropriate LOF notes have been added. The wording of note 1 was changed to be more precise that it is the second or a subsequent MSIV, as opposed to two or more MSIVs, intentionally made inoperable that render the condition being not applicable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 8 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 14 3.7.3 Main Feedwater Isolation Valves (MFIVs) This LCO is included in the RICT LAR supplement but has changes. The MFIVs are modeled in the PRA and credited in the safety analysis to close during a steam line break and a feedwater line break:
- Condition A for one or more MFIVs inoperable is being kept.
- Condition B for two valves in the same flow path is being kept and the appropriate LOF notes have been added. The wording of note 1 was modified to be more specific that the RICT is not applicable as opposed to the entire condition being not applicable when the second valve in the affected flow path is intentionally made inoperable since this condition is part of the current licensing basis and not a new condition. Also, the wording was changed to be more precise that it is the second valve in the affected flow path, as opposed to the first two, that renders the RICT not applicable. 15 3.7.4 Atmospheric Dump Valves (ADVs) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:
- Condition A is being kept for one ADV (per SG) without any changes.
- Condition B is being kept but has a clarifier on the applicability of the loss of function notes since if one ADV is operable (with as many as three being inoperable) it is not a loss of function. With all four ADVs inoperable, it is a loss of function condition. The wording of note 1 was changed to be more precise that it is the last ADV, as opposed to all ADVs, intentionally made inoperable that renders the condition not applicable. 16 3.7.5 Auxiliary Feedwater (AFW) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one steam supply inoperable is being kept.
- Condition B for one AFW train inoperable for reasons other than condition A is being kept.
- Condition C for two AFW trains inoperable is being kept. It is a loss of function condition that has the appropriate notes added along with a clarifier since if one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function. The wording of note 1 was changed to be more precise that it is the second AFW train, as opposed to two AFW trains, being inoperable that renders the condition not applicable. 17 3.7.6 Condensate Storage Tank (CST) This LCO is no longer included in the RICT LAR supplement primarily since it is a single train system that was not within the RICT lead plant submittal.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 9 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 18 3.7.7 Essential Cooling Water (EW) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one train of EW inoperable is being kept.
- Condition B for two trains of EW inoperable is being kept but is a loss of function condition that has the appropriate notes added. 19 3.7.8 Essential Spray Pond System (ESPS) This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one train of ESPS inoperable is being kept.
- Condition B for two trains of ESPS inoperable is being kept but is a loss of function condition that has the appropriate notes added. 20 3.7.9 Ultimate Heat Sink (UHS) This LCO is no longer included in RICT LAR supplement, primarily since it is a single train system. 21 3.7.10 Essential Chilled Water (EC) System This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant submittal:
- Condition A for one train of EC inoperable is being kept.
- Condition B for two trains of EC inoperable is being kept but is a loss of function condition that has the appropriate notes added. 22 3.7.12 Control Room Emergency Air Temperature Control System (CREATCS) This LCO is no longer included in the RICT LAR supplement, primarily since Condition A for one train inoperable already allows 30 days to restore and Condition B for two trains inoperable was not within the RICT lead plant submittal.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 10 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 23 3.8.1 AC Sources - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:
- Condition A for one offsite circuit inoperable is being kept without changes.
- Condition B for one diesel generator (DG) inoperable is being kept without changes. The Note above the 10 day Completion Time regarding License Amendment 200 is being deleted since it is no longer applicable.
- Condition C for two offsite circuits inoperable is being kept without changes.
- Condition D for one offsite circuit and one DG inoperable stays without changes.
- Condition E for two DGs inoperable is being kept but has loss of function notes added. Note 1 was modified to be more precise that it is the second diesel generator, not two diesel generators, that renders the condition not applicable.
- Condition F for one DG Sequencer inoperable is being kept without changes.
- Old Condition I for three or more required alternate current (AC) sources inoperable is being kept in the RICT scope but changes to be a loss of function and designate it as new condition H. The wording of note 1 was changed to be more precise in that it is the third or a subsequent required AC source, as opposed to three or more required AC sources, intentionally made inoperable that renders the condition being not applicable.
24 3.8.4 DC Sources - Operating This LCO is included in the RICT LAR supplement but has changes, similar to the RICT lead plant:
- Condition A for one battery charger on a subsystem inoperable is being kept in RICT scope. However, required Action A.1 for restoring the battery terminal voltage to greater than minimum float voltage is no longer included in the RICT scope because it is a parameter. Only required action A.3 for restoring the battery charger to operable status stays.
- Condition B for one direct current (DC) electrical power subsystem being inoperable for reasons other than Condition A is being kept.
- Condition C for two DC electrical subsystems being inoperable is being kept but is a loss of function condition that has all of the appropriate LOF notes added. The wording on note 1 was changed to be more precise that it is the second DC electrical subsystem, not two DC electrical subsystems, intentionally made inoperable that renders the condition being not applicable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Table 1 - Supplement Summary Table 11 ITEM # PVNGS Limiting Condition of Operation (LCO) Description of Change in this LAR supplement 25 3.8.7 Inverters - Operating This LCO is included in the RICT LAR supplement but has changes:
- Condition A for one inverter being inoperable is being kept.
- Condition B for two or more inverters being inoperable stays in scope but has a clarifier since this condition does not always result in a loss of function. PVNGS design has two trains of inverters with a total of four inverters channels A, B, C and D. Channels A and C are train A. Channels B and D are train B. If two inverters in the same train are inoperable and the other two inverters on the opposite train remain operable, it is not a loss of function. The wording of note 1 was changed to be more precise that it is the second or a subsequent required inverter, as opposed to two or more required inverters, intentionally made inoperable that renders the Condition being not applicable. 26 3.8.9 Distribution Systems - Operating This LCO is included in the RICT LAR supplement but has changes:
- Condition A for one AC electrical power distribution subsystem being inoperable is being kept.
- Condition B for one AC vital instrument bus being inoperable is being kept.
- Condition C for one DC electrical power distribution subsystem is being kept
- New Condition D for two or more electrical power distribution subsystems being inoperable is being kept in scope but is a loss of function condition and has the appropriate notes added. The wording of note 1 was changed to be more precise that it is the second or a subsequent electrical power distribution subsystem, as opposed to two or more electrical power distribution subsystems, intentionally made inoperable that renders the Condition being not applicable. 27 5.5.20 Risk-Informed Completion Time Program The TS program for risk informed completion time is included with changes to coincide with the TS program language from the RICT lead plant with minor changes. Editorial changes were made on the pages for the Battery Monitoring Program of TS 5.5.19 to eliminate reference to the SFP Transition.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 12 3.0 REGULATORY SAFETY ANALYSIS APS has evaluated the proposed change to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.
APS requests adoption of the proposed changes to the TS and plant specific TS, to modify the TS requirements related to completion times for required actions to provide the option to calculate RICT based on risk levels a ssociated with equipment determined to be inoperable that are within the scope of the RICT program. The allowance is described in a new program in TS Section 5, Administrative Controls, entitled Risk Informed Completion Time Program. The proposed RICT program conforms to the NRC model safety evaluation, Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, dated May 17, 2007 (References 4 and 6).
Attachment 4 of the enclosure to this letter contains a proposed regulatory commitment (as defined by NEI 99-04, Guidelines for Managing NRC Commitment Changes, Revision 0) and license conditions. The commitment contained in Attachment 4 of the enclosure supersedes the commitments in reference 1.
As required by 10 CFR 50.91(a), Notice for Public Comment, an analysis of the issue of no significant hazards consideration was provided in the original license amendment request. This LAR supplement does not affect the conclusions of the no significant hazards consideration determination [10 CFR 50.91(a)] provided in the original LAR (Reference 1).
4.0 ENVIRONMENTAL CONSIDERATION
APS has reviewed the environmental evaluation included in the model safety evaluation published on March 15, 2012, as part of the Notice of Availability (77 FR 15399). APS has concluded that the NRC staff findings presented in that evaluation are applicable to PVNGS.
The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, Standards for Protection Against Radiation, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22, Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review. Therefore, pursuant to 10 CFR 51.22, no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times 13
References:
- 1. Arizona Public Service (APS) Company Letter 102-07060, License Amendment Request to Revise Technical Specifications to Adopt TSTF-505-A, Revision 1, Risk-Informed Completion Times, dated July 31, 2015 (ADAMS Accession Number ML15218A300)
- 2. APS Letter 102-07227, Response to Request for Additional Information Regarding License Amendment Request to Adopt TSTF-505, dated April 11, 2016 (ADAMS Accession Number ML16102A463)
- 3. Vogtle Electric Generating Plant Units 1 and 2 - Issuance of Amendments Regarding implementation of Topical Report Nuclear Energy Institute NEI 06-09, " Risk-Informed Technical Specifications Initiative 4B, Risk-Managed Technical Specification (RMTS) Guidelines," Revision 0-A, dated August 8, 2017 (ADAMS Accession Number ML15127A669)
- 4. Nuclear Energy Institute (NEI) 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)
Guidelines (NEI 06-09-A), dated November 13, 2006 (ADAMS Accession Number ML12286A322)
- 5. Issues with Technical Specification Task Force Traveler TSTF-505, Revision 1, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4 B, dated November 15, 2016 (ADAMS Accession Number ML16300A245)
- 6. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-informed Technical Specifications initiative 4B, Risk-Managed Technical Specifications (RMT) Guideline (TAC NO. MD4995), dated May 17, 2007 (ADAMS Accession Number ML071200238)
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 1 Proposed Technical Specification Changes TS Mark-up Pages 1.3-13 3.7.7-1 3.3.6-1 3.7.8-1 3.3.6-2 3.7.10-13.4.10-1 3.8.1-2 3.4.12-1 3.8.1-3 3.5.1-1 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.4-1 3.6.2-3 3.8.7-1 3.6.3-1 3.8.7-2 3.6.3-2 3.8.9-1 3.6.3-3 3.8.9-2 3.6.3-4 5.5-19 3.6.6-1 5.5-19a 3.7.2-2 3.7.3-1 3.7.4-1 3.7.5-1 3.7.5-2
Completion Times 1.3 1.3 Completion Times ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 1.3-13 AMENDMENT NO. 117 EXAMPLES EXAMPLE 1.3-7 (continued) The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time
Condition A was initially entered. If Required Action A.1
is met after Condition B is entered, Condition B is exited
and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 has not expired. ______________________________________________________________________________ IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a controlled manner.
Insert1 INSERT 1 (1.3-13) EXAMPLES EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem inoperable. A.1 Restore subsystem to OPERABLE status.
7 days OR In accordance with the Risk
Informed Completion Time
Program B. ------NOTES------
- 1. Not applicable when second
subsystem
intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. --------------
Two subsystems inoperable. B.1 Restore at least one subsystem to OPERABLE
status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program C. Required Action and associated
Completion Time not met. C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours When a subsystem is declared inoperable, Condition A is entered.
The 7 day Completion Time may be applied as discussed in Example
1.3-2. However, the licensee may elect to apply the Risk
Informed Completion Time Program which permits calculation of a
Risk Informed Completion Time (RICT) that may be used to
complete the Required Action beyond the 7 day Completion Time.
INSERT 1 (1.3-13 continued)
The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status
within the RICT or Condition C must also be entered.
If a second subsystem is declared inoperable, Condition B may also be entered. The Condition is modified by two Notes. The
first note states it is not applicable if the second subsystem
is intentionally made inoperable. The second Note provides
restrictions applicable to these "loss of function" Conditions.
The Required Actions of Condition B are not intended for
voluntary removal of redundant subsystems from service. The
Required Action is only applicable if one subsystem is
inoperable for any reason and the second subsystem is found to
be inoperable, or if both subsystems are found to be inoperable
at the same time. If Condition B is applicable, at least one
subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or
Condition C must also be entered. The licensee may be able to
apply a RICT or to extend the Completion Time beyond 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, but
not longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, if the requirements of the Risk
Informed Completion Time Program are met. If two subsystems are
inoperable and Condition B is not applicable (i.e., the second
subsystem was intentionally made inoperable), LCO 3.0.3 is
entered as there is no applicable Condition.
The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned
changes, the revised RICT must be determined prior to
implementation of the change in configuration. For emergent
conditions, the revised RICT must be determined within the time
limits of the Required Action Completion Time (i.e., not the
RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less.
If the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time clock of Condition B have expired and subsequent
changes in plant conditions result in exiting the applicability
of the Risk Informed Completion Time Program without restoring
the inoperable subsystem to OPERABLE status, Condition C is also
entered and the Completion Time clocks for Required Actions C.1
and C.2 start.
If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable
subsystem has not been restored to OPERABLE status, Condition C
is also entered and the Completion Time clocks for Required
Actions C.1 and C.2 start. If the inoperable subsystems are
restored to OPERABLE status after Condition C is entered, Conditions A, B, and C are exited, and therefore, the Required Actions of Condition C may be terminated.
ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2,3 3.3.6-1 AMENDMENT NO. 117
3.3 INSTRUMENTATION
3.3.6 Engineered
Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four
channels of Manual Trip shall be OPERABLE for each Function
in Table 3.3.6-1. APPLICABILITY: According to Table 3.3.6-1.
ACTIONS ------------------------------------NOTE-------------------------------------
Separate Condition entry is allowed for each Function.
CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one Matrix Logic
channel inoperable.
OR Three Matrix Logic channels are
inoperable due to a
common power source
failure de-energizing
three matrix power
supplies. A.1 Restore channel to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> B. One or more Functions with one Manual Trip
or Initiation Logic
channel inoperable. B.1 Restore channel to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> (continued)
Insert2 INSERT 2 OR In accordance with the Risk Informed Completion Time Program Reviewers Note:
The "Insert 2" is used repeatedly throughout this package. The insert will not be provided as a separate page every time it is
used. This will be the only time the insert page will follow the
marked-up TS page.
ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2,3 3.3.6-2 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions with two Initiation
Logic channels or
Manual Trip channels
affecting the same
trip leg inoperable. C.1 Open at least one contact in the
affected trip leg of
both ESFAS Actuation
Logics. AND Immediately C.2 Restore channels to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> D. One or more Functions with one Actuation
Logic channel
D.1 --------NOTE---------
One channel of
Actuation Logic may
be bypassed for up to
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for
Surveillances, provided the other
channel is OPERABLE.
Restore inoperable channel to OPERABLE
status. 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> E. Required Action and associated Completion
Time of Conditions for
Actuation Signal, Main
Steam Isolation Signal
Actuation Signal not
met. E.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> E.2 Be in MODE 4. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (continued)
Insert2 Pressurizer Safety Valves-MODES 1, 2, and 3 3.4.10PALO VERDE UNITS 1,2,33.4.10-1AMENDMENT NO. 117
3.4 REACTOR
COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves - Modes 1, 2 and 3LCO 3.4.10Four pressurizer safety valves shall be OPERABLE with lift settings 2450.25 psia and 2549.25 psia.APPLICABILITY:MODES 1, 2, and 3,-----------------------------NOTE----------------------------
The lift settings are not required to be within LCO limits
during MODES 3 and 4 for the purpose of setting the
pressurizer safety valves under ambient (hot) conditions.
This exception is allowed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following entry into
MODE 3 provided a preliminary cold setting was made prior to
heatup.
ACTIONSCONDITIONREQUIRED ACTIONCOMPLETION TIMEA.One p ressurizer safety valve inoperable.A.1Restore valve to OPERABLE status.
15 minutesB.1Be in MODE 3.
AND 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />sB.Required Action and associated Completion
Time not met.
OR Two or more pressurizer safety
valves inoperable.B.2Be in MODE 412 hour0.00477 days <br />0.114 hours <br />6.812169e-4 weeks <br />1.56766e-4 months <br />sInsert2Insert3.
INSERT 3 (3.4.10-1)
NOTES------------------------------
- 1. Not applicable when pressurizer safety valve intentionally made inoperable.
- 2. The following Section 5.5.20 constraints are applicable:
parts b, c.2, c.3, d, e, f, g, and h.
Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2,3 3.4.12-1 AMENDMENT NO. 117 , 188 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3.
MODE 4 with RCS pressure 385 psia.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required pressurizer vent paths
inoperable. A.1 Restore required pressurizer vent
paths to OPERABLE status. 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. All pressurizer vent paths inoperable. B.1 Restore one pressurizer vent path to OPERABLE status.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C. Required Action and associated Completion
Time of Condition A, or B not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 4 with RCS pressure < 385 psia.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Insert2Insert2Insert4 INSERT 4 (3.4.12-1)
NOTES------------------------------
- 1. Not applicable when last pressurizer vent path intentionally made inoperable.
- 2. The following Section 5.5.20 constraints are applicable:
parts b, c.2, c.3, d, e, f, g, and h.
SITs-Operating 3.5.1 PALO VERDE UNITS 1,2,3 3.5.1-1 AMENDMENT NO. 117 , 118 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
3.5.1 Safety
Injection Tanks (SITs) - Operating LCO 3.5.1 Four SITs shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODES 3 and 4 with pressurizer pressure 1837 psia.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due to boron concentration
not within limits.
OR One SIT inoperable due to inability to verify level or pressure. A.1 Restore SIT to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. One SIT inoperable for reasons other than Condition A. B.1 Restore SIT to OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> C. Required Action and associated Completion
Time of Condition A
or B not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Reduce pressurizer pressure to
< 1837 psia.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> D. Two or more SITs inoperable. D.1 Enter LCO 3.0.3. Immediately Insert5 D D D,B,orC INSERT 5 (3.5.1-1)
C. ----- NOTES -----
- 1. Not applicable when the second
or a subsequent
SIT intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Two or more SITs inoperable for
reasons other than
Condition A.
C.1 Restore all but one SIT to OPERABLE
status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program ECCS - Operating 3.5.3 PALO VERDE UNITS 1,2,3 3.5.3-1 AMENDMENT NO. 117 , 124 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS - Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE. APPLICABILITY: MODES 1 and 2, MODE 3 with pressurizer pressure 1837 psia or with RCS T c 485°F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem inoperable. A.1 Restore subsystem to OPERABLE status.
7 days B. One or more trains inoperable for reasons
other than Condition
A. AND At least 100% of the ECCS flow equivalent
to a single OPERABLE
ECCS train available. B.1 Restore train(s) to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Reduce pressurizer pressure to
< 1837 psia.
AND 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> C.3 Reduce RCS T c to < 485°F. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Insert2Insert2 RWT 3.5.5 PALO VERDE UNITS 1,2,3 3.5.5-1 AMENDMENT NO. 117
3.5 EMERGENCY
CORE COOLING SYSTEMS (ECCS)
3.5.5 Refueling
Water Tank (RWT) LCO 3.5.5 The RWT shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron concentration not within limits.
OR RWT borated water temperature not within limits. A.1 Restore RWT to OPERABLE status.
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> B. RWT inoperable for reasons other than
Condition A. B.1 Restore RWT to OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Insert2Insert6 INSERT 6 (3.5.5-1)
NOTES------------------------------
- 1. Not applicable when RWT is intentionally made inoperable.
- 2. The following Section 5.5.20 constraints are applicable:
parts b, c.2, c.3, d, e, f, g, and h.
Containment Air Locks 3.6.2 PALO VERDE UNITS 1,2,3 3.6.2-3 AMENDMENT NO. 117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.1 Verify an OPERABLE door is closed in the
affected air lock.
AND 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> B.2 Lock an OPERABLE door closed in the
affected air lock.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> B.3 --------NOTE---------
Air lock doors in
may be verified
locked closed by
administrative means.
Verify an OPERABLE door is locked closed
in the affected air
lock. Once per 31 days C. One or more containment air locks
inoperable for reasons
other than Condition A
or B. C.1 Initiate action to evaluate overall
containment leakage
rate per LCO 3.6.1.
AND Immediately C.2 Verify a door is closed in the
affected air lock.
AND 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> C.3 Restore air lock to OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (continued)Insert2 Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-1 AMENDMENT NO. 117 , 166 3.6 CONTAINMENT SYSTEMS
3.6.3 Containment
Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS -------------------------------------NOTES----------------------------------- 1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls. 2. Separate Condition entry is allowed for each penetration flow path. 3. Enter applicable Conditions and Required Actions for system(s) made inoperable by containment isolation valves. 4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria. 5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in
accordance with SR 3.6.1.1.
CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE---------
Only applicable to
penetration flow paths
with two required
containment isolation
valves.
One or more penetration flow paths
with one required
containment isolation
valve inoperable
except for purge valve
leakage not within
limit. A.1 Isolate the affected penetration flow path
by use of at least
one closed and
de-activated
automatic valve, closed manual valve, blind flange, or
check valve with flow
through the valve
secured. AND 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (continued) Insert2 Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO. 117 , 166 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 --------NOTE---------
Isolation devices in
may be verified by
use of administrative
means.
Verify the affected penetration flow path
is isolated.
Once per 31 days for isolation
devices outside
containment AND Prior to entering MODE 4
from MODE 5 if
not performed
within the
previous 92 days
for isolation
devices inside
containment B. ---------NOTE---------
Only applicable to
penetration flow paths
with two required
containment isolation
valves. ----------------------
One or more penetration flow paths
with two required
containment isolation
valves inoperable
except for purge valve
leakage not within
limit. B.1 Isolate the affected penetration flow path
by use of at least
one closed and
de-activated
automatic valve, closed manual valve, or blind flange.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (continued) following isolationInsert2 SInsert7 1.
INSERT 7 (3.6.3-2)
- 2. RICT is not applicable when the second containment isolation valve is intentionally made inoperable.
- 3. The following Section 5.5.20 constraints are applicable:
parts b, c.2, c.3, d, e, f, g, and h.
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-3 AMENDMENT NO. 117 , 166 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. ---------NOTE---------
Only applicable to
penetration flow paths
with only one required
containment isolation
valve and a closed
system.
One or more penetration flow paths
with one required
containment isolation
valve inoperable. C.1 Isolate the affected penetration flow path
by use of at least
one closed and
de-activated
automatic valve, closed manual valve, or blind flange.
AND C.2 --------NOTE---------
Isolation devices in
may be verified by
use of administrative
means. ---------------------
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Verify the affected penetration flow path
is isolated.
Once per 31 days D. One or more penetration flow paths
with one or more
required containment
purge valves not
within purge valve
leakage limits. D.1 Isolate the affected penetration flow path
by use of at least
one closed and
de-activated
automatic valve with
resilient seals, or
blind flange.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (continued) following isolationInsert2Insert2Insert8 INSERT 8 (3.6.3-3)
NOTES------------------------------
- 1. RICT is not applicable when the second containment purge valve is intentionally made inoperable.
- 2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-4 AMENDMENT NO. 117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued) D.2 --------NOTE---------
Isolation devices in
may be verified by
use of administrative
means.
Verify the affected penetration flow path
is isolated.
Once per 31 days for isolation
devices outside
containment AND Prior to entering MODE 4
from MODE 5 if
not performed
within the
previous 92 days
for isolation
devices inside
containment AND D.3 Perform SR 3.6.3.6 for the resilient
seal purge valves
closed to comply with
Required Action D.1.
Once per 92 days E. Required Action and associated Completion
Time not met. E.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> E.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following isolation following isolation Containment Spray System 3.6.6 PALO VERDE UNITS 1,2,3 3.6.6-1 AMENDMENT NO. 117
3.6 CONTAINMENT
SYSTEMS
3.6.6 Containment
Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3.
MODE 4 when RCS pressure is 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray train inoperable. A.1 Restore containment spray train to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. Required Action and associated Completion
Time of Condition A
not met. B.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 4 with RCS pressure < 385 psia.
84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> C. Two containment spray trains inoperable. C.1 Enter LCO 3.0.3. Immediately Insert2 MSIVs 3.7.2 PALO VERDE UNITS 1,2,3 3.7.2-2 AMENDMENT NO. 1 17 , 163 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV actuator trains
OR Required Action and associated Completion
Time of Condition A, B, or C not met. E.1 Declare each affected MSIV inoperable.
Immediately F. One MSIV inoperable in MODE 1. F.1 Restore MSIV to OPERABLE status.
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> G. Required Action and Associated Completion
Time of Condition F
not met. G.1 Be in MODE 2. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> H. ---------NOTE---------
Separate Condition
entry is allowed for
each MSIV.
One or more MSIVs inoperable in MODE 2, 3, or 4. H.1 Close MSIV.
AND H.2 Verify MSIV is closed. 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Once per 7 days I. Required Action and associated Completion
Time of Condition H
not met. I.1 Be in MODE 3.
AND I.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Insert9 H H I I I J J JInsert2orG I INSERT 9 (3.7.2-2)
G. ----- NOTES -----
- 1. Not applicable when the second
or a subsequent
MSIV intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two or more MSIVs inoperable in MODE
- 1.
G.1 Restore all but one MSIV to OPERABLE
status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program MFIVs 3.7.3 PALO VERDE UNITS 1,2,3 3.7.3-1 AMENDMENT NO. 117 158 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs) LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power
operated valve.
ACTIONS -------------------------------------NOTE------------------------------------
Separate Condition entry is allowed for each penetration flow path.
CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs inoperable. A.1 Close or isolate inoperable MFIV.
AND A.2 Verify inoperable MFIV is closed or
isolated.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Once per 7 days B. Two valves in the same flow path
inoperable. B.1 Isolate affected flow path. AND B.2 Verify inoperable MFIV is closed or
isolated.
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Once per 7 days (continued) Insert10 INSERT 10 (3.7.3-1) A.1 Restore MFIV(s) to OPERABLE status.
OR A.2.1 Close or isolate inoperable MFIV(s). AND A.2.2 Verify inoperable MFIV(s) is closed
or isolated.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Once per 7 days following Isolation B. ----- NOTES ------
- 1. RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable.
- 2. The following Section 5.5.20
constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h.
Two valves in the same flow path
B.1 Restore one valve to OPERABLE status. OR
B.2.1 Isolate affected flow path.
AND B.2.2 Verify inoperable MFIV(s) is closed
or isolated.
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Once per 7 days following Isolation
ADVs 3.7.4 PALO VERDE UNITS 1,2,3 3.7.4-1 AMENDMENT NO. 165 , 191 (CORRECTEDPAGE)
3.7 PLANT
SYSTEMS
3.7.4 Atmospheric
Dump Valves (ADVs) LCO 3.7.4 Four ADV lines shall be OPERABLE. APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------
Separate Condition
entry is allowed for
each SG. --------------------
One required ADV line inoperable. A.1 Restore ADV line to OPERABLE status.
7 days B. Two or more ADV lines inoperable with both
ADV lines inoperable
on one or more SGs. B.1 Restore one ADV line to OPERABLE status on
each SG. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND C.2 Be in MODE 4 without reliance on steam
generator for heat
removal. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 24 hours Insert2Insert11Insert2 INSERT 11 (3.7.4-1)
NOTES------------------------------
- 1. Not applicable when the last ADV intentionally made inoperable resulting in loss of safety function.
- 2. The following Section 5.5.20 constraints are applicable when there is a loss of function: parts b, c.2, c.3, d, e, f, g, and h.
AFW System 3.7.5 PALO VERDE UNITS 1,2,3 3.7.5-1 AMENDMENT NO. 165, 197
3.7 PLANT
SYSTEMS
3.7.5 Auxiliary
Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.
NOTE----------------------------
Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.
APPLICABILITY: MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.
ACTIONS ------------------------------------NOTE-------------------------------------
LCO 3.0.4.b is not applicable.
CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to turbine driven AFW
pump inoperable.
OR ---------NOTE---------
Only applicable if MODE 2 has not been
entered following
refueling.
One turbine driven AFW pump inoperable in
MODE 3 following
refueling. A.1 Restore affected equipment to OPERABLE
status. 7 days B. One AFW train inoperable for reasons
other than Condition A
in MODE 1, 2, or 3.
B.1 Restore AFW train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (continued) Insert2Insert2 AFW System 3.7.5 PALO VERDE UNITS 1,2,3 3.7.5-2 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion
Time of Condition A
or B not met.
OR Two AFW trains inoperable in
MODE 1, 2, or 3 C.1 Be in MODE 3.
AND C.2 Be in MODE 4.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours D. Three AFW trains inoperable in MODE 1, 2, or 3. D.1 --------NOTE---------
LCO 3.0.3 and all other LCO Required
Actions requiring
MODE changes are
suspended until one
AFW train is restored
to OPERABLE status.
Initiate action to restore one AFW train
to OPERABLE status.
Immediately E. Required AFW train inoperable in MODE 4.
E.1 --------NOTE---------
LCO 3.0.3 and all
other LCO Required
Actions requiring
MODE changes are
suspended until one
AFW train is restored
to OPERABLE status.
Initiate action to restore one AFW train
to OPERABLE status.
Immediately Insert12 D D D,B,orC E E F F INSERT 12 (3.7.5-2)
C. ----- NOTES -----
- 1. Not applicable when second AFW
train intentionally
made inoperable
resulting in loss
of safety
function.
- 2. The following Section 5.5.20
constraints are
applicable when
there is a loss
of function:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two AFW trains inoperable in MODE
1, 2, or 3.
C.1 Restore at least one AFW train to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program EW System 3.7.7 PALO VERDE UNITS 1,2,3 3.7.7-1 AMENDMENT NO. 117
3.7 PLANT
SYSTEMS
3.7.7 Essential
Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train inoperable.
A.1 --------NOTE---------
Enter applicable
Conditions and
Required Actions of
Loops - MODE 4" for
shutdown cooling made
inoperable by EW.
Restore EW train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. Required Action and associated Completion
Time of Condition A
not met. B.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> Insert2Insert13 C C C INSERT 13 (3.7.7-1)
B. ----- NOTES -----
- 1. Not applicable when second EW
train intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two EW trains inoperable.
B.1 Restore at least one EW train to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program ESPS 3.7.8 PALO VERDE UNITS 1,2,3 3.7.8-1 AMENDMENT NO. 117
3.7 PLANT
SYSTEMS
3.7.8 Essential
Spray Pond System (ESPS) LCO 3.7.8 Two ESPS trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train inoperable.
A.1 --------Notes-------- 1. Enter applicable Conditions and
Required Actions
of LCO 3.8.1.
"AC Sources Operating," for
emergency diesel
generator made
inoperable by
ESPS. 2. Enter applicable Conditions and
Required Actions
of LCO 3.4.6.
"RCS Loops MODE 4," for
made inoperable
by ESPS. ---------------------
Restore ESPS train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. Required Action and associated Completion
Time of Condition A
not met. B.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> C CInsert14 CInsert2 INSERT 14 (3.7.8-1)
B. ----- NOTES -----
- 1. Not applicable when second ESPS
train intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two ESPS trains inoperable.
B.1 Restore at least one ESPS train to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program EC 3.7.10 PALO VERDE UNITS 1,2,3 3.7.10-1 AMENDMENT NO. 117 , 188 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train inoperable. A.1 Restore EC train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. Required Action and associated Completion
Time not met. B.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power operated, and automatic valve in the flow
path, that is not locked, sealed, or
otherwise secured in position, is in the
correct position.
In accordance with the Surveillance
Frequency
Control Program SR 3.7.10.2 Verify the proper actuation of each EC System component on an actual or simulated
actuation signal.
In accordance with the Surveillance
Frequency
Control Program Insert15 C C CInsert2 INSERT 15 (3.7.10-1)
B. ----- NOTES -----
- 1. Not applicable when second EC
train intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two EC trains inoperable.
B.1 Restore at least one EC train to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-2 AMENDMENT NO. 164, 197 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.3 Restore required offsite circuit to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. One DG inoperable. B.1 Perform SR 3.8.1.1 for the OPERABLE
required offsite
circuit(s).
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> AND Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter AND B.2 Declare required feature(s) supported
by the inoperable DG
inoperable when its
redundant required
feature(s) is
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from discovery of
Condition B
concurrent with
inoperability of
redundant
required feature(s) AND B.3.1 Determine OPERABLE DG is not
inoperable due to
common cause failure.
OR 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> B.3.2 Perform SR 3.8.1.2 for OPERABLE DG.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> AND (continued) Insert2 AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO. 197, 200 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG to OPERABLE
status. -------NOTE------
For the Unit 3
Train B DG failure
on December 15, 2016, restore the
inoperable DG to
OPERABLE status
within 62 days.
10 days C. Two required offsite circuits inoperable. C.1 Declare required feature(s)
inoperable when
its redundant
required feature(s) is
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from discovery of
Condition C
concurrent with
inoperability of
redundant required
feature(s) AND C.2 Restore one required offsite
circuit to
OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (continued)
Deleted NOTE fromLA 200Insert2Insert2 AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO. 117 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite circuit inoperable.
AND One DG inoperable.
NOTE-------------
Enter applicable Conditions
and Required Actions of
LCO 3.8.9, "Distribution
Systems Operating," when Condition D is entered with
no AC power source to a
train.
D.1 Restore required offsite circuits to
OPERABLE status.
OR 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> D.2 Restore DG to OPERABLE status.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> E. Two DGs inoperable. E.1 Restore one DG to OPERABLE status.
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> F. One automatic load sequencer inoperable. F.1 Restore automatic load sequencer to
OPERABLE status.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> F.2 Declare required feature(s) supported
by the inoperable
sequencer inoperable
when its redundant
required feature(s)
is inoperable.
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from discovery of
Condition F
concurrent with
inoperability of
redundant
required feature(s) (continued) Insert2Insert2Insert2Insert2Insert16 INSERT 16 (3.8.1-4)
NOTES------------------------------
- 1. Not applicable when second DG intentionally made inoperable.
- 2. The following Section 5.5.20 constraints are applicable:
parts b, c.2, c.3, d, e, f, g, and h.
AC Sources Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-5 AMENDMENT NO. 123, 201 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME G. --------NOTE--------
Condition G is not
applicable for Class
1E bus(es) provided
with a two stage time
delay for the degraded
voltage relays and a
fixed time delay for
the loss of voltage
relays.
One or more required offsite circuit(s) do
not meet required
capability. G.1 Restore required capability of the
offsite circuit(s).
OR 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> -------------NOTE------------
Enter LCO 3.8.1 Condition A
or C for required offsite
circuit(s) inoperable.
G.2 Transfer the ESF bus(es) from the
offsite circuit(s) to
the EDG(s).
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> H. Required Action and Associated Completion
Time of Condition A, B, C, D, E, F,
or G not met. H.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> H.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> I. Three or more required AC sources
inoperable. I.1 Enter LCO 3.0.3. Immediately Insert17 I I IGorH INSERT 17 (3.8.1-5)
H. ----- NOTES -----
- 1. Not applicable when the third
or a subsequent
required AC
source intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Three or more required AC sources
H.1 Restore required AC source(s) to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program DC Sources - Operating 3.8.4 PALO VERDE UNITS 1,2,3 3.8.4-1 AMENDMENT NO. 117, 193
3.8 ELECTRICAL
POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on one subsystem
inoperable. A.1 Restore battery terminal voltage to
greater than or equal
to the minimum
established float
voltage. AND A.2 Verify battery float AND A.3 Restore battery charger to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 72 hours B. One DC electrical power subsystem
inoperable for reasons
other than
Condition A. B.1 Restore DC electrical power subsystem to
OPERABLE status 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Insert2Insert2 D D DInsert18.
INSERT 18 (3.8.4-1)
C. ----- NOTES -----
- 1. Not applicable when second DC
electrical power
subsystem
intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two DC electrical power subsystems
C.1 Restore at least one DC electrical power
subsystem to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program Inverters Operating 3.8.7 PALO VERDE UNITS 1,2,3 3.8.7-1 AMENDMENT NO. 117 180 3.8 ELECTRICAL POWER SYSTEMS
3.8.7 Inverters
- Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE.
NOTE----------------------------
One inverter may be disconnected from its associated DC bus
for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on its associated battery, provided: a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and b. All other AC vital instrument buses are energized from their associated OPERABLE inverters.
APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter inoperable.
A.1 ---------NOTE---------
Enter applicable
Conditions and
Required Actions of
LCO 3.8.9, "Distribution
Systems - Operating" with any vital
instrument bus
de-energized.
Restore inverter to OPERABLE status.
7 days (continued)Insert2 Inverters Operating 3.8.7 PALO VERDE UNITS 1,2,3 3.8.7-2 AMENDMENT NO. 117 , 188 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and associated Completion
Time not met. B.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, and alignment to required AC vital
instrument buses.
In accordance with the Surveillance
Frequency
Control Program Insert19 C C C INSERT 19 (3.8.7-2)
B. ----- NOTES -----
- 1. Not applicable when the second
or a subsequent
required inverter intentionally
made inoperable
resulting in
loss of safety
function.
- 2. The following Section 5.5.20
constraints are
applicable when
there is a loss
of function:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two or more required inverters
B.1 Restore all but one inverter to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program Distribution Systems Operating 3.8.9 PALO VERDE UNITS 1,2,3 3.8.9-1 AMENDMENT NO. 117 197
3.8 ELECTRICAL
POWER SYSTEMS
3.8.9 Distribution
Systems - Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE. APPLICABILITY: MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical power distribution
subsystem inoperable. A.1 Restore AC electrical power distribution
subsystem to OPERABLE
status. 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> B. One AC vital instrument bus
electrical power
distribution subsystem
inoperable. B.1 Restore AC vital instrument bus
electrical power
distribution
subsystem to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (continued)Insert2Insert2 Distribution Systems Operating 3.8.9 PALO VERDE UNITS 1,2,3 3.8.9-2 AMENDMENT NO. 188, 197 ACTIONS (continued) CONDITION REQUIRED ACTION COMPLETION TIME C. One DC electrical power distribution
subsystems inoperable. C.1 Restore DC electrical power distribution
subsystem to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> D. Required Action and associated Completion
Time not met. D.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> D.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> E. Two or more inoperable distribution
subsystems that result
in a loss of safety
function. E.1 Enter LCO 3.0.3. Immediately SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and voltage to required AC, DC, and AC vital
instrument bus electrical power
distribution subsystems.
In accordance with the Surveillance
Frequency
Control Program Insert20 E E EInsert2 INSERT 20 (3.8.9-2)
D. ----- NOTES -----
- 1. Not applicable when the second
or a subsequent
electrical power
distribution
subsystem
intentionally
made inoperable
resulting in
loss of safety
function.
- 2. The following Section 5.5.20
constraints are
applicable when
there is a loss
of function:
parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two or more electrical power
distribution
subsystems
D.1 Restore electrical power distribution
subsystem(s) to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) ______________________________________________________________________ (continued) ________________________________________________________________________ PALO VERDE UNITS 1,2,3 5.5-19 AMENDMENT NO. 193, 203 5.5.19 Battery Monitoring and Maintenance Program (continued) 4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following statements in
paragraph (d) may be omitted: "When it has been recorded that the charging current has stabilized at the charging voltage for three consecutive hourly measurements, the battery is near full
charge. These measurements shall be made after the initially
high charging current decreases sharply and the battery voltage
rises to approach the charger output voltage." 5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string." b. The program shall include the following provisions: 1. Actions to restore battery cells with float voltage < 2.13 V; 2. Actions to determine whether the float voltage of the battery cell has been found to be < 2.13 V; 3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates; 4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and 5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer recommendations.
Delete After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued) ______________________________________________________________________ ______________________________________________________________________ PALO VERDE UNITS 1,2,3 5.5-19a AMENDMENT NO. 193, 203 5.5.19 Battery Monitoring and Maintenance Program (continued) 4. In Regulatory Guide 1.129, Regulatory Position 3, Subsection 5.4.1, "State of Charge Indicator," the following
statements in paragraph (d) may be omitted: "When it has been
recorded that the charging current has stabilized at the charging
voltage for three consecutive hourly measurements, the battery is
near full charge. These measurements shall be made after the
initially high charging current decreases sharply and the battery
voltage rises to approach the charger output voltage." 5. In lieu of RG 1.129, Regulatory Position 7, Subsection 7.6, "Restoration," the following may be used: "Following the test, record the float voltage of each cell of the string." b. The program shall include the following provisions: 1. Actions to restore battery cells with float voltage < 2.13 V; 2. Actions to determine whether the float voltage of the remaining bat 13 V when the float voltage of a battery cell has been found to be < 2.13 V; 3. Actions to equalize and test battery cells that had been discovered with electrolyte level below the top of the plates; 4. Limits on average electrolyte temperature, battery connection resistance, and battery terminal voltage; and 5. A requirement to obtain specific gravity readings of all cells at each discharge test, consistent with manufacturer
recommendations. 5.5.20 Not UsedInsert21 INSERT 21 (5.5-20) 5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in
accordance with NEI 06-09 (Revision 0) - A, "Risk-Managed
Technical Specifications (RMTS) Guidelines." The program
shall include the following:
- a. The RICT may not exceed 30 days;
- b. A RICT may only be utilized in MODE 1 and 2.
- c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk
Management Program must be considered for the effect
on the RICT.
- 1. For planned changes, the revised RICT must be determined prior to implementation of the change in
configuration.
- 2. For emergent conditions, the revised RICT must be determined within the time limits of the Required
Action Completion Time (i.e., not the RICT) or 12
hours after the plant configuration change, whichever is less.
- 3. Revising the RICT is not required if the plant configuration change would lower plant risk and
would result in a longer RICT.
- d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a
specified safety function or inoperability of all
required trains of a system required to be OPERABLE.
- e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function
or inoperability of all required trains of a system
required to be OPERABLE if one or more of the trains
are considered "PRA functional" as defined in Section
2.3.1 of NEI 06-09 (Revision 0) - A. The RICT for
these loss of function conditions may not exceed 24
hours.
INSERT 21 continued
- f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function
or inoperability of all required trains of a system
required to be OPERABLE if one or more trains are
considered "PRA Functional" as defined in Section
2.3.1 of NEI 06-09 (Revision 0) - A. However, the
following additional constraints shall be applied to
the criteria for "PRA Functional." 1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to
perform the specified Technical Specifications safety
function.
- 2. Design basis success criteria parameters shall be met for all design basis accident scenarios for
establishing PRA Functionality, during a Technical
Specifications loss of function condition, where a
RICT is applied.
- g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be
addressed.
If there is a high degree of confidence, based on the evidence collected, that there is no CC failure
mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor
probability.
If a high degree of confidence cannot be established that there is no CC failure that could affect the
redundant components, the RICT shall account for the
increased possibility of CC failure. Accounting for
the increased possibility of CC failure shall be
accomplished by one of two methods. If one of the two
methods listed below is not used, the Technical
Specifications front stop shall not be exceeded.
- 1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section
A-1.3.2.1 of Appendix A of the RG. Specifically, when
a component fails, the CC failure probability for the
remaining redundant components shall be increased to
represent the conditional failure probability due to
CC failure of these components, in order to account
for the possibility the first failure was caused by a
CC mechanism.
OR INSERT 21 continued
implemented. These RMAs shall target the success of
the redundant and/or diverse structures, systems, or
components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call
upon the function(s) performed by the failed SSC.
Documentation of RMAs shall be available for NRC
review. h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss
of Function if a PRA Functionality determination that
reflects the plant configuration concludes that the
LCO cannot be restored without placing the TS
inoperable trains in an alignment which results in a
loss of functional level PRA success criteria.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 2 Revised Technical Specification Pages (Clean copy) 1.3-13 3.7.5-5 1.3-14 1.3-15 3.3.6-1 3.3.6-2 3.4.10-1 3.7.7-1 3.7.7-2 3.7.8-1 3.7.8-2 3.7.10-13.4.10-2 3.7.10-2 3.4.12-1 3.8.1-1 3.4.12-2 3.8.1-2 3.5.1-1 3.8.1-3 3.5.1-2 3.8.1-4 3.5.3-1 3.8.1-5 3.5.5-1 3.8.1-6 3.6.2-3 3.8.1-7 3.6.3-1 3.8.1-8 3.6.3-2 3.8.1-9 3.6.3-3 3.8.1-103.6.3-4 3.8.1-113.6.3-5 3.8.1-123.6.3-6 3.8.1-133.6.3-7 3.8.1-143.6.6-1 3.8.1-153.7.2-2 3.8.1-163.7.2-3 3.8.1-173.7.3-1 3.8.1-18 3.7.3-2 3.8.4-1 3.7.4-1 3.8.4-2 3.7.4-2 3.8.4-3 3.7.5-1 3.8.4-4 3.7.5-2 3.8.7-1 3.7.5-3 3.8.7-2 3.7.5-4 3.8.9-1 3.8.9-2 3.8.9-3 5.5-20 5.5-21 5.5-22 Completion Times 1.3 1.3 Completion Times
________________________________
________________________________
______________
PALO VERDE UNITS 1,2
,3 1.3-13 AMENDMENT NO.
117 EXAMPLES EXAMPLE 1.3
-7 (continued
) The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A
was initially entered. If Required Action A.1 is met after
Condition B is entered, Condition B is exited and operation may
continue in accordance with Condition A, provided the
Completion Time for Required Action A.2 has not expired.
EXAMPLES EXAMPLE 1.3
-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One subsystem
A.1 Restore subsystem to
OPERABLE status. 7 days OR In accordance with the Risk Informed
Completion Time
Program B. --------NOTES------- 1. Not applicable when second
subsystem
intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Two subsystems
B.1 Restore at least one
subsystem to OPERABLE
status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed
Completion Time
Program Completion Times 1.3 1.3 Completion Times
________________________________
________________________________
______________
PALO VERDE UNITS 1,2
,3 1.3-14 AMENDMENT NO.
EXAMPLES EXAMPLE 1.3
-8 (continued)
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion Time not met.
C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be appli ed as discussed in Example 1.3
-2. However, the
licensee may elect to apply the Risk Informed Completion Time Program which
permits calculation of a Risk Informed Completion Time (RICT) that may be
used to complete the Required Action beyond the 7 day Completion Time.
The RICT cannot exc eed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or
Condition C must also be entered.
If a second subsystem is declared inoperable, Condition B may also be entered. The Condition i s modified by two Notes. The first note states it is
not applicable if the second subsystem is intentionally made inoperable. The
second Note provides restrictions applicable to these "loss of function" Conditions. The Required Actions of Condition B are n ot intended for
voluntary removal of redundant subsystems from service. The Required Action
is only applicable if one subsystem is inoperable for any reason and the
second subsystem is found to be inoperable, or if both subsystems are found
to be inoperabl e at the same time. If Condition B is applicable, at least one
subsystem must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or Condition C
must also be entered. The licensee may be able to apply a RICT or to extend
the Completion Time beyond 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, but not longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, if the
requirements of the Risk Informed Completion Time Program are met. If two
subsystems are inoperable and Condition B is not applicable (i.e., the second
subsystem was intentionally made inoperable), LCO 3.0.3 is entered as ther e
is no applicable Condition.
The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
For emergent conditions, the revised RICT must be determined within the time
limits of the Required Action Completion Time (i.e., not the RICT) or
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less.
Completion Times 1.3 1.3 Completion Times
________________________________
________________________________
______________
PALO VERDE UNITS 1,2
,3 1.3-15 AMENDMENT NO.
EXAMPLES EXAMPLE 1.3
-8 (continued)
I f the 7 day Completion Time clock of Condition A or the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time clock of Condition B have expired and subsequent changes in plant
conditions result in exiting the applicability of the Risk Informed
Completion Time Program without restoring t he inoperable subsystem to
OPERABLE status, Condition C is also entered and the Completion Time clocks
for Required Actions C.1 and C.2 start.
If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the i noperable subsystem has not been restored
to OPERABLE status, Condition C is also entered and the Completion Time
clocks for Required Actions C.1 and C.2 start. If the inoperable subsystems
are restored to OPERABLE status after Condition C is entered, Cond itions A, B, and C are exited, and therefore, the Required Actions of Condition C may
be terminated.
________________________________
________________________________
______________
IMMEDIATE When "Immediately" is used as a Completion Time, the COMPLETION TIME Required Action should be pursued without delay and in a
controlled manner.
ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2
,3 3.3.6-1 AMENDMENT NO.
117 3.3 INSTRUMENTATION
3.3.6 Engineered
Safety Features Actuation System (ESFAS) Logic and Manual Trip LCO 3.3.6 Six channels of ESFAS Matrix Logic, four channels of ESFAS Initiation Logic, two channels of Actuation Logic, and four channels of Manual Trip shall be OPERABLE for each Function in Table 3.3.6-1. APPLICABILITY:
According to Table 3.3.6
-1. ACTIONS ------------------------------------------------------NOTE-----------------------------------------------------
Separate Condition entry is allowed for each Function.
CONDITION REQUIRED ACTION COMPLETION TIME A. One or more Functions with one Matrix Logic channel inoperable.
OR Three Matrix Logic channels are inoperable due to a common power source failure de
-
energizing three matrix power supplies.
A.1 Restore channel to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> B. One or more Functions with one Manual Trip or Initiation Logic channel inoperable.
B.1 Restore channel to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program (continued)
ESFAS Logic and Manual Trip 3.3.6 PALO VERDE UNITS 1,2
,3 3.3.6-2 AMENDMENT NO.
117 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME C. One or more Functions with two Initiation Logic channels or Manual Trip channels affecting the same trip leg inoperable.
C.1 Open at least one contact in the affected trip leg of both ESFAS Actuation Logics.
AND Immediately C.2 Restore channels to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> D. One or more Functions with one Actuation Logic channel inoperable.
D.1 -------------NOTE---------- One channel of Actuation Logic may be bypassed for up to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for Surveillances, provided the other channel is OPERABLE.
Restore channel to OPERABLE status.
48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> OR In accordance with the Risk Informed Completion Time Program E. Required Action and associated Completion Time of Conditions for Containment Spray Actuation Signal, Main Steam Isolation Signal or Auxiliary Feedwater Actuation Signal not met. E.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> E.2 Be in MODE 4.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (continued)
Pressurizer Safety Valves
-MODES 1, 2, and 3 3.4.10 PALO VERDE UNITS 1,2
,3 3.4.10-1 AMENDMENT NO.
117 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves
- Modes 1, 2 and 3 LCO 3.4.10 Four pressurizer safety valves shall be OPERABLE with lift settings ~ 2450.25 psia and 2549.25 psia.
APPLICABILITY:
MODES 1, 2, and 3, -----------------------------
NOTE----------------------------
The lift settings are not required to be within LCO limits
during MODES 3 and 4 for the purpose of setting the
pressurizer safety valves under ambient (hot) conditions.
This exception is allow ed for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following entry into
MODE 3 provided a preliminary cold setting was made prior to
heatup.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE S--------- 1. Not applicable when pressurizer safety
valve intentionally
made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable: parts b, c.2, c.3, d, e, f, g, and h. -------------------
--- One pressurizer safety valve inoperable.
A.1 Restore valve to OPERABLE status.
15 minutes OR In accordance with the Risk
Informed Completion Time
Program Pressurizer Safety Valves
-MODES 1, 2, and 3 3.4.10 PALO VERDE UNITS 1,2
,3 3.4.10-2 AMENDMENT NO.
117 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. Required Action and associated Completion
Time not met.
OR Two or more pressurizer safety
valves inoperable.
B.1 Be in MODE 3
. AND B.2 Be in MODE 4. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is OPERABLE in accordance with the Inservice
Testing Program. Following testing, lift
settings shall be within +/- 1%.
In accordance
with the Inservice
Testing Program
Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2
,3 3.4.12-1 AMENDMENT NO.
188 , 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.12 Pressurizer Vents LCO 3.4.12 Four pressurizer vent paths shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, and 3.
MODE 4 with RCS pressure
~ 385 psia. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Two or three required pressurizer vent paths inoperable.
A.1 Restore required pressurizer vent
paths to OPERABLE status. 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. --------NOTE S--------- 1. Not applicable when last pressurizer
vent path
intentionally made inoperable.
- 2. The following Section 5.5.20
constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------
- All pressurizer vent paths inoperable.
B.1 Restore one pressurizer vent path to OPERABLE status.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> OR In accordance with the Risk Informed Completion Time Program Pressurizer Vents 3.4.12 PALO VERDE UNITS 1,2
,3 3.4.12-2 AMENDMENT NO.
188 , ACTIONS (CONTINUED)
CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion
Time of Condition A, or B not met.
C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 4 with RCS
pressure < 385 psia.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.12.1 Perform a complete cycle of each
Pressurizer Vent Valve.
In accordance
with the Surveillance
Frequency
Control Program SR 3.4.12.2 Verify flow through each
pressurizer vent path.
In accordance
with the Surveillance
Frequency
Control Program
SITs-Operating 3.5.1 PALO VERDE UNITS 1,2
,3 3.5.1-1 AMENDMENT NO.
118 , 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
3.5.1 Safety
Injection Tanks (SITs)
- Operating LCO 3.5.1 Four SITs shall be OPERABLE.
APPLICABILITY:
MODES 1 and 2, MODES 3 and 4 with pressurizer pressure
~ 1837 psia.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One SIT inoperable due to boron concentration not within limits.
OR One SIT inoperable due to inability to verify level or pressure.
A.1 Restore SIT to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> B. One SIT inoperable for reasons other than
Condition A.
B.1 Restore SIT to OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> C. --------NOTE S-------- 1. Not applicable when the second or a subsequent SIT intentionally made
- 2. The following Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Two or more SITs inoperable for reasons
other than Condition A. C.1 Restore all but one SIT to OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program SITs-Operating 3.5.1 PALO VERDE UNITS 1,2
,3 3.5.1-2 AMENDMENT NO.
188 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME D. Required Action and associated Completion Time of Condition A , B , or C not met. D.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> D.2 Reduce pressurizer pressure to
< 1837 psia.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.5.1.1 Verify each SIT isolation valve is fully open. In accordance
with the Surveillance
Frequency
Control Program SR 3.5.1.2 Verify borated water volume in each SIT is
~ 28% narrow range and 72% narrow range.
In accordance with the Surveillance
Frequency
Control Program SR 3.5.1.3 Verify nitrogen cover pressure in each SIT is ~ 600 psig and 625 psig. In accordance with the Surveillance
Frequency
Control Program (continued)
ECCS - Operating 3.5.3 PALO VERDE UNITS 1,2
,3 3.5.3-1 AMENDMENT NO.
124 , 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.3 ECCS
- Operating LCO 3.5.3 Two ECCS trains shall be OPERABLE.
APPLICABILITY:
MODES 1 and 2, MODE 3 with pressurizer pressure
~ 1837 psia or with RCS T c ~ 485°F. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One LPSI subsystem inoperable.
A.1 Restore subsystem to
OPERABLE status.
7 days OR In accordance with the Risk
Informed Completion Time
Program B. One or more trains
inoperable for reasons
other than Condition A.
AND At least 100% of the ECCS flow equivalent to
train available.
B.1 Restore train(s) to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program C. Required Action and
associated Completion
Time not met.
C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Reduce pressurizer
pressure to
< 1837 psia.
AND 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> C.3 Reduce RCS T c to < 485°F. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> RWT 3.5.5 PALO VERDE UNITS 1,2
,3 3.5.5-1 AMENDMENT NO.
117 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)
3.5.5 Refueling
Water Tank (RWT)
LCO 3.5.5 The RWT shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. RWT boron concentration not
within limits.
OR RWT borated water temperature not within
limits. A.1 Restore RWT to
OPERABLE status.
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> B. --------NOTE S--------- 1. Not applicable when RWT is
intentionally made inoperable.
- 2. The following Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
RWT inoperable for
reasons other than
Condition A.
B.1 Restore RWT to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program C. Required Action and
associated Completion
Time not met.
C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours Containment Air Locks 3.6.2 PALO VERDE UNITS 1,2
,3 3.6.2-3 AMENDMENT NO.
117 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)
B.1 Verify an OPERABLE door is closed in the
affected air lock.
AND 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> B.2 Lock an OPERABLE door closed in the
affected air lock.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> B.3 --------NOTE--------- Air lock doors in
may be verified
locked closed by
administrative means.
Verify an OPERABLE door is locked closed
in the affected air
lock. Once per 31 days C. One or more
containment air locks inoperable for reasons other than Condition A or B. C.1 Initiate action to
evaluate overall
containment leakage
rate per LCO 3.6.1.
AN D Immediately C.2 Verify a door is closed in the
affected air lock.
AND 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> C.3 Restore air lock to OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance
with the Risk
Informed Completion Time
Program (continued)
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-1 AMENDMENT NO.
166 , 3.6 CONTAINMENT SYSTEMS
3.6.3 Containment
Isolation Valves LCO 3.6.3 Each required containment isolation valve shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS -------------------------------------
NOTES-----------------------------------
- 1. Penetration flow paths except for 42 inch purge valve penetration flow paths may be unisolated intermittently under administrative controls.
- 2. Separate Condition entry is allowed for each penetration flow path.
- 3. Enter applicable Conditions and Requi red Actions for system(s) made
inoperable by containment isolation valves.
- 4. Enter applicable Conditions and Required Actions of LCO 3.6.1, "Containment," when leakage results in exceeding the overall containment leakage rate acceptance criteria.
- 5. A 42 inch refueling purge valve is not a required containment isolation valve when its flow path is isolated with a blind flange tested in
accordance with SR 3.6.1.1.
CONDITION REQUIRED ACTION COMPLETION TIME A. ---------NOTE---------
Only applicable to
penetration flow paths
with two required containment isolation
valves.
One or more penetration flow paths
with one required containment isolation
valve inoperable
except for purge valve
leakage not within limit. A.1 Isolate the affected
penetration flow path
by use of at least
one closed and
de-activated
automatic valve, closed manual valve, blind flange, or
check valve with flow
through the valve
sec ured. AND 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> OR In accordance with the Risk
Informed Completion Time
Program (continued)
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2,3 3.6.3-2 AMENDMENT NO.
166 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)
A.2 --------NOTE--------- Isolation devices in high radiation areas
may be verified by use
of administrative
means. ---------------------
Verify the affected penetration flow path
is isolated.
Once per 31 days following
isolation for isolation
devices outside
containment AND Prior to entering MODE 4
from MODE 5 if
not performed
within the
previous 92 days
for isolation
devices inside
containment B. --------NOTE S--------
- 1. Only applicable to
penetration flow
paths with two
required containment isolation valves.
- 2. RICT is not
applicable when the
second containment
isolation valve is
intentionally made
. 3. The following
Section 5.5.20
constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------
B.1 Isolate the affected
penetration flow path
by use of at least one
closed and de
-activated
automatic valve, closed
manual valve, or blind
flange. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program (continued)
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-3 AMENDMENT NO.
166 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)
One or more penetration flow paths
containment isolation
valves inoperable
except for purge valve
leakage not within
limit. C. ---------NOTE--------- Only applicable to penetration flow paths
with only one required containment isolation
valve and a closed
system.
One or more penetration flow paths
with one required containment isolation
valve inoperable.
C.1 Isolate the affected
penetration flow path
by use of at least one
closed and
de-activated automatic
valve, closed manual
valve, or blind flange.
AND C.2 --------NOTE--------- Isolation devices in
may be verified by use
of administrative
means. ---------------------
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> OR In accordance with the Risk
Informed Completion Time
Program Verify the affected penetration flow path
is isolated.
Once per 31 days following
isolation Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-4 AMENDMENT NO.
117 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME D. ---------NOTE S--------- 1. RICT is not applicable when the
second containment
purge valve is
intentionally made
. 2. The following
Section 5.5.20
constraints are
applicable when there is a loss of
function: parts b, c.2, c.3, d, e, f, g, and h. ----------------------
- One or more penetration flow paths with one or more
required containment
purge valves not
within purge valve
leakage limits.
D.1 Isolate the affected
penetration flow path
by use of at least
one closed and
de-activated
automatic valve with
resilient seals, or
blind flange.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk
Informed Completion Time
Program (continued)
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-5 AMENDMENT NO.
188 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME D. (continued)
D.2 --------NOTE--------- Isolation devices in
may be verified by
use of administrative
means.
Verify the affected penetration flow path
is isolated.
Once per 31 days following
isolation for isolation
devices outside
containment AND Prior to entering MODE 4 from MODE 5 if
not performed
within the
previous 92 days
for isolation
devices inside containment AND D.3 Perform SR 3.6.3.6 for the resilient
seal purge valves
closed to comply with
Required Action D.1.
Once per 92 days following
isolation E. Required Action and
associated Completion
Time not met.
E.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> E.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-6 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.3.1 Verify each required 42 inch purge valve is sealed closed except for one purge valve in a penetration flow path while in
Condition D of this LCO.
In accordance
with the Surveillance
Frequency
Control Program SR 3.6.3.2 Verify each 8 inch purge valve is closed
except when the 8 inch purge valves are
open for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances that require the
valves to be open.
In accordance
with the Surveilla nce Frequency
Control Program SR 3.6.3.3
NOTE--------------------
Valves and blind flanges in high radiation
areas may be verified by use of
administrative means.
Verify each containment isolation manual valve and blind flange that is located
outside containment and not locked, sealed
or otherwise secured and is required to be
closed during accident conditions is
closed, except for containment isolation
valves that are open under administr ative controls. In accordance with the Surveillance
Frequency
Control Program (continued)
Containment Isolation Valves 3.6.3 PALO VERDE UNITS 1,2
,3 3.6.3-7 AMENDMENT NO.
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.6.3.4 -------------------
NOTE--------------------
Valves and blind flanges in high radiation
areas may be verified by use of
administrative means.
Verify each containment isolation manual valve and blind flange that is located
inside containment and not locked, sealed
or otherwise secured and required to be
closed during accident conditions is
closed, except for containment isolation
valves that are open under administrative
controls. Prior to entering MOD E 4 from MODE 5
if not performed
within the previous
92 days SR 3.6.3.5 Verify the isolation time of each required automatic power operated containment
isolation valve is within limits.
In accordance
with the Inservice
Testing Program SR 3.6.3.6 Perform leakage rate testing for required containment purge valves with resilient
seals. In accordance with
the Surveillance
Frequency Control
Program AND Within 92 days after opening the valve SR 3.6.3.7 Verify each required automatic containment isolation valve that is not locked, sealed, or otherwise secured in position, actuates
to the isolation position on an actual or
simulated actuation signal.
In accordance with
the Surveillance
Frequency Control
Program Containment Spray System 3.6.6 PALO VERDE UNITS 1,2
,3 3.6.6-1 AMENDMENT NO.
117 3.6 CONTAINMENT SYSTEMS
3.6.6 Containment
Spray System LCO 3.6.6 Two containment spray trains shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, and 3.
MODE 4 when RCS pressure is
~ 385 psia ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One containment spray train inoperable.
A.1 Restore containment
spray train to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. Required Action and
associated Completion
Time of Condition A
not met. B.1 Be in MODE 3. AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> B.2 Be in MODE 4 with RCS pressure < 385 psia.
84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> C. Two containment spray
trains inoperable.
C.1 Enter LCO 3.0.3.
Immediately
MSIVs 3.7.2 PALO VERDE UNITS 1,2
,3 3.7.2-2 AMENDMENT NO.
163 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME E. Three or more MSIV
actuator trains
OR Required Action and
associated Completion
Time of Condition A, B, or C not met. E.1 Declare each affected
Immediately F. One MSIV inoperable in
MODE 1. F.1 Restore MSIV to OPERABLE status.
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> OR In accordance with the Risk
Informed Completion Time Program G. --------NOTE S--------- 1. Not applicable when the second or a
subsequent MSIV
intentionally made
- 2. The following
Section 5.5.20
constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ----------------------
Two or more MSIVs inoperable in MODE 1.
G.1 Restore all but one MSIV to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time Program H. Required Action and Associated Completion
Time of Condition F or G not met. H.1 Be in MODE 2.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> MSIVs 3.7.2 PALO VERDE UNITS 1,2
,3 3.7.2-3 AMENDMENT NO.
181 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME I. ---------NOTE---------
Separate Condition
entry is allowed for
each MSIV.
One or more MSIVs inoperable in MODE 2, 3, or 4. I.1 Close MSIV.
AND I.2 Verify MSIV is
closed. 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Once per 7 days J. Required Action and associated Completion
Time of Condition I
not met. J.1 Be in MODE 3.
AND J.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1
NOTE--------------------
Not required to be performed prior to entry into MODE 3.
Verify closure time of each MSIV is within limits with each actuator train on
an actual or simulated actuation signal.
In accordance with the Inservice
Testing Program
MFIVs 3.7.3 PALO VERDE UNITS 1,2
,3 3.7.3-1 AMENDMENT NO.
158 3.7 PLANT SYSTEMS 3.7.3 Main Feedwater Isolation Valves (MFIVs)
LCO 3.7.3 Four economizer MFIVs and four downcomer MFIVs shall be OPERABLE. APPLICABILITY:
MODES 1, 2, 3, and 4 except when MFIV is closed and deactivated or isolated by a closed and deactivated power
operated valve.
ACTIONS -------------------------------------
NOTE------------------------------------
Separate Condition entry is allowed for each penetration flow path.
CONDITION REQUIRED ACTION COMPLETION TIME A. One or more MFIVs inoperable.
A.1 Restore MFIV(s) to
OPERABLE status.
OR A.2.1 Close or isolate inoperable MFIV(s).
AND A.2.2 Verify inoperable MFIV(s) is closed or
isolated. 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time
Program 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Once per 7 days following Isolation MFIVs 3.7.3 PALO VERDE UNITS 1
,2,3 3.7.3-2 AMENDMENT NO. 181 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES----------
- 1. RICT is not
applicable when the
second valve in the
affect ed flow path
is intentionally
made inoperable
. 2. The following
Section 5.5.20 constraints are
applicable: parts b, c.2, c.3, d, e, f, g, and h. -----------------------
Two valves in the same flow path inoperable.
B.1 Restore one valve to OPERABLE status.
OR B.2.1 Isolate affected flow path. AND B.2.2 Verify inoperable
MFIV(s) is closed or
isolated. 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> OR In accordance with the Risk Informed Completion Time
Program 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Once per 7 days following Isolation.
C. Required Action and
associated Completion
Time not met.
C.1 Be in MODE 3.
AND C.2 Be in MODE 5.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.3.1 Verify the closure time of each MFIV is within limits on an actual or simulated
actuation signal.
In accordance
with the Inservice
Testing Program
ADVs 3.7.4 PALO VERDE UNITS 1,2
,3 3.7.4-1 AMENDMENT NO.
191 , (CORRECTED PAGE
) 3.7 PLANT SYSTEMS
3.7.4 Atmospheric
Dump Valves (ADVs)
LCO 3.7.4 Four ADV line s shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, and 3, MODE 4 when steam generator is being relied upon for heat removal. ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. --------NOTE--------
Separate Condition
entry is allowed for
each SG. --------------------
One required ADV line
in operable. A.1 Restore ADV line to
OPERABLE status.
7 days OR In accordance with the Risk
Informed Completion Time
Program B. --------NOTE S--------- 1. Not applicable when the last ADV intentionally made inoperable resulting in loss of safety
function. 2. The following Section 5.5.20
constraints are
applicable when there is a loss of
function: parts b, c.2, c.3, d, e, f, g, and h. -------------------
Two or more ADV lines
inoperable with both
ADV lines inoperable
on one or more SGs
. B.1 Restore one ADV line
to OPERABLE status on each SG. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk
Informed Completion Time
Program ADVs 3.7.4 PALO VERDE UNITS 1,2
,3 3.7.4-2 AMENDMENT NO.
188 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion
Time not met.
C.1 Be in MODE 3.
AND C.2 Be in MODE 4 without
reliance on steam
generator for heat
removal. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.4.1 Verify one complete cycle of each ADV.
In accordance with the Surveillance
Frequency
Control Program
AFW System 3.7.5 PALO VERDE UN ITS 1,2,3 3.7.5-1 AMENDMENT NO.
197 , 3.7 PLANT SYSTEMS
3.7.5 Auxiliary
Feedwater (AFW) System LCO 3.7.5 Three AFW trains shall be OPERABLE.
NOTE----------------------------
Only one AFW train, which includes a motor driven pump, is required to be OPERABLE in MODE 4.
APPLICABILITY:
MODES 1, 2, and 3, MODE 4 when steam generator is relied upon for heat removal.
ACTIONS
NOTE----------------------------
LCO 3.0.4.b is not applicable.
CONDITION REQUIRED ACTION COMPLETION TIME A. One steam supply to
turbine driven AFW
pump inoperable.
OR ---------NOTE--------- Only applicable if MODE 2 has not been entered following
refueling.
One turbine driven AFW pump inoperable in MODE 3 following
refueling.
A.1 Restore affected
equipment to OPERABLE status. 7 days OR In accordance with the Risk
Informed Completion Time
Program B. One AFW train
inoperable for reasons
other than Condition A
in MODE 1, 2, or 3.
B.1 Restore AFW train to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk Informed Completion Time
Program (continued)
AFW System 3.7.5 PALO VERDE UNITS 1,2
,3 3.7.5-2 AMENDMENT NO.
117 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME C. -------NOTES-------- 1. Not applicable when second AFW train intentionally made
inoperable resulting in loss of safety
function. 2. The following Section 5.5.20
constraints are
applicable when there is a loss of
function: parts b, c.2, c.3, d, e, f, g, and h. --------------
Two AFW trains
inoperable in MODE 1, 2, or 3. C.1 Restore at least one AFW
train to OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program D. Required Action and
associated Completion
Time of Condition A , B or C not met. D.1 Be in MODE 3.
AND D.2 Be in MODE 4.
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours AFW System 3.7.5 PALO VERDE UNITS 1,2
,3 3.7.5-3 AMENDMENT NO.
1 88 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME E. Three AFW trains inoperable in MODE 1, 2, or 3. E.1 --------NOTE--------- LCO 3.0.3 and all other LCO Required Actions
requiring MODE changes
are suspended until one
AFW train is restored
to OPERABLE status.
Initiate action to
restore one AFW train to OPERABLE status.
Immediately F. Required AFW train inoperable in MODE 4.
F.1 --------NOTE--------- LCO 3.0.3 and all other
LCO Required Actions
requiring MODE changes
are suspended until one AFW train is restored
to OPERABLE status.
Initiate action to restore one AFW train to
OPERABLE status.
Immediately
AFW System 3.7.5 PALO VERDE UNITS 1,2
,3 3.7.5-4 AMENDMENT NO.
1 88 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.5.1 Verify each AFW manual, power operated, and automatic valve in each water flow path and
in both steam supply flow paths to the
steam turbine driven pump, that is not
locked, sealed, or otherwise secured in
position, is in the correct position.
In accordance
with the Surveillance
Frequency
Control Program SR 3.7.5.2
NOTE--------------------
Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after reaching 532°F in the RCS
. -------------------------------------------
Verify the developed head of each AFW pump
at the flow test point is greater than or
equal to the required developed head.
In accordance
with the Inservice Test
Program SR 3.7.5.3
NOTES-------------------
- 1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />
after reaching 532°F in the RCS.
- 2. Not applicable in MODE 4 when steam
generator is relied upon for heat
removal. -------------------------------------------
Verify each AFW automatic valve that is not
locked, sealed, or otherwise secured in
position, actuates to the correct position
on an actual or simulated actuation signal.
In accordance
with the Surveillance
Fre quency Control Program (continued)
AFW System 3.7.5 PALO VERDE UNITS 1,2
,3 3.7.5-5 AMENDMENT NO.
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.7.5.4
NOTES-------------------
- 1. Not required to be performed for the turbine driven AFW pump until 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after reaching 532°F in the RCS.
- 2. Not applicable in MODE 4 when steam
generator is relied upon for heat
removal. -------------------------------------------
Verify each AFW pump starts automatically
on an actual or simulated actuation signal.
In accordance with the Surveillance
Frequency
Control Program SR 3.7.5.5 Verify the proper alignment of the required
AFW flow paths by verifying flow from the
condensate storage tank to each stea m
generator.
Prior to entering MODE 2
whenever unit
has been in
MODE 5 or 6 for
> 30 days EW System 3.7.7 PALO VERDE UNITS 1,2
,3 3.7.7-1 AMENDMENT NO.
117 3.7 PLANT SYSTEMS
3.7.7 Essential
Cooling Water (EW) System LCO 3.7.7 Two EW trains shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EW train inoperable.
A.1 --------NOTE--------- Enter applicable Conditions and Required
Actions of LCO 3.4.6, "RCS Loops
- MODE 4" for shutdown cooling
made inoperable by EW.
Restore EW train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. --------NOTES-------- 1. Not applicable when second EW train intentionally made
- 2. The following Section 5.5.20
constraints are
applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------
Two EW trains
B.1 Restore at least one EW
train to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance
with the Risk Informed Completion Time
Program EW System 3.7.7 PALO VERDE UNITS 1,2
,3 3.7.7-2 AMENDMENT NO.
188 , ACTION (continued)
CONDITION REQUIRED ACTION COMPLETION TIME C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.7.1
NOTE--------------------
Isolation of EW flow to individual
components does not render the EW System
Verify each EW manual, power operated, and automatic valve in the flow path servicing
safety related equipment, that is not
locked, sealed, or otherwise secured in
position, is in the correct position.
In accordance with the Surveillance
Frequency
Control Program SR 3.7.7.2 Verify each EW automatic valve in the flow
path that is not locked, sealed, or
otherwise secured in position, actuates to
the correct position on an actual or
simulated actuation signal.
In accordance
with the Surveillance
Frequency Control Program SR 3.7.7.3 Verify ea ch EW pump starts automatically on an actual or simulated actuation signal.
In accordance with the Surveillance
Frequency
Control Program
ESPS 3.7.8 PALO VERDE UNITS 1,2
,3 3.7.8-1 AMENDMENT NO.
117 3.7 PLANT SYSTEMS
3.7.8 Essential
Spray Pond System (ESPS)
LCO 3.7.8 Two ESPS trains shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train inoperable.
A.1 --------Notes-------- 1. Enter applicable
Conditions and
Required Actions of
Sources ~ Operating," for
emergency diesel
generator made
inoperable by ESPS.
- 2. Enter applicable
Conditions and
Required Actions of
Loops ~ MODE 4," for
made inoperable by
ESPS. ---------------------
Restore ESPS train to OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance
with the Risk
Informed Completion Time
Program ESPS 3.7.8 PALO VERDE UNITS 1,2
,3 3.7.8-2 AMENDMENT NO.
188 , ACTION (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. ---------NOTES--------- 1. Not applicable when second ESPS train
intentionally made
- 2. The following Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Two ESPS trains
B.1 Restore at least one
ESPS train to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program C. Required Action and associated Completion
Time not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.8.1
Notes-------------------
Isolation of ESPS flow to individual
components does not render ESPS inoperable.
Verify each ESPS manual and power operated valve in the flow path servicing safety
related equipment, that is not locked, sealed, or otherwise secured in position, is in the correct position.
In accordance with the Surveillance
Frequency
Control Program SR 3.7.8.2 Verify each ESPS pump starts automatically
on an actual or simulated actuation signal.
In accordance
with the Surveillance
Frequency
Control Program
EC 3.7.10 PALO VERDE UNITS 1,2
,3 3.7.10-1 AMENDMENT NO.
188 3.7 PLANT SYSTEMS 3.7.10 Essential Chilled Water (EC) System LCO 3.7.10 Two EC trains shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One EC train inoperable.
A.1 Restore EC train to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. --------NOTES--------- 1. Not applicable when second EC train intentionally made
- 2. The following Section 5.5.20
constraints are applicable: parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two EC trains
B.1 Restore at least one EC
train to OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program C. Required Action and
associated Completion
Time not met. C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> EC 3.7.10 PALO VERDE UNITS 1,2
,3 3.7.10-2 AMENDMENT NO.
SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.10.1 Verify each EC System manual, power operated, and automatic valve in the flow
path, that is not locked, sealed, or
otherwise secured in position, is in the
correct position.
In accordance
with the Surveillance
Frequency
Control Program SR 3.7.10.2 Verify the proper actuation of each EC
System component on an actual or simulated
actuation signal.
In accordance
with the Surveillance
Frequency
Control Program
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-2 AMENDMENT NO.
197 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued)
A.3 Restore required offsite circuit to
OPERABLE status.
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. One DG inoperable.
B.1 Perform SR 3.8.1.1
for the OPERABLE
required offsite
circuit(s).
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> AND Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter AND B.2 Declare required
feature(s)
supported by the
inoperable when
its redundant
required feature(s) is
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from
discovery of
Condition B
concurrent with
inoperability of
redundant
required feature(s)
AND B.3.1 Determine OPERABLE DG is not
inoperable due to
common cause
failure. OR 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> B.3.2 Perform SR 3.8.1.2
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> AND (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO.
200 , ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)
B.4 Restore DG to OPERABLE status. 10 days OR In accordance with the Risk Informed
Completion Time
Program C. Two required offsite
circuits inoperable.
C.1 Declare required
feature(s)
inoperable when
its redundant
required feature(s) is
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from
discovery of
Condition C
concurrent with
inoperability of
redundant required
feature(s)
AND C.2 Restore one
required offsite
circuit to
OPERABLE status.
24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk Informed
Completion Time
Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-4 AMENDMENT NO.
117 ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME D. One required offsite circuit inoperable.
AND One DG inoperable.
NOTE-----------
Enter applicable Conditions and Required Actions of
LCO 3.8.9, "Distribution
Systems ~ Operating," when Condition D is entered with no AC power source to a
train.
D.1 Restore required offsite circuits to OPERABLE status.
OR 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR In accordance with the Risk Informed
Completion Time
Program D.2 Restore DG
to OPERABLE status.
12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR In accordance with the Risk Informed
Completion Time
Program ----------NOTE S--------- 1. Not applicable when
second DG
intentionally made inoperable.
- 2. The following
Section 5.5.20
constraints are
applicable: parts b, c.2, c.3, d, e, f, g, and h. ---------------------
--- E. Two DGs inoperable.
E.1 Restore one DG to
OPERABLE status.
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk Informed
Completion Time
Program AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-5 AMENDMENT NO.
201 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME F. One automatic load sequencer inoperable.
F.1 Restore automatic
load sequencer to
OPERABLE status.
AND 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> OR In accordance with the Risk Informed
Completion Time
Program F.2 Declare required
feature(s) supported by the inoperable sequencer inoperable
when its redundant
required feature(s)
is inoperable.
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from
discovery of Condition F concurrent with
inoperability of
r edundant required
feature(s)
G. --------NOTE--------
Condition G is not
applicable for Class
1E bus(es) provided
with a two stage time delay for the degraded voltage relays and a
fixed time delay for
the loss of voltage
relays.
One or more required offsite circuit(s) do
not meet required
capability.
G.1 Restore required
capability of the
offsite circuit(s).
OR 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> ----------
--NOTE-----------
Enter LCO 3.8.1 Condition A or C for required offsite
circuit(s) inoperable.
G.2 Transfer the ESF
bus(es) from the
to the EDG(s).
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-6 AMENDMENT NO.
188 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME H.---------NOTES-------- 1. Not applicable when the third or a
subsequent required AC source intentionally made
- 2. The following
Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Three or more required AC sources inoperable
. H.1 Restore required AC source(s) to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program I. Required Action and
Associated Completion
Time of Condition A, B, C, D, E, F, G, or H not met. I.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> I.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-7 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.1.1 Verify correct breaker alignment and indicated power availability for each
required offsite circuit.
In accordance
with the Surveillance
Frequency
Control Program SR 3.8.1.2
NOTES------------------
- 1. Performance of SR 3.8.1.7 satisfies
this SR. 2. All DG starts may be preceded by an
engine prelube period and followed by
a warmup period prior to loading.
- 3. A modified DG start involving idling
and gradual a cceleration to
synchronous speed may be used for
this SR as recommended by the
manufacturer. When modified start
procedures are not used, the time, voltage, and frequency tolerances
of SR 3.8.1.7 must be met.
- 4. The steady state voltage and
frequency lim its are analyzed values
and have not been adjusted for
instrument error.
Verify each DG starts from standby condition and achieves steady state
voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-8 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.3 -------------------
NOTES-------------------
- 1. DG loadings may include gradual loading as recommended by the
manufacturer.
- 2. Momentary transients outside the load
range do not invalidate this test.
- 3. This Surveillance shall be conducted
on only o ne DG at a time.
- 4. This SR shall be preceded by and
immediately follow without shutdown a
successful performance of SR 3.8.1.2
or SR 3.8.1.7.
Verify each DG is synchronized and loaded, and operates for 60 minutes at a load 4950 kW and 5500 kW. In accordance
with the Surveillance
Frequency
Control Program SR 3.8.1.4 Verify each day tank contains 550 gal of fuel oil (minimum level of 2.75 feet).
In accordance
with the Surveillance
Frequency
Control Program SR 3.8.1.5 Check for and remove accumulated water from
each day tank.
In accordance
with the Surveillance
Frequency
Control Program SR 3.8.1.6 Verify the fuel oil transfer system
operates to automatically transfer fuel
oil from the storage tank to the day tank.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-9 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.7
NOTE--------------------
- 1. All DG starts may be preceded by an
engine prelube period followed by a
warmup period prior to loading.
- 2. The steady state voltage and frequency
limits are analyzed va lues and have not been adjusted for instrument error.
Verify each DG starts from standby
condition and achieves
- a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and
- b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance with the Surveillance
Frequency
Control Program SR 3.8.1.8
NOTE------------------
This Surveillance shall not normally be
performed in MODE 1 or 2. However, this Surveillance may be performed to
reestablish OPERABILITY provided an
assessment determines the safety of the
plant is maintained or enhanced.
Verify manual transfer of AC power sources from the normal offs ite circuit to each
alternate offsite circuit.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-10 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.9
NOTE------------------
This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.
However, this Surveillance may be performed to
reestablish OPERABILITY provided an
assessment determines the safety of the
plant is maintained or enhanced.
Verify each DG rejects a load greater than
or equal to its associated single largest
post-accident load, and:
- a. Following load rejection, the frequency is 64.5 Hz; b. Within 3 seconds following load
rejection, the voltage is 3740 V and 4580 V; and
- c. Within 3 seconds following load
rejection, the frequency is
58.8 Hz and 61.2 Hz. In accordance
with the Surveillance Frequency
Control Program SR 3.8.1.10
NOTE-----------------
If performed with the DG synchronized with
offsite power, it shall be performed at a
power factor of 0.89. However, if grid conditions do not permit, the power factor
limit is not required to be met. Under
this condition the power factor shall be
maint ained as close to the limit as
practicable.
Verify each DG does not trip, and voltage
is maintained 6200 V during and following a load rejection of 4950 kW and 5500 kW. In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-11 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.11
NOTE--------------------
- 1. All DG starts may be preceded by an engine prelube period.
- 2. This Surveillance shall not normally
be performed in MODE 1, 2, 3, or 4.
However, portions of the Surveillance
may be performed to reestablish
OPE RABILITY provided an assessment
determines the safety of the plant is
maintained or enhanced.
- 3. Momentary voltage and frequency transients induced by load changes do
not invalidate this test.
- 4. The steady state voltage and frequency
limits are analyzed values and have not been adjusted for instrument
error. -------------------------------------------
Verify on an actual or simulated loss of
offsite power signal:
- a. De-energization of emergency buses;
- b. Load shedding from emergency buses;
- c. DG auto-starts and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto
-connected
emergency loads through automatic
load sequencer, 3. maintains steady state voltage
4000 V and 4377.2 V, 4. maintains steady state frequency
59.7 Hz and 60.7 Hz, and
- 5. supplies permanently connected
and auto-connected emergency
loads for 5 minutes.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2,3 3.8.1-12 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.12
NOTES------------------
- 1. All DG starts may be preceded by an engine prelube period.
- 2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.
However, portions of the Surveillance
may be performed to reestablish
OPERABILITY provided an assessment
determines the safety of the plant is
maintained or enhanced.
- 3. The steady state voltage and frequency
limits are analyzed values and have not been adjusted for instrument
error. ------------------------------------------
Verify on an actual or simulated Engineered
Safety Feature (ESF) actuation signal (without a loss of offsite power) each
DG auto-starts and:
- a. In 10 seconds, achieves voltage 3740 V and frequency 58.8 Hz; b. Achieves steady state voltage 4000 and 4377.2 V and frequency 59.7 Hz and 60.7 Hz; c. Operates for 5 minutes on standby (running unloaded);
- d. Permanently connected loads remain
energized from the offsite power
system; and
- e. Emergency loads are energized (auto
-
connected through the automatic load
sequencer) from the offsite power
system. In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-13 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.13 Verify each DG automatic trip is bypassed on actual or simulated loss of voltage signal on the emergency bus concurrent with
an actual or simulated ESF actuation
signal except:
- a. Engine overspeed;
- b. Generator differential current;
- c. Engine low lube oil pressure; and
- d. Manual emergency stop trip.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-14 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.14
NOTES-------------------
- 1. Momentary transients outside the load range do not invalidate this test.
- 2. If performed with the DG synchronized with offsite power, it shall be
performed at a power factor of 0.89. However, if grid conditions do not
permit, the power factor limit is not
required to be met. Under this
condition the power factor shall be
maintained as close to the limit as
practicable.
- 3. All DG starts may be preceded by an
engine prelube period followed by a
warmup period prior to loading.
- 4. DG loading may include gradual loading
as recommended by the manufacturer.
Verify each DG operates for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s: a. For 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> loaded 4950 kW and 5500 kW; and
- b. For the remaining hours ( 2) of the test loaded 5775 kW and 6050 kW. In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-15 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.15
NOTES-------------------
- 1. This Surveillance shall be performed within 5 minutes of shutting down the
DG after the DG, loaded 4950 kW and 5500 kW, has operated 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or until temperatures have stabilized.
Momentary transients outside of load
range do not invalidate this test
. 2. All DG starts may be preceded by an engine prelube period.
- 3. The steady state voltage and frequency
limits are analyzed values and have
not been adjusted for instrument
error. -------------------------------------------
Verify each DG starts and achieves
- a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and
- b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance
with the Surveillance
Frequency
Control Program SR 3.8.1.16
NOTE-------------------
This Surveillance shall not normally be
performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to
reestablish OPERABILITY provided an
assessment determines the safety of the
plant is maintai ned or enhanced.
Verify each DG:
- a. Synchronizes with offsite power source while loaded with emergency loads upon
a simulated restoration of offsite
power; b. Transfers loads to offsite power
source; and
- c. Returns to ready
-to-load operation.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-16 AMEND MENT NO. 188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.17
NOTE--------------------
This Surveillance shall not normally be
performed in MODE 1, 2, 3, or 4. However, portions of the Surveillance may be
performed to reestablish OPERABILITY
provided an assessme nt determines the
safety of the plant is maintained or
enhanced.
Verify, with a DG operating in test mode and connected to its bus, an actual or
simulated ESF actuation signal overrides
the test mode by:
- a. Returning DG to ready
-to-load operation; and
- b. Automatically energizing the emergency
load from offsite power.
In accordance with the Surveillance
Frequency
Control Program SR 3.8.1.18
NOTE-------------------
This Surveillance shall not normally be
performed in MODE 1, 2, 3, or 4. However, this Surveillance may be performed to
reestablish OPERABILITY provided an
assessment determines the safety of the
plant is maintained or enhanced.
Verify interval between each sequenced load
block is within +/- 1 second of design
interval for each automatic load sequencer.
In accordance
with the Surveillance
Frequency
Control Program (continued)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-17 AMENDMENT NO.
188 , SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.19
NOTES-------------------
- 1. All DG starts may be preceded by an engine prelube period.
- 2. This Surveillance shall not normally be performed in MODE 1, 2, 3, or 4.
However, portions of the Surveillance
may be performed to reestablish
OPERABILITY provided an assessment
determines the safety of the plant is
maintained or enhanced.
- 3. The steady state voltage and frequency
limits are ana lyzed values and have
not been adjusted for instrument
error. -------------------------------------------
Verify on an actual or simulated loss of
offsite power signal in conjunction with an
actual or simulated ESF actuation signal:
- a. De-energization of emergency buses;
- b. Load shedding from emergency buses;
- c. DG auto-starts from standby condition and: 1. energizes permanently connected loads in 10 seconds, 2. energizes auto
-connected
emergency loads through load
sequencer, 3. achieves steady state vo ltage 4000 V and 4377.2 V, 4. achieves steady state frequency
59.7 Hz and 60.7 Hz, and
- 5. supplies permanently connected
and auto-connected emergency
loads for 5 minutes.
In accordance
with the Surveillance
Frequency
Control Program (continued
)
AC Sources
~ Operating 3.8.1 PALO VERDE UNITS 1,2
,3 3.8.1-18 AMENDMENT NO.
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.1.20
NOTES-------------------
- 1. All DG starts may be preceded by an engine prelube period.
- 2. The steady state voltage and frequency
limits are analyzed values and have
not been adjusted for instrument
error. -------------------------------------------
Verify, when started simultaneously, each DG achieves
- a. In 10 seconds, voltage 3740 V and frequency 58.8 Hz; and
- b. Steady state voltage 4000 V and 4377.2 V, and frequency 59.7 Hz and 60.7 Hz. In accordance with the Surveillance
Frequency
Control Program
DC Sources
- Operating 3.8.4 PALO VERDE UNITS 1,2
,3 3.8.4-1 AMENDMENT NO.
193 , 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources
- Operating LCO 3.8.4 The Train A and Train B DC electrical power subsystems shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One battery charger on one subsystem
. A.1 Restore battery terminal voltage to
greater than or equal
to the minimum
established float
voltage. AND A.2 Verify battery float
AND A.3 Restore battery
charger to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 72 hours OR In accordance with the Risk
Informed Completion Time
Program B. One DC electrical
power subsystem
inoperable for reasons
othe r than Condition A. B.1 Restore DC electrical
power subsystem to OPERABLE status
. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program DC Sources
- Operating 3.8.4 PALO VERDE UNITS 1,2
,3 3.8.4-2 AMENDMENT NO.
193 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME C. --------NOTES-------- 1. Not applicable when second DC
electrical power
subsystem
inten tionally made
- 2. T he following
Section 5.5.20
constraints are
applicable: parts
b, c.2, c.3, d, e, f, g, and h.
Two DC electrical power subsystems inoperable
. C.1 Restore at least one DC
electrical power
subsystem to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time Program D. Required Action and associated Completion
Time not met. D.1 Be in MODE 3. AND D.2 Be in MODE 5.
6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> s 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> DC Sources
- Operating 3.8.4 PALO VERDE UNITS 1,2
,3 3.8.4-3 AMENDMENT NO.
193 , SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.4.1 Verify battery terminal voltage is greater than or equal to the minimum established
float voltage. In accordance
with the Surveillance
Frequency
Control Program SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 Deleted SR 3.8.4.5 Deleted SR 3.8.4.
6 Verify each battery charger supplies
~ 400 amps for Batteries A and B and ~ 300 amps for Batteries C and D at greater than or equal to the minimum
. OR Verify each battery charger can recharge
the battery to the fully charged state
within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> while supplying the largest
combined demands of the various continuous
steady state loads, after a battery
discharge to the bounding design basis
event discharge state.
In accordance
with the Surveillance
Frequency
Control Program (continued)
DC Sources
- Operating 3.8.4 PALO VERDE UNITS 1, 2,3 3.8.4-4 AMENDMENT NO.
SURVEILLANCE REQUIREMENTS (continued)
SURVEILLANCE FREQUENCY SR 3.8.4.
7 -------------------
NOTES-------------------
- 1. The modified performance discharge test in SR 3.8.
6.9 may be performed in lieu of SR 3.8.4.7.
- 2. This Surveillance shall not be performed in MODE 1, 2, 3, or 4. -------------------------------------------
Verify battery capacity is adequate to
supply, and maintain in OPERABLE status, the required emergency loads for the design
duty cycle when subjected to a battery
service test.
In acco rdance with the Surveillance Frequency
Control Program SR 3.8.4.
8 Deleted Inverters
~ Operating 3.8.7 PALO VERDE UNITS 1,2
,3 3.8.7-1 AMENDMENT NO.
180 3.8 ELECTRICAL POWER SYSTEMS
3.8.7 Inverters
- Operating LCO 3.8.7 The required Train A and Train B inverters shall be OPERABLE. ----------------------------
NOTE----------------------------
One inverter may be disconnected from its associated DC bus
for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform an equalizing charge on its associated battery, provided:
- a. The associated AC vital instrument bus is energized from its Class 1E constant voltage source regulator; and
- b. All other AC vital instrument buses are energized from
their associated OPERABLE inverters.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required inverter
A.1 ---------NOTE---------
Enter applicable
Conditions and
Required Actions of
LCO 3.8.9, "Distribution
Systems - Operating" with any vital
instrument bus
de-energized.
Restore inverter to OPERABLE status. 7 days OR In accordance
with the Risk
Informed Completion Time
Program (continued)
Inverters
~ Operating 3.8.7 PALO VERDE UNITS 1,2
,3 3.8.7-2 AMENDMENT NO.
188 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTES-------- 1. Not applicable when the second or a
subsequent required inverter intentionally made
inoperable resulting in loss of safety
function. 2. The following
Section 5.5.20
constraints are
applicable when there is a loss of
fu n ction: parts b, c.2, c.3, d, e, f, g, and h. ----------------
Two or more required
inverters inoperable
. B.1 Restore all but one
inverter to OPERABLE status. 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program C. Required Action and
associated Completion
Time not met.
C.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> C.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.7.1 Verify correct inverter voltage, frequency, and alignment to required AC vital
instrument buses.
In accordance
with the Surveillance
Frequency
Control Program
Distribution Systems
~ Operating 3.8.9 PALO VERDE UNITS 1,2
,3 3.8.9-1 AMENDMENT NO.
197 3.8 ELECTRICAL POWER SYSTEMS
3.8.9 Distribution
Systems
- Operating LCO 3.8.9 Train A and Train B AC, DC, and AC vital instrument bus electrical power distribution subsystems shall be OPERABLE.
APPLICABILITY:
MODES 1, 2, 3, and 4.
ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One AC electrical
power distribution
subsystem inoperable.
A.1 Restore AC electrical
power distribution
subsystem to OPERABLE
status. 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> OR In accordance with the Risk
Informed Completion Time
Program B. One AC vital
instrument bus
electrical power distribution subsystem inoperable.
B.1 Restore AC vital
instrument bus
electrical power
distribution
subsystem to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk Informed Completion Time
Program C. One DC electrical
power distribution
subsystems inoperable.
C.1 Restore DC electrical
power distribution
subsystem to OPERABLE
status. 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> OR In accordance with the Risk
Informed Completion Time
Program (continued)
Distribution Systems
~ Operating 3.8.9 PALO VERDE UNITS 1,2
,3 3.8.9-2 AMENDMENT NO.
197 , ACTIONS (continued)
CONDITION REQUIRED ACTION COMPLETION TIME D. --------NOTES-------- 1. Not applicable when the second or a subsequent
electrica l power distribution
subsystem
intentionally made
inoperable resulting in loss of safety
function. 2. The following Section 5.5.20
constraints are
applicable when there is a loss of
fu n ction: parts b, c.2, c.3, d, e, f, g, and h. ---------------
Two or more electrical
power distribution
subsystems inoperable
. D.1 Restore electrical
power distribution
subsystem(s) to
OPERABLE status.
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> OR In accordance with the Risk Informed
Completion Time
Program E. Required Action and
associated Completion
Time not met.
E.1 Be in MODE 3.
AND 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> E.2 Be in MODE 5.
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.9.1 Verify correct breaker alignments and
voltage to required AC, DC, and AC vital
instrument bus electrical power
distribution subsystems.
In accordance with the Surveillance
Frequency
Control Program
Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)
________________________________
________________________________
______ ________________________________
________________________________
______ PALO VERDE UNITS 1,2
,3 5.5-20 AMENDMENT NO.
5.5.20 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06
-09 (Revision 0)
- A, "Risk-Managed Technical Specifications (RMTS) Guidelines.
" The program shall include the following:
- a. The RICT may not exceed 30 days;
- b. A RICT may only be utilized in MODE 1 and 2.
- c. When a RICT is being used, any plant configuration change within the scope of the Configuration Risk Management Program must be considered for the effect on the RICT.
- 1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.
- 2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the plant configuration change, whichever is less. 3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.
- d. Use of a RICT is not permitted for voluntary entry into a configuration which represents a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE.
- e. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional
" as defined in Section 2.3.1 of NEI 06
-09 (Revision 0)
- A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- f. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more trains are considered
"PRA Functional
" as defined in Section 2.3.1 of NEI 06
-09 (Revision 0)
- A. However, the following additional constraints shall be applied to the criteria for "PRA Functional
."
Before SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)
________________________________
________________________________
______ ________________________________
________________________________
______ PALO VERDE UNITS 1,2
,3 5.5-21 AMENDMENT NO.
- 1. Any SSCs credited in the PRA Functionality determination shall be the same SSCs relied upon to perform the specified Technical Specifications safety function.
- 2. Design basis success criteria parameters shall be met for all design basis accident scenarios for establishing PRA Functionality, during a Technical Specifications loss of function condition, where a RICT is applied. g. Upon entering a RICT for an emergent condition, the potential for a common cause (CC) failure must be addressed.
If there is a high degree of confidence, based on the evidence collected, that there is no CC failure mechanism that could affect the redundant components, the RICT calculation may use nominal CC factor probability.
If a high degree of confidence cannot be established that there is no CC failure that could affect the redundant components, the RICT shall account for the increased possibility of CC failure. Accounting for the increased possibility of CC failure shall be accomplished by one of two methods. If one of the two methods listed below is not used, the Technical Specifications front stop shall not be exceeded.
- 1. The RICT calculation shall be adjusted to numerically account for the increased possibility of CC failure, in accordance with RG 1.177, as specified in Section A
-1.3.2.1 of Appendix A of the RG. Specifically, when a component fails, the CC failure probability for the remaining redundant components shall be increased to represent the conditional failure probability due to CC failure of these components, in order to account for the possibility the first failure was caused by a CC mechanism.
OR 2. Prior to exceeding the front stop, RMAs not already credited in the RICT calculation shall be implemented. These RMAs shall target the success of the redundant and/or diverse structures, systems, or components (SSC) of the failed SSC and, if possible, reduce the frequency of initiating events which call upon the function(s) performed by the failed SSC. Documentation of RMAs shall be available for NRC review. h. A RICT entry is not permitted, or a RICT entry made shall be exited, for any condition involving a TS loss of Function if a PRA Functionality determination that reflects the plant configuration concludes that the LCO cannot be restored without placing the TS inoperable trains in an alignment which results in a loss of functional level PRA success criteria.
After SFP transition Programs and Manuals 5.5 5.5 Programs and Manuals (continued)
________________________________
________________________________
______ ________________________________
________________________________
______ PALO VERDE UNITS 1,2
,3 5.5-22 AMENDMENT NO.
5.5.21 Spent Fuel Storage Rack Neutron Absorber Monitoring Program Certain storage cells in the spent fuel storage racks utilize neutro n absorbing material that is credited in the spent fuel storage rac k criticality safety analysis to ensure the limitations of Technica l Specifications 3.7.17 and 4.3.1.1 are maintained
. In order to ensure the reliability of the neutron absorber material, a monitoring program is provided to confirm the aassumptions in the spent fuel pool criticality safety analysis. The Spent Fuel Storage Rack Neutron Absorber Monitoring Program shall require periodic inspection and monitoring of spent fuel pool test coupons and neutron absorber inserts on a performance
-based frequency, not to exceed 10 years. Test coupons shall be inspected as part of the monitoring program. These inspections shall include visual, B
-10 areal density and corrosion rate. Visual in-situ inspections of inserts shall also be part of the program to monitor for signs of degradation. In addition, an insert shall be removed periodically for visual inspection, thickness measurements, and determination of retention force.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 3 Technical Specification Bases Changes TS Bases Mark-up Pages B 3.3.6-16 B 3.7.5-6 B 3.3.6-18 B 3.7.5-7 B 3.4.10-3 B 3.7.5-8 B 3.4.12-3 B 3.7.7-3 B 3.4.12-4 B 3.7.7-4 B 3.5.1-8 B 3.7.8-3 B 3.5.3-6 B 3.7.10-3 B 3.5.5-8 B 3.8.1-9 B 3.6.2-7 B 3.8.1-12 B 3.6.3-10 B 3.8.1-13 B 3.6.3-11 B 3.8.1-15 B 3.6.3-12 B 3.8.1-16 B 3.6.3-13 B 3.8.1-17 B 3.6.3-14 B 3.8.1-22 B 3.6.3-15 B 3.8.4-7 B 3.6.6-5 B 3.8.4-8 B 3.7.2-7 B 3.8.7-4 B 3.7.2-8 B 3.8.9-4 B 3.7.3-3 B 3.8.9-5 B 3.7.3-4 B 3.8.9-6 B 3.7.4-5 B 3.8.9-7 B 3.7.5-5
ESFAS Logic and Manual Trip B 3.3.6 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.3.6-16 REVISION 0 ACTIONS A.1 (continued) The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. This provides the operator with time to take
appropriate actions and still ensures that any risk
involved in operating with a failed channel is acceptable.
Operating experience has demonstrated that the probability
of a random failure of a second Matrix Logic channel is low
during any given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. If the channel cannot be
restored to OPERABLE status with 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, Condition E is
entered. B.1 Condition B applies to one Manual Trip or Initiation Logic channel inoperable. The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Operating experience has demonstrated that the
probability of a random failure in a second channel is low
during any given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. Failure of a single Initiation Logic channel may open one contact affecting both Actuation Logic channels. For the
purposes of this Specification, the Actuation Logic is not
inoperable. This prevents the need to enter LCO 3.0.3 in
the event of an Initiation Logic channel failure. The
Actions differ from those involving one RPS manual channel
inoperable, because in the case of the RPS, opening RTCBs
can be easily performed and verified. Opening an
initiation relay contact is more difficult to verify, and
subsequent shorting of the contact is always possible. C.1 and C.2 Condition C applies to the failure of both Initiation Logic channels affecting the same trip leg. In this case, the Actuation Logic channels are not inoperable, since they are in one-out-of-two logic and
capable of performing as required. This obviates the need
to enter LCO 3.0.3 in the event of a matrix or vital bus
power failure.orinaccordancewiththeRisk
Informed CompletionTime
Program ESFAS Logic and Manual Trip B 3.3.6 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.3.6-18 REVISION 0 ACTIONS D.1 (continued) The channel must be restored to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Operating experience has demonstrated that the
probability of a random failure in the Actuation Logic of
the second train is low during a given 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> period. Failure of a single Initiation Logic channel, matrix channel power supply, or vital instrument bus may open one
or both contacts in the same trip leg in both Actuation
Logic channels. For the purposes of this Specification, the Actuation Logic is not inoperable. This obviates the
need to enter LCO 3.0.3 in the event of a vital bus, matrix, or initiation channel failure. Each Actuation Logic channel has two sets of redundant power supplies. The power supplies in each set are powered
from different vital instrument buses. Failure of a single
power supply or a set of power supplies due to the loss of
a vital instrument bus, does not affect the operation of
the Actuation Logic because the redundant power supplies
can supply the full system load. For the purposes of this
specification, the Actuation Logic is not inoperable. Required Action D.1 is modified by a Note to indicate that one channel of Actuation Logic may be bypassed for up to
1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for Surveillance, provided the other channel is
OPERABLE. This allows performance of a PPS CHANNEL FUNCTIONAL TEST on an OPERABLE ESFAS train without generating an ESFAS
actuation in the inoperable train. E.1 and E.2 If the Required Actions and associated Completion Times of Conditions for CSAS, MSIS or AFAS cannot be met, the plant
must be brought to a MODE in which the LCO does not apply.
To achieve this status, the plant must be brought to at
least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.
The allowed Completion Times are reasonable, based on
operating experience, to reach the required plant
conditions from full power conditions in an orderly manner
and without challenging plant systems.orinaccordancewiththeRisk
Informed CompletionTime
Program Pressurizer Safety Valves-MODES 1, 2, and 3 B 3.4.10 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.4.10-3 REVISION 0 APPLICABILITY The requirements for overpressure protection in other MODES (continued) are covered by LCO 3.4.11, "Pressurizer Safety Valves-MODE 4," and LCO 3.4.13, "LTOP System." The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and
examination of the safety valves at high pressure and
temperature near their normal operating range, but only
after the valves have had a preliminary cold setting. The
cold setting gives assurance that the valves are OPERABLE
near their design condition. Only one valve at a time will
be removed from service for testing. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> exception
is based on 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> outage time for each of the four valves.
The 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> period is derived from operating experience that
hot testing can be performed within this timeframe. ______________________________________________________________________________
ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of
15 minutes reflects the importance of maintaining the RCS
overpressure protection system. An inoperable safety valve
coincident with an RCS overpressure event could challenge
the integrity of the RCPB. B.1 and B.2 If the Required Action cannot be met within the required Completion Time or if two or more pressurizer safety valves
are inoperable, the plant must be brought to a MODE in which
the requirement does not apply. To achieve this status, the
plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and
to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowed is
reasonable, based on operating experience, to reach MODE 3
from full power without challenging plant systems.
Similarly, the 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed is reasonable, based on
operating experience, to reach MODE 4 without challenging
plant systems.orinaccordancewiththeRiskInformedCompletionTimeProgramInsert1 Insert 1: B 3.4.10-3 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when pressurizer safety valve is intentionally made inoperable. This
Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable
constraints are located in TS section 5.5.20.
Pressurizer Vents B 3.4.12 BASES ______________________________________________________________________________ (continued) _______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.4.12-3 REVISION 48 LCO A vent path is flow capability from the pressurizer to the (continued) RDT or from the pressurizer to containment atmosphere.
Loss of any single valve in the pressurizer vent system will
cause two flow paths to become inoperable. A pressurizer
vent path is required to depressurize the RCS in a SGTR
design basis event which assumes LOP and APSS unavailable. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the four pressurizer vent paths are required to be OPERABLE.
The safety analysis for the SGTR with LOP and a Single
Failure (loss of APSS) credits a pressurizer vent path to
reduce RCS pressure. In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia the SGs are the primary means of heat removal in the RCS, until shutdown cooling can be initiated. In MODES 1, 2, 3, and MODE 4 with RCS pressure 385 psia, assuming the APSS is not available, the pressurizer vent paths are the
credited means to depressurize the RCS to Shutdown Cooling
System entry conditions. Further depressurization into MODE
5 requires use of the pressurizer vent paths. In MODE 5 with
the reactor vessel head in place, temperature requirements
of MODE 5 (< 210°F) ensure the RCS remains depressurized.
In MODE 6 the RCS is depressurized. ______________________________________________________________________________
ACTIONS A.1 If two or three pressurizer vent paths are inoperable, they must be restored to OPERABLE status. Loss of any single
valve in the pressurizer vent system will cause two flow
paths to become inoperable. Any vent path that provides
flow capability from the pressurizer to the RDT or to the
containment atmosphere, independent of which train is
powering the valves in the flow path, can be considered an
operable vent path. The Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is
reasonable because there is at least one pressurizer vent
path that remains OPERABLE.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.
Pressurizer Vents B 3.4.12 BASES _______________________________________________________________________________
________________________________________________________________________________ (continued) PALO VERDE UNITS 1,2,3 B 3.4.12-4 REVISION 56 ACTIONS B.1 (continued) If all pressurizer vent paths are inoperable, then restore at least one pressurizer vent path to OPERABLE status. The
Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable to allow time to
correct the situation, yet emphasize the importance of
restoring at least one pressurizer vent path. If at least
one pressurizer vent path is not restored to OPERABLE within
the Completion Time, then Action C is entered. C.1 If the required Actions, A and B, cannot be met within the associated Completion Times, the plant must be brought to a
MODE in which the requirement does not apply. To achieve
this status, the plant must be brought to at least MODE 3
within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and to MODE 4 with RCS pressure < 385 psia
within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The allowed Completion Times are
reasonable, based on operating experience, to reach the
required plant conditions from full power conditions in an
orderly manner without challenging plant systems.
_______________________________________________________________________________
SURVEILLANCE SR 3.4.12.1 REQUIREMENTS SR 3.4.12.1 requires complete cycling of each pressurizer vent path valve. The vent valves must be cycled from the
control room to demonstrate their operability. Pressurizer
vent path valve cycling demonstrates its function. The
Surveillance Frequency is controlled under the Surveillance
Frequency Control Program. This surveillance test must be
performed in Mode 5 or Mode 6. In any Mode, partial
surveillance tests can be performed for post-maintenance
testing under site procedural controls that ensure the valve
being tested is isolated from RCS pressure. SR 3.4.12.2 SR 3.4.12.2 requires verification of flow through each pressurizer vent path. Verification of pressurizer vent
path flow demonstrates its function. The Surveillance
Frequency is controlled under the Surveillance Frequency
Control Program. This surveillance test must be performed
in Mode 5 or Mode 6.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.Insert2 Insert 2: B 3.4.12-4 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the last pressurizer vent path is intentionally made inoperable. This
Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if three pressurizer
vent paths are inoperable for any reason and the last vent path is found to be inoperable, or if all pressurizer vent paths are found to be inoperable at the same time.
Note 2 provides constraints for this condition, the applicable constraints are located in
SITs-Operating B 3.5.1 BASES _______________________________________________________________________________
(continued)
______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.5.1-8 REVISION 1 ACTIONS B.1 If one SIT is inoperable for a reason other than boron concentration or the inability to verify level or pressure, the SIT must be returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
In this Condition, the required contents of three SITs
cannot be assumed to reach the core during a LOCA. CE NPSD-994 (Ref. 6) provides a series of deterministic and probabilistic findings that support 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> as being either "risk beneficial" or "risk neutral" in comparison to shorter
periods for restoring the SIT to OPERABLE status. CE
NPSD-994 (Ref. 6) discusses best-estimate analysis for a
typical PWR that confirmed that, during large-break LOCA
scenarios, core melt can be prevented by either operation of
one low pressure safety injection (LPSI) pump or the
operation of one high pressure safety injection (HPSI) pump
and a single SIT. CE NPSD-994 (Ref. 6) also discusses
plant-specific probabilistic analysis that evaluated the
risk-impact of the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> recovery period in comparison to
shorter recovery periods. ACTIONS C.1 and C.2 If the SIT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a
MODE in which the LCO does not apply. To achieve this
status, the plant must be brought to at least MODE 3 within
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure reduced to < 1837 psia
within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are
reasonable, based on operating experience, to reach the
required plant conditions from full power conditions in an
orderly manner and without challenging plant systems. Specification 3.5.2, "SITs - Shutdown", further requires the plant to be in Mode 5 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the SIT
inoperability was discovered but not restored while in the
applicability of Specification 3.5.1, "SITs - Operating". D.1 If more than one SIT is inoperable, the unit is in a condition outside the accident analyses. Therefore,
LCO 3.0.3 must be entered immediately. Insert3 D D SIT (s)
Insert 3: B 3.5.1-8 C.1 With two or more SITs inoperable, the Required Action is to restore all but one SIT to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain this safety function. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of
sufficient SITs to regain safety function. Alternately, a Completion Time can be
determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent SIT is intentionally made inoperable. The
Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one SIT is inoperable for any reason and additional SITs are found to be inoperable, or if two or more SITs are found to be inoperable at the same time. Note 2 provides constraints for
this condition, the applicable constraints are located in TS section 5.5.20.
ECCS - Operating B 3.5.3 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.5.3-6 REVISION 2 ACTIONS A.1 Condition A addresses the specific condition where the only affected ECCS subsystem is a single LPSI subsystem. The
availability of at least 100% of the ECCS flow equivalent to
a single OPERABLE ECCS train is implicit in the definition
of Condition A.
If LCO 3.5.3 requirements are not met due only to the existence of Condition A, then the inoperable LPSI subsystem
components must be returned to OPERABLE status within 7 days
of discovery of Condition A. This 7 day Completion Time is
based on the findings of the deterministic and probabilistic
analysis that are discussed in Reference 6. Seven days is a
reasonable amount of time to perform many corrective and
preventative maintenance items on the affected LPSI
subsystem. Reference 6 concluded that the overall risk
impact of this Completion Time was either risk-beneficial or
risk-neutral.
The Configuration Risk Management Program (CRMP) in TRM Section 5.0.500.19 applies when Condition A is entered. B.1 If one or more ECCS trains are inoperable, except for reasons other than Condition A (one LPSI subsystem
inoperable), and at least 100% of the ECCS flow equivalent
to a single OPERABLE ECCS train is available, the inoperable
components must be returned to OPERABLE status within
72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on an NRC
study (Ref. 4) using a reliability evaluation and is a
reasonable amount of time to effect many repairs. An ECCS train is inoperable if it is not capable of delivering the design flow to the RCS. The individual
components are inoperable if they are not capable of
performing their design function, or if supporting systems
are not available.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.
RWT B 3.5.5 BASES _______________________________________________________________________________
(continued)
______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.5.5-8 REVISION 56 ACTIONS B.1 (continued)
With RWT borated water volume not within limits, it must be returned to within limits within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In this condition, neither the ECCS nor Containment Spray System can perform
their design functions; therefore, prompt action must be
taken to restore the tank to OPERABLE status or to place the
unit in a MODE in which these systems are not required. The
allowed Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to restore the RWT to
OPERABLE status is based on this condition since the
contents of the tank are not available for injection and
core cooling.
C.1 and C.2 If the RWT cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a
MODE in which the LCO does not apply. To achieve this
status, the plant must be brought to at least MODE 3 within
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed
Completion Times are reasonable, based on operating
experience, to reach the required plant conditions from full
power conditions in an orderly manner and without
challenging plant systems.
_______________________________________________________________________________
SURVEILLANCE SR 3.5.5.1 REQUIREMENTS RWT borated water temperature shall be verified to be within
the limits assumed in the accident analysis. The
Surveillance Frequency is controlled under the Surveillance
Frequency Control Program.
The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures
are within the operating temperature limits of the RWT. With
ambient temperatures within this range, the RWT temperature
should not exceed the limits.
orinaccordancewiththeRiskInformedCompletionTimeProgramInsert4 Insert 4: B 3.5.5-8 The Condition is modified by two Notes. Note 1 states that this condition is not
applicable when RWT is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. The
Required Action is only applicable if RWT is inoperable for any reason other than
Condition A. Note 2 provides constraints for this condition, the applicable constraints are
located in TS section 5.5.20.
Containment Air Locks B 3.6.2 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.2-7 REVISION 0 ACTIONS C.1, C.2, and C.3 (continued) Required Action C.2 requires that one door in the affected containment air lock must be verified to be closed. This
action must be completed within the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time.
This specified time period is consistent with the ACTIONS of
LCO 3.6.1, which requires that containment be restored to
OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Additionally, the affected air lock(s) must be restored to OPERABLE status within the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time. The
specified time period is considered reasonable for restoring
an inoperable air lock to OPERABLE status, assuming that at
least one door is maintained closed in each affected air
lock. D.1 and D.2 If the inoperable containment air lock cannot be restored to OPERABLE status within the required Completion Time, the
plant must be brought to a MODE in which the LCO does not
apply. To achieve this status, the plant must be brought to
at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant
conditions from full power conditions in an orderly manner
and without challenging plant systems. ______________________________________________________________________________ SURVEILLANCE SR 3.6.2.1 REQUIREMENTS Maintaining containment air locks OPERABLE requires compliance with the leakage rate test requirements of the
Containment Leakage Rate Testing Program. This SR reflects
the leakage rate testing requirements with regard to air
lock leakage (Type B leakage tests). The acceptance
criteria were established during initial air lock and
containment OPERABILITY testing. The periodic testing
requirements verify that the air lock leakage does not
exceed the allowed fraction of the overall containment
leakage rate. The Frequency is required by the Containment
Leakage Rate Testing Program and includes testing of the
airlock doors following each closing, as specified.orinaccordancewiththeRiskInformedCompletionTimeProgram Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-10 REVISION 64 ACTIONS A.1 and A.2 (continued)
In the event one required containment isolation valve in one or
more penetration flow paths is inoperable except for purge valve leakage not within limit (refer to Action D),the affected penetration flow path must be isolated. The method of isolation must include
the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed
manual valve (including a de-activated non-automatic valve),
a blind flange, and a check valve with flow through the valve secured. Compliance with this Action is established via:
- 1) Administrative controls on the de-activated automatic valve, closed manual valve, blind flange, or check valve, and
- 2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e., flow/pressure transmitters) located within the penetration that
are not removed from service for maintenance nor open to the
atmosphere are considered a closed loop portion of the associated
penetration; therefore, isolation valves associated with instruments
meeting this criteria need not be isolated nor otherwise
administratively controlled to comply with the requirements of this
Action. For penetrations isolated in accordance with Required
Action A.1, the device used to isolate the penetration should be the
closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting
containment OPERABILITY during MODES 1, 2, 3, and 4. For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time and
that have been isolated in accordance with Required Action
A.1, the affected penetration flow paths must be verified to
be isolated on a periodic basis. This is necessary to ensure
that containment penetrations required to be isolated
following an accident and no longer capable of being automatically isolated will be in the isolation position orinaccordancewiththeRiskInformedCompletionTimeProgram Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-11 REVISION 43 ACTIONS A.1 and A.2 (continued) should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside
containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact
that the devices are operated under administrative controls and
the probability of their misalignment is low. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the
previous 92 days" is based on engineering judgment and is
considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility. Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with
two containment isolation valves. For penetration flow paths with
only one containment isolation valve and a closed system, Condition C provides appropriate actions. Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing
verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the
probability of misalignment of these devices, once they have been
verified to be in the proper position, is small.followingisolation Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-12 REVISION 64 ACTIONS B.1 (continued) With two required containment isolation valves in one or more penetration flow paths inoperable except for purge valve leakage not within limit (refer to Action D), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The method of isolation must
include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that
meet this criterion are a closed and de-activated automatic valve, a closed manual valve (including a de-activated non-automatic
valve), and a blind flange. Compliance with this Action is established via: 1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange, and
- 2) Administrative controls on vents, drains, and test connections located within the containment penetration. Instruments (i.e.,
flow/pressure transmitters) located within the penetration that are not removed from service for maintenance nor open to the
atmosphere are considered a closed loop portion of the associated
penetration; therefore, isolation valves associated with instruments
meeting this criteria need not be isolated nor otherwise
administratively controlled to comply with the requirements of this
Action. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is consistent with the
ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated in accordance with Required Action B.1, the affected
penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the valves are operated under
administrative controls and the probability of their misalignment is low. Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves. Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration
flow path.orinaccordancewiththeRiskInformedCompletionTimeProgramNotes.Note1isInsert5 Insert 5: B 3.6.3-12 Note 2 states that RICT is not applicable when the second containment isolation valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 3 provides constraints
for this condition, the applicable constraints are located in TS section 5.5.20.
Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-13 REVISION 64 ACTIONS C.1 and C.2 (continued) With one or more required penetration flow paths with one containment isolation valve inoperable, the inoperable valve must
be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the
use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this
criterion are a closed and de-activated automatic valve, a closed
manual valve (including a de-activated non-automatic valve), and
a blind flange. Compliance with this Action is established via:
- 1) Administrative controls on the de-activated automatic valve, closed manual valve, or blind flange and 2) Administrative controls on vents, drains, and test connections located within the
containment penetration. Instruments (i.e., flow/pressure
transmitters) located within the penetration that are not removed from service for maintenance nor open to the atmosphere are
considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this
criteria need not be isolated nor otherwise administratively
controlled to comply with the requirements of this Action. A check
valve may not be used to isolate the affected penetration.
Required Action C.1 must be completed within the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />
Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation boundary and the relative importance of supporting containment OPERABILITY
during MODES 1, 2, 3, and 4. In the event the affected penetration
is isolated in accordance with Required Action C.1, the affected
penetration flow path must be verified to be isolated on a periodic
basis. This is necessary to assure leak tightness of containment
and that containment penetrations requiring isolation following an
accident are isolated. The Completion Time of once per 31 days
for verifying that each affected penetration flow path is isolated is
appropriate considering the valves are operated under
administrative controls and the probability of their misalignment is low. Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths
with only one containment isolation valve and a closed system. The only credited closed systems are the Steam Generating and the Containment Pressure Monitoring
Systems. This Note is necessary since this Condition is Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime
Program.followingisolation Containment Isolation Valves B 3.6.3 BASES _______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-14 REVISION 64 ACTIONS C.1 and C.2 (continued) written to specifically address those penetration flow paths which are neither part of the reactor coolant pressure boundary nor
connected directly to the containment atmosphere (10 CFR 50, APP. A, GDC 57). Required Action C.2 is modified by a Note that applies to valves and blind flanges located in high radiation areas and allows these
devices to be verified closed by use of administrative means.
Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.
Therefore, the probability of misalignment of these valves, once
they have been verified to be in the proper position, is small. D.1, D.2, and D.3 In the event one or more required containment purge valves in one or more penetration flow paths are not within the purge valve leakage limits, purge valve leakage must be restored to within
limits, or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation
barriers that meet this criterion are a closed and de-activated
automatic valve with resilient seals, or a blind flange. A purge valve with resilient seals utilized to satisfy Required Action D.1
must have been demonstrated to meet the leakage requirements of SR 3.6.3.6. Compliance with this Action is established via:
- 1) Administrative controls on the de-activated automatic valve with resilient seals or blind flange, and 2) Administrative controls on vents, drains, and test connections located within the containment
penetration. Instruments (i.e., flow/pressure transmitters) located
within the penetration that are not removed from service for
maintenance nor open to the atmosphere are considered a closed loop portion of the associated penetration; therefore, isolation valves associated with instruments meeting this criteria need not
be isolated nor otherwise administratively controlled to comply with the requirements of this Action. The specified Completion Time is reasonable, considering that one containment purge valve remains
closed so that a gross breach of containment does not exist.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.
Containment Isolation Valves B 3.6.3 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.6.3-15 REVISION 43 ACTIONS D.1, D.2 and D.3 (continued) In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The
periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which
are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required
Action does not require any testing or valve manipulation.
Rather, it involves verification, through a system walkdown, that those isolation devices outside containment capable of being mispositioned are in the correct position. For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not
performed within the previous 92 days" is based on engineering
judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility. For the required containment purge valve with a resilient seal that is isolated in accordance with Required Action D.1, SR 3.6.3.6 must be performed at least once every 92 days. This assures that degradation of the resilient seal is detected and confirms that the leakage rate of the containment purge valve does not increase
during the time the penetration is isolated. The normal Frequency for SR 3.6.3.6, 184 days, is based on an NRC initiative, Generic
Issue B-20 (Ref. 3). Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more
often. Therefore, a Frequency of once per 92 days was chosen
and has been shown to be acceptable based on operating
experience. E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at
least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions
from full power conditions in an orderly manner and without
challenging plant systems.followingisolationfollowingisolationfollowingisolationInsert6 Insert 6: B 3.6.3-15 Note 1 states that RICT is not applicable when the second containment purge valve is intentionally made inoperable. The Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints
for this condition, the applicable constraints are located in TS section 5.5.20.
Containment Spray System B 3.6.6 BASES ______________________________________________________________________________ (continued) _____________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.6.6-5 REVISION 1 LCO containment spray actuation signal and automatically (continued) transferring suction to the containment sump on a recirculation actuation signal. Each spray train flow path
from the containment sump shall be via an OPERABLE shutdown
cooling heat exchanger. Therefore, in the event of an accident, the minimum requirements are met, assuming that the worst case single
active failure occurs. Each Containment Spray System typically includes a spray pump, a shutdown cooling heat exchanger, spray headers, nozzles, valves, piping, instruments, and controls to ensure
an OPERABLE flow path capable of taking suction from the RWT
upon an ESF actuation signal and automatically transferring
suction to the containment sump. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, and 3, and Mode 4 with RCS pressure 385 psia, a DBA could cause a release of radioactive material to
containment and an increase in containment pressure and
temperature, requiring the operation of the containment
spray trains. In MODE 4 with RCS pressure < 385 psia and MODES 5 and 6, the probability and consequences of these events are reduced
due to the pressure and temperature limitations of these
MODES. Thus, the Containment Spray System is not required
to be OPERABLE in these MODES. ______________________________________________________________________________
ACTIONS A.1 With one containment spray train inoperable, the inoperable containment spray train must be restored to OPERABLE status
within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE
spray train is adequate to perform the iodine removal, hydrogen mixing, and containment cooling functions. The
72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundant
heat removal capability afforded by the Containment Spray
System, reasonable time for repairs, and the low probability
of a DBA occurring during this period.orinaccordancewiththeRiskInformedCompletionTimeProgram MSIVs B 3.7.2 BASES (continued) ______________________________________________________________________________ (continued) ______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.2-7 REVISION 59 ACTIONS E.1 (continued)
(continued) or more MSIVs inoperable while in MODE 1 requires entry
into LCO 3.0.3.
F.1 With one MSIV inoperable in MODE 1, time is allowed to restore the component to OPERABLE status. Some repairs can
be made to the MSIV with the unit hot. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />
Completion Time is reasonable, considering the probability
of an accident occurring during the time period that would
require closure of the MSIVs.
Condition F is entered when one MSIV is inoperable in MODE 1, including when both actuator trains for one MSIV
are inoperable. When only one actuator train is inoperable
on one MSIV, Condition A applies.
The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that normally allowed for containment isolation valves that isolate a
closed system penetrating containment. These valves differ
from other containment isolation valves in that the closed
system provides an additional means for containment
isolation.
G.1 If the MSIV cannot be restored to OPERABLE within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the unit must be placed in a MODE in which the LCO does not
apply. To achieve this status, the unit must be placed in
MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition H would be entered. The
Completion Time is reasonable, based on operating
experience, to reach MODE 2, and close the MSIVs in an
orderly manner and without challenging unit systems.
H.1 and H.2 Condition H is modified by a Note indicating that separate Condition entry is allowed for each MSIV.
Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the inoperable MSIVs may either be restored to
OPERABLE status or closed. When closed, the MSIVs are
already in the position required by the assumptions in the
safety analysis.
Alternately,theCompletionTimecanbe determinedinaccordance withtheRiskInformed CompletionTimeProgram.Insert7 H I I I I Insert 7: B 3.7.2-7 G.1 With two or more MSIVs inoperable, the Required Action is to restore all but one MSIV
to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a method of main steam line isolation. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for
restoration of sufficient required MSIVs. Alternately, a Completion Time can be
determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not
applicable when the second or a subsequent MSIV is intentionally made inoperable.
This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one MSIV is
inoperable for any reason and additional MSIVs are found to be inoperable, or if two or more MSIVs are found to be inoperable at the same time. Note 2 provides constraints
for this condition, the applicable constraints are located in TS section 5.5.20.
MSIVs B 3.7.2 BASES (continued)
_______________________________________________________________________________
(continued)
______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.2-8 REVISION 54 ACTIONS H.1 and H.2 (continued)
(continued)
The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that allowed
in Condition F.
Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must
be verified on a periodic basis to be closed. This is
necessary to ensure that the assumptions in the safety
analysis remain valid. The 7 day Completion Time is
reasonable, based on engineering judgment, MSIV status
indications available in the control room, and other
administrative controls, to ensure these valves are in the
closed position.
I.1 and I.2 If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must
be placed in a MODE in which the LCO does not apply. To
achieve this status, the unit must be placed in at least
MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions
from MODE 2 conditions in an orderly manner and without
challenging unit systems.
_______________________________________________________________________________
SURVEILLANCE SR 3.7.2.1 REQUIREMENTS This SR verifies that the closure time of each MSIV is
within the limit given in Reference 5 with each actuator
train on an actual or simulated actuation signal and is
within that assumed in the accident and containment
analyses. This SR also verifies the valve closure time is
in accordance with the Inservice Testing Program. This SR
is normally performed upon returning the unit to operation
following a refueling outage. The MSIVs should not be full
stroke tested at power.
The Frequency for this SR is in accordance with the Inservice Testing Program. This Frequency demonstrates the
valve closure time at least once per refueling cycle.
I I J J MFIVs B 3.7.3 BASES (continued) ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.3-3 REVISION 37 APPLICABILITY The MFIVs must be OPERABLE whenever there is significant mass and energy in the Reactor Coolant System and steam
generators. This ensures that, in the event of an HELB, a
single failure cannot result in the blowdown of more than
one steam generator. In MODES 1, 2, 3, and 4, the MFIVs are required to be OPERABLE, except when they are closed and deactivated or
isolated by a deactivated and closed power operated valve, in order to limit the amount of available fluid that could
be added to containment in the case of a secondary system
pipe break inside containment. When the valves are closed
or isolated by a closed power operated valve, they are
already performing their safety function. In MODES 5 and 6, steam generator energy is low. Therefore, the MFIVs are not required. ______________________________________________________________________________ ACTIONS The ACTIONS table is modified by a Note indicating that separate Condition entry is allowed for each penetration
flow path. A.1 and A.2 With one MFIV inoperable, action must be taken to close or isolate the inoperable valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. When these
valves are closed or isolated, they are performing their
required safety function (e.g., to isolate the line). The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the redundancy afforded by the remaining OPERABLE valves, and
the low probability of an event occurring during this time
period that would require isolation of the MFW flow paths. Inoperable MFIVs that are closed to comply with Required Action A.1 must be verified on a periodic basis to be
closed. This is necessary to ensure that the assumptions in
the safety analysis remain valid. The seven day completion
time is responsible, based on engineering judgement, MFIV
status indications available in the control room, and other
administrative controls, to ensure these valves are in the
closed position.
With one or more MFIV s inoperable, action must be taken to restore the MFIV(s) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or in accordance
with the Risk Informed Completion Time Program OR to close or isolate the inoperable valves within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
A.1, A.2.1, and A.2.2 A.2.1 reasonable (editorial)followingisolation7(editorial)
MFIVs B 3.7.3 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.3-4 REVISION 0 ACTIONS B.1 and B.2 (continued)
If more than one MFIV in the same flow path cannot be
restored to OPERABLE status, then there may be no system to
operate automatically and perform the required safety
function. Under these conditions, valves in each flow path
must be restored to OPERABLE status, closed, or the flow
path isolated within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. This action returns the
system to the condition where at least one valve in each
flow path is performing the required safety function. The
8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time is reasonable to close an MFIV or
otherwise isolate the affected flow path. Inoperable MFIVs that cannot be restored to OPERABLE status within the Completion Time, but are closed or isolated, must
be verified on a periodic basis that they are closed or
isolated. This is necessary to ensure that the assumptions
in the safety analysis remain valid. The 7 day Completion
Time is reasonable, based on engineering judgment, in view
of valve status indications available in the control room, and other administrative controls to ensure that these
valves are closed or isolated. C.1 and C.2 If the MFIVs cannot be restored to OPERABLE status, closed, or isolated in the associated Completion Time, the unit must
be placed in a MODE in which the LCO does not apply. To
achieve this status, the unit must be placed in at least
MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions
from full power conditions in an orderly manner and without
challenging unit systems.
With two valves in the same flow path
inoperable, action
must be taken to
restore one valve to
OPERABLE status
within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or in
accordance with the
Risk Informed
Completion Time
Program OR isolate
the affected flow
path.restore an MFIV to OPERABLE status, or to B.1, B.2.1, and B.2.2 Insert 8 Insert 8: B 3.7.3-4 The Condition is modified by two Notes. Note 1 states that RICT is not applicable when the second valve in the affected flow path is intentionally made inoperable. This
Required Action is not intended for voluntary removal of redundant systems or components from service. Note 2 provides constraints for this condition, the applicable
constraints are located in TS section 5.5.20.
ADVs B 3.7.4 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.4-5 REVISION 58 ACTIONS A.1 The condition for this ACTION is modified by a Note that states separate Condition entry is allowed for each SG.
This is acceptable because only one SG is required for RCS
heat removal after a design basis accident, and because
this Condition provides the appropriate Required Action and
Completion Time for one inoperable ADV line on each SG. With one ADV line on a SG inoperable, action must be taken to restore that ADV line to OPERABLE status within 7 days
to meet the LCO for each SG that has entered this
Condition. The 7-day Completion Time takes into
consideration the redundant capability afforded by the
remaining OPERABLE ADV lines, the safety grade MSSVs, and
the non-safety grade backup of the SBCS. B.1 With two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs, action must be taken to
restore one ADV line on each SG to OPERABLE status within 24
hours. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable to repair
inoperable ADV lines, based on the availability of the Steam
Bypass Control System and MSSVs, and the low probability of
an event occurring during this period that requires the ADV
lines. NOTE: Entry into Condition B for all four ADV lines simultaneously inoperable is not intended for voluntary removal of
redundant systems or components from service in lieu of
other alternatives that would not result in redundant
systems or components being inoperable.
Alternately,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTime
Pro g ram.Alternately,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCom pletionTimePro g ram.Insert9 Insert 9: B 3.7.4-5 The Condition is modified by two Notes. Note 1 states that this condition is not
applicable when the last ADV intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The
Required Action is only applicable if two or more ADV lines are found inoperable with both ADV lines inoperable on one or more SGs and the last ADV line is found to be inoperable, or if all ADV lines are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS
AFW System B 3.7.5 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.5-5 REVISION 42 APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE and to function in the event that the MFW System is
lost. In addition, the AFW System is required to supply
enough makeup water to replace steam generator secondary
inventory, lost as the unit cools to MODE 4 conditions. In MODE 4, the AFW System may be used for heat removal via the steam generator. In MODES 5 and 6, the steam generators are not normally used for decay heat removal, and the AFW System is not required. ______________________________________________________________________________ A note prohibits the application of LCO 3.0.4.b to an inoperable AFW Train. There is an increased risk associated
with entering a MODE or other specified condition in the
applicability with an AFW train inoperable and the
provisions of LCO 3.0.4.b which allows entry into a MODE or
other specified condition in the Applicability with the LCO
not met after performance of a risk assessment addressing
inoperable systems and components, should not be applied in
this circumstance.
ACTIONS A.1 If one of the two steam supplies to the turbine driven AFW pumps is inoperable, or if a turbine driven pump is
inoperable while in MODE 3 immediately following refueling (prior to MODE 2), action must be taken to restore OPERABLE
status within 7 days. The 7 day Completion Time is
reasonable based on the following reasons: a. For the inoperability of a steam supply to the turbine-driven AFW pump, the 7 day Completion time is
reasonable since there is a redundant steam supply
line for the turbine driven pump. b. For the inoperability of a turbine-driven AFW pump while in MODE 3 immediately subsequent to a refueling
outage, the 7 day Completion time is reasonable due to
the minimal decay heat levels in this situation. c. For both the inoperability of a steam supply line to the turbine-driven pump and an inoperable turbine-
driven AFW pump while in MODE 3 immediately following
a refueling outage, the 7 day Completion time is
reasonable due to the availability of redundant
OPERABLE motor driven AFW pumps. orinaccordancewiththeRiskInformedCompletionTimeProgram AFW System B 3.7.5 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.5-6 REVISION 63 ACTIONS A.1 (continued) Condition A is modified by a Note which limits the applicability of the Condition to when the unit has not entered MODE 2 following a refueling. Condition A allows
the turbine-driven AFW pump to be inoperable for 7 days vice
the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time in Condition B. This longer
Completion Time is based on the reduced decay heat following
refueling and prior to the reactor being critical. It should be noted that when in this Condition with one steam supply to the turbine driven AFW pump inoperable, that
the AFA train of AFW is considered to be inoperable. B.1 With one of the required AFW trains (pump or flow path) inoperable, action must be taken to restore OPERABLE status
within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This Condition includes the loss of two
steam supply lines to the turbine driven AFW pump. The
72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based on the
redundant capabilities afforded by the AFW System, the time
needed for repairs, and the low probability of a DBA event
occurring during this period. Two AFW pumps and flow paths
remain to supply feedwater to the steam generators.
C.1 and C.2 When either Required Action A.1 or B.1 cannot be completed
within the required Completion Time, or if two AFW trains
are inoperable in MODES 1, 2, and 3, the unit must be placed
in a MODE in which the LCO does not apply.
To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. This Condition includes the loss of 2 AFW pumps. This Condition also includes the situation where one steam supply
to the turbine driven AFW pump is inoperable, coincident
with another ("B" or "N") AFW train inoperable. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full
power conditions in an orderly manner and without challenging
unit systems. orinaccordancewiththeRiskInformed Com pletionTimePro g ramInsert10 D D,B.1,orC.1 Insert 10: B 3.7.5-6 C.1 With two AFW trains inoperable in MODE 1, 2, or 3, the Required Action is to restore at
least one AFW train to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a method of decay heat removal. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one AFW train. Alternately, a Completion
Time can be determined in accordance with the Risk Informed Completion Time
Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second AFW train is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable
if one AFW train is inoperable for any reason and a second AFW train is found to be inoperable, or if two AFW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS
In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required in accordance with the Note that modifies the LCO. Although it is not required, the unit may continue to cool down and start the Shutdown Cooling System.
AFW System B 3.7.5 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.7.5-7 REVISION 63 ACTIONS C.1 and C.2 (continued) In MODE 4, with two AFW trains inoperable, operation is allowed to continue because only one motor driven AFW pump (either the essential or the non-essential pump) is required
in accordance with the Note that modifies the LCO. Although
it is not required, the unit may continue to cool down and
start the SDC. D.1 Required Action D.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended
until one AFW train is restored to OPERABLE status.
Completion Times are also suspended at the time the
conditions is entered. The Completion Time is resumed with
the time remaining when the Condition was entered upon
restoration of one AFW train to OPERABLE status. With all three AFW trains inoperable in MODES 1, 2, and 3, the unit is in a seriously degraded condition with no TS
related means for conducting a cooldown, and only limited
means for conducting a cooldown with nonsafety grade
equipment. In such a condition, the unit should not be
perturbed by any action, including a power change, that
might result in a trip. The seriousness of this condition
requires that action be started immediately to restore one
AFW train to OPERABLE status. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition. E.1 Required Action E.1 is modified by a Note indicating that all required MODE changes or power reductions are suspended
until one AFW train is restored to OPERABLE status.
Completion Times are also suspended at the time the
Condition is entered. The Completion Time is resumed with
the time remaining when the Condition was entered upon
restoration of one AFW train to OPERABLE status.
With one AFW train inoperable, action must be taken to immediately restore the inoperable train to OPERABLE status
or to immediately verify, by administrative means, the
OPERABILITY of a second train. LCO 3.0.3 is not applicable, as it could force the unit into a less safe condition.Includedaslastparagraphinnew"C.1" above.(Insert8)
E E F F AFW System B 3.7.5 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.5-8 REVISION 63 ACTIONS E.1 (continued) In MODE 4, either the reactor coolant pumps or the SDC loops can be used to provide forced circulation as discussed in
LCO 3.4.6, "RCS Loops - MODE 4." _______________________________________________________________________________
SURVEILLANCE SR 3.7.5.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the AFW water and steam supply flow
paths provides assurance that the proper flow paths exist
for AFW operation. This SR does not apply to valves that
are locked, sealed, or otherwise secured in position, since
these valves are verified to be in the correct position
prior to locking, sealing, or securing. This SR also does
not apply to valves that cannot be inadvertently misaligned, such as check valves. This Surveillance does not require
any testing or valve manipulations; rather, it involves
verification that those valves capable of potentially being
mispositioned are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.7.5.2 Verifying that each AFW pump's developed head at the flow test point is greater than or equal to the required
developed head ensures that AFW pump performance has not
degraded during the cycle. Flow and differential head are
normal tests of pump performance required by the ASME OM
Code (Ref. 2). Because it is undesirable to introduce cold
AFW into the steam generators while they are operating, this
testing may be performed on recirculation flow. This test
confirms one point on the pump design curve and can be
indicative of overall performance. Such inservice tests
confirm component OPERABILITY, trend performance, and detect
incipient failures by indicating abnormal performance.
Performance of inservice testing, discussed in the ASME OM
Code, (Ref. 2), at 3 month intervals satisfies this
requirement.
F EW System B 3.7.7 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.7-3 REVISION 1 LCO (continued) not acceptable and would render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable
in this situation because it is operating outside of the
acceptable limits of the system. ______________________________________________________________________________ APPLICABILITY In MODES 1, 2, 3, and 4, the EW System must be prepared to perform its post accident safety functions, primarily RCS
heat removal by cooling the SDC heat exchanger.
When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EW System shall be consistent with the
definition of OPERABILITY which requires (support) equipment
to be capable of performing its related support function(s). ______________________________________________________________________________
ACTIONS A.1 Required Action A.1 is modified by a Note indicating the requirement of entry into the applicable Conditions and
Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," for SDC
made inoperable by EW. This note is only applicable in Mode
- 4. This is an exception to LCO 3.0.6 and ensures the proper
actions are taken for these components.
With one EW train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE EW train is adequate to perform the
heat removal function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based
on the redundant capabilities afforded by the OPERABLE
train, and the low probability of a DBA occurring during
this period.
B.1 and B.2 If the EW train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a
MODE in which the LCO does not apply. To achieve this
status, the unit must be placed in at least MODE 3 within
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. orinaccordancewiththeRiskInformedCompletionTimeProgramInsert11 C C train(s)
Insert 11: B 3.7.7-3 B.1 With two EW trains inoperable, the Required Action is to restore at least one of the
required EW trains to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sink for safety
related components. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion
Time can be determined in accordance with the Risk Informed Completion Time
Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second EW train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from
service. The Required Action is only applicable if one EW train is inoperable for any reason and a second EW train is found to be inoperable, or if two EW trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the
applicable constraints are located in TS section 5.5.20.
EW System B 3.7.7 BASES _______________________________________________________________________________
(continued)
______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.7-4 REVISION 56 ACTIONS B.1 and B.2 (continued)
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions
from full power conditions in an orderly manner and without
challenging unit systems.
_______________________________________________________________________________
SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EW flow path provides assurance
that the proper flow paths exist for EW operation. This SR
does not apply to valves that are locked, sealed, or
otherwise secured in position, since these valves are
verified to be in the correct position prior to locking, sealing, or securing. This SR also does not apply to valves
that cannot be inadvertently misaligned, such as check
valves. This Surveillance does not require any testing or
valve manipulation; rather, it involves verification that
those valves capable of potentially being mispositioned are
in their correct position.
This SR is modified by a Note indicating that the isolation of the EW components or systems renders those components or
systems inoperable but does not necessarily affect the
OPERABILITY of the EW System. Isolation of the EW System to
the Essential Chiller, while rendering the Essential Chiller
inoperable, is acceptable and does not impact the
OPERABILITY of the EW System. Isolation of the EW System to
the SDC system heat exchanger is not acceptable and would
render both the EW System and the SDC system inoperable (Ref. 3). The EW System is inoperable in this situation
because it is operating outside of the acceptable limits of
the system.
The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.
SR 3.7.7.2 This SR verifies proper automatic operation of the EW valves on an actual or simulated actuation signal. This
Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under C
ESPS B 3.7.8 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.8-3 REVISION 1 ACTIONS A.1 With one ESPS train inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining OPERABLE ESPS train is adequate to perform the
heat removal function. However, the overall reliability is
reduced because a single failure in the ESPS train could
result in loss of ESPS function. Required Action A.1 is
modified by two Notes. The first Note indicates that the
applicable Conditions of LCO 3.8.1, "AC Sources - Operating,"
must be entered when the inoperable ESPS train results in an
inoperable emergency diesel generator. The second Note
indicates that the applicable Conditions and Required
Actions of LCO 3.4.6, "RCS Loops - MODE 4," should be entered
if an inoperable ESPS train results in an inoperable SDC
System. This note is only applicable in MODE 4. The
72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the redundant
capabilities afforded by the OPERABLE train, and the low
probability of a DBA occurring during this time period.
B.1 and B.2 If the ESPS train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be
placed in a MODE in which the LCO does not apply. To
achieve this status, the unit must be placed in at least
MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions
from full power conditions in an orderly manner and without
challenging unit systems. ______________________________________________________________________________ SURVEILLANCE SR 3.7.8.1 REQUIREMENTS Verifying the correct alignment for manual and power
operated, valves in the ESPS flow path ensures that the
proper flow paths exist for ESPS operation. This SR does
not apply to valves that are locked, sealed, or otherwise
secured in position, since they are verified to be in the
correct position prior to locking, sealing, or securing.
This SR also does not apply to valves that cannot be
inadvertently misaligned, such as check valves. This orinaccordancewiththeRiskInformedCompletionTimeProgramInsert12 train(s)C C Insert 12: B 3.7.8-3 B.1 With two ESPS trains inoperable, the Required Action is to restore at least one of the required ESPS trains to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sink for safety
related components. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion
Time can be determined in accordance with the Risk Informed Completion Time
Program.
The Condition is modified by two Notes. Note 1 states that this condition is not
applicable when the second ESPS train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from
service. The Required Action is only applicable if one ESPS train is inoperable for any reason and a second ESPS train is found to be inoperable, or if two ESPS trains are
found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS section 5.5.20.
EC System B 3.7.10 BASES ______________________________________________________________________________ (continued) _____________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.7.10-3 REVISION 1 APPLICABILITY (continued) When the plant is in other than MODES 1, 2, 3 or 4, the requirements for the EC System shall be consistent with the
definition of OPERABILITY which requires (support) equipment
to be capable of performing its related support function(s). ______________________________________________________________________________
ACTIONS A.1 If one EC train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this condition, one OPERABLE ECW train is adequate to perform the cooling
function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is reasonable, based
on the low probability of an event occurring during this
time and the 100% capacity OPERABLE EC train. B.1 and B.2 If the EC train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a
MODE in which the LCO does not apply. To achieve this
status, the unit must be placed in at least MODE 3 within
6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed
Completion Times are reasonable, based on operating
experience, to reach the required unit conditions from full
power conditions in an orderly manner and without
challenging unit systems. ______________________________________________________________________________ SURVEILLANCE SR 3.7.10.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the EC flow path provides assurance
that the proper flow paths exist for EC operation. This SR
does not apply to valves that are locked, sealed, or
otherwise secured in position, since they are verified to be
in the correct position prior to locking, sealing, or
securing. This SR also does not apply to valves that cannot
be inadvertently misaligned, such as check valves. This
Surveillance does not require any testing or valve
manipulation; rather, it involves verification that those
valves capable of potentially being mispositioned are in the
correct position.orinaccordancewiththeRiskInformedCompletion TimeProgrameditorialchangeInsert13 train(s)C C Insert 13: B 3.7.10-3 B.1 With two EC trains inoperable, the Required Action is to restore at least one train to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain a heat sink for safety-related air handling systems. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one train. Alternately, a Completion Time can be
determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not
applicable when the second EC train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from
service. The Required Action is only applicable if one EC train is inoperable for any reason and a second EC train is found to be inoperable, or if two EC trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the
applicable constraints are located in TS section 5.5.20.
AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-9 REVISION 63 ACTIONS A.2 (continued) Additionally, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable
time for repairs, and the low probability of a DBA occurring during
this period. A.3 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is
increased, with attendant potential for a challenge to the unit safety systems. In this Condition, however, the remaining OPERABLE
offsite circuit and DGs are adequate to supply electrical power to
the onsite Class 1E Distribution System. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for
repairs, and the low probability of a DBA occurring during this
period. B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite
circuits on a more frequent basis. Since the Required Action only
specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if an offsite circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit
inoperability, additional Conditions and Required Actions must then
be entered. B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of redundant required
features. These features require Class 1E power from PBA-S03 or PBB-S04 ESF buses to be OPERABLE, and are identical to those
specified in ACTION A.2. Mode applicability is as specified in each appropriate TS section. Redundant required feature failures consist
of Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.
AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-12 REVISION 63 ACTIONS B.4 (continued) In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E
Distribution System. The 10 day Completion Time takes into
account the capacity and capability of the remaining AC sources, a
reasonable time for repairs, and the low probability of a DBA
occurring during this period. When utilizing an extended DG Completion Time (a Completion Time greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and less than or equal to 10 days), the
compensatory measures listed below shall be implemented. For planned maintenance utilizing an extended Completion Time, the compensatory measures shall be implemented prior to entering Condition B. For an unplanned entry into an extended Completion
Time, the compensatory measures shall be implemented without delay. 1. The redundant DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified OPERABLE (as required by TS) and no discretionary maintenance activities will be scheduled on the redundant (OPERABLE) DG. 2. No discretionary maintenance activities will be scheduled on the station blackout generators (SBOGs). 3. No discretionary maintenance activities will be scheduled on the startup transformers. 4. No discretionary maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and
transformers which could cause a line outage or challenge
offsite power availability to the unit utilizing the extended DG
Completion Time. 5. All activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled.
Discretionary maintenance within the switchyard that could challenge offsite power supply availability will be evaluated in accordance with 10 CFR 50.65(a)(4) and managed on a graded
approach according to risk significance. 6. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTimeProgram.
AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-13 REVISION 63 ACTIONS B.4 (continued) 7. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.
Additionally, DG outages will not be scheduled when severe
weather conditions and/or unstable grid conditions are
predicted or present. 8. All maintenance activities associated with the unit that is utilizing the extended DG Completion Time will be assessed and
managed per 10 CFR 50.65 (Maintenance Rule). 9. The functionality of the SBOGs will be verified by ensuring that the monthly start test has been successfully completed within
the previous four weeks before entering the extended DG
Completion Time. 10. The OPERABILITY of the steam driven auxiliary feedwater pump will be verified before entering the extended DG
Completion Time. 11. The system dispatcher will be contacted once per day and informed of the DG status, along with the power needs of the
facility. 12. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply
during the extended DG Completion Time, an operator will be
available locally at the SBOG should local operation of the
SBOG be required as a result of on-site weather related
damage. 13. No discretionary maintenance will be allowed on the main and unit auxiliary transformers associated with the unit. If one or more of the above compensatory measures is not met while in the extended completion time, the corrective action program shall be entered, the risk managed in accordance with the Maintenance Rule, and the compensatory measure(s) restored
without delay.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformedCompletionTime
Program.
AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-15 REVISION 64 CORRECTED ACTIONS C.1 and C.2 (continued) Because of the normally high availability of the offsite sources, this level of degradation may appear to be more severe than other combinations of two AC sources inoperable that involve one or more
DGs inoperable. However, two factors tend to decrease the severity of
this level of degradation: a. The configuration of the redundant AC electrical power system that remains available is not susceptible to a single bus or
switching failure; and b. The time required to detect and restore an unavailable offsite power source is generally much less than that required to detect and restore an unavailable onsite AC source. With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the unit in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of
offsite AC sources, a LOCA, and a worst case single failure were
postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to effect
restoration of one of the offsite circuits commensurate with the
importance of maintaining an AC electrical power system capable of
meeting its design criteria. According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources, two less than required by the LCO, operation may
continue for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. If two offsite sources are restored within 24
hours, unrestricted operation may continue. If only one offsite source
is restored within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, power operation continues in accordance
with Condition A.
Condition C applies only when the offsite circuits are unavailable to commence automatic load sequencing in the event of a design basis accident (DBA). In cases where the offsite circuits are available for sequencing, but a DBA could cause actuation of the Degraded Voltage Relays, Condition G applies for Class 1E bus(es) with single stage time delay DVRs and inverse time delay LVRs.
Alternatively,aCompletionTimecanbedeterminedin accordancewiththeRisk InformedCompletionTime
Program.
AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-16 REVISION 63 CORRECTED ACTIONS D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered
with no AC source to a train, the Conditions and Required Actions for LCO 3.8.9, "Distribution Systems - Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train. According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12
hours. In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system.
Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this
Condition may appear higher than that in Condition C (loss of both
required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or
switching failure. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Completion Time takes into account
the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA
occurring during this period. E.1 With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite
electrical power, insufficient standby AC sources are available to
power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level
of degradation, the risk associated with continued operation for a
short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid
instability, which could result in a total loss of AC Alternatively,aCompletionTimecan bedeterminedin accordancewiththe RiskInformed CompletionTime
Program.Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCom pletionTimePro g ram.
AC Sources - Operating B 3.8.1 BASES ______________________________________________________________________ (continued) ______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-17 REVISION 64 CORRECTED ACTIONS E.1 (continued) power). Since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued
operation is severely restricted. The intent here is to avoid the risk
associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation. According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, operation may continue for a period that should not
exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
F.1 and F.2 The sequencer(s) is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated
ESF bus. Therefore, loss of an ESF bus sequencer affects every major ESF system in the load group. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time provides a period of time to correct the problem commensurate with
the importance of maintaining sequencer OPERABILITY. This time period also ensures that the probability of an accident (requiring sequencer OPERABILITY) occurring during periods when the
sequencer is inoperable is minimal. Required Action F.2 is intended
to provide assurance that a single failure of a DG Sequencer will not result in a complete loss of safety function of critical redundant
required features. G.1 and G.2 A Note indicates that Condition G is not applicable for Class 1E bus(es) provided with a two stage time delay for the Degraded Voltage Relays (DVR) and a fixed time delay Loss of Voltage Relays (LVR). The DVRs are being modified to install a two stage time delay design: one short stage time delay for when a SIAS is present and a second long stage time delay when no SIAS is present. The LVRs are being modified to replace the existing mechanical inverse time delay relays with fixed time delay relays. Condition G is not applicable to Class 1E bus DVRs and LVRs that have been modified. The installation of the two stage time delays ensures automatic actuation of the DVRs within the assumptions of the accident analysis should the offsite source post-trip voltage be degraded. Conditions A and C remain applicable to Class 1E buses that have been modified. The more restrictive requirements of Condition G reflect the single stage time delay DVR design not being consistent with the time delay assumptions of the accident analysis.
Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRiskInformed CompletionTimeProgram.Insert14 Alternatively,aCompletionTimecanbedeterminedinaccordancewiththeRisk InformedCompletionTimeProgram.
Insert 14: B 3.8.1-17 The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DG train is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from
service. The Required Action is only applicable if one DG train is inoperable for any reason and a second DG train is found to be inoperable, or if two DG trains are found to be inoperable at the same time. Note 2 provides constraints for this condition, the
applicable constraints are located in TS section 5.5.20.
AC Sources - Operating B 3.8.1 BASES _______________________________________________________________________ (continued) _______________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.1-22 REVISION 41 ACTIONS H.1 and H.2 (continued) If the inoperable AC electrical power sources cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To
achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed
Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. I.1 Condition I corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At
this severely degraded level, any further losses in the AC electrical
power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by
LCO 3.0.3 to commence a controlled shutdown. _______________________________________________________________________ SURVEILLANCE The AC sources are designed to permit inspection and testing REQUIREMENTS of all important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated
accident conditions).
The SR for demonstrating OPERABILITY of the DGs are based on the recommendations of Regulatory Guide 1.9 (Ref. 3), unless otherwise noted in the Updated FSAR Section 1.8.
The DG capabilities (starting and loading) are required to be met from a variety of initial conditions such as DG in standby condition
with the engine hot (SR 3.8.1.15) and DG in standby condition with
the engine at normal keep-warm conditions (SR 3.8.1.2, SR 3.8.1.7 and SR 3.8.1.19). Although it is expected that most DG starts will
be performed from normal keep-warm conditions, DG starts should
be performed with the jacket water cooling and lube oil temperatures within the lower to upper limits of DG OPERABILITY, except as noted above. Rapid cooling of the DG down to normal keep-warm conditions should be minimized. Insert15 I I Insert 15: B 3.8.1-22 H.1 With three or more required AC sources inoperable, the Required Action is to restore the required AC source(s) to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain some level of redundancy in the AC electrical power supplies. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of required AC sources. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the third or a subsequent required AC source is intentionally made inoperable. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if two
required AC sources are inoperable for any reason and additional required AC sources are found to be inoperable, or if three or more required AC sources are found to be
inoperable at the same time. Note 2 provides constraints for this condition, the
applicable constraints are located in TS section 5.5.20.
DC Sources - Operating B 3.8.4 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.8.4-7 REVISION 61 ACTIONS Required Action A.3 limits the restoration time for the (continued) inoperable battery charger to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used. The backup class 1E charger is used to restore OPERABILITY as no balance of plant non-class 1E battery charger exists. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status. B.1 Condition B represents one subsystem with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. This
condition is exclusive of the status of one battery charger.
It is therefore, imperative that the operator's attention
focus on stabilizing the unit, minimizing the potential for
complete loss of DC power to the affected subsystem. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> limit is consistent with the allowed time for an
inoperable DC distribution subsystem.
If one of the required DC electrical power subsystems is
inoperable for reasons other than Condition A, the remaining DC electrical power subsystem has the capacity to support a
safe shutdown and to mitigate an accident condition. Since a
subsequent worst case single failure would, however, result
in the complete loss of the remaining 125 VDC electrical
power subsystem with attendant loss of ESF functions, continued power operation should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The
2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit
status as a function of the inoperable DC electrical power
subsystem and, if the DC electrical power subsystem is not
restored to OPERABLE status, to prepare to effect an orderly
and safe unit shutdown.orinaccordancewiththeRiskInformedCompletionTimeProgram DC Sources - Operating B 3.8.4 BASES _______________________________________________________________________________
(continued)
______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.8.4-8 REVISION 61 ACTIONS C.1 and C.2 (continued)
If the inoperable DC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be
brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5
within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the
required unit conditions from full power conditions in an
orderly manner and without challenging unit systems. The
Completion Time to bring the unit to MODE 5 is consistent
with the time required in Regulatory Guide 1.93 (Ref. 8).
_______________________________________________________________________________
SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge for the batteries helps to ensure the effectiveness of the
battery chargers, which support the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous
charge required to overcome the internal losses of a battery and maintain the battery in a fully charged state while supplying the continuous steady state loads of the associated DC subsystem. On float charge, battery cells will receive adequate current to optimally charge the battery. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the minimum float voltage established by the battery manufacturer (2.17 volts per cell (Vpc) times the number of connected cells or 130.2 V for a 60 cell battery at the battery terminals). This voltage maintains the battery plates in a condition that supports maintaining the grid life. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. SR 3.8.4.2 Deleted SR 3.8.4.3 Deleted SR 3.8.4.4 and SR 3.8.4.5 Deleted Insert16 D D Insert 16: B 3.8.4-8 C.1 With two DC electrical power subsystems inoperable, the Required Action is to restore
at least one DC electrical power subsystem to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain control power for the AC emergency power system. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required DC electrical power subsystem. Alternately, a Completion Time can be
determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second DC electrical power subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one DC electrical power subsystem is inoperable for any reason and a second DC electrical power subsystem is found to be inoperable, or if two DC electrical power subsystem are found to be inoperable at the same time. Note 2 provides constraints for this condition, the applicable constraints are located in TS
Inverters Operating 4 ______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.8.7-4 REVISION 63 BASES _______________________________________________________________________________
ACTIONS A.1 (continued)
Required Action A.1 allows 7 days to fix the inoperable inverter and return it to service. The 7 day limit is a
risk informed Completion Time based on a plant specific risk
analysis, taking into consideration the time required to
repair an inverter and the additional risk to which the unit
is exposed because of the inverter inoperability. This has
to be balanced against the risk of an immediate shutdown, along with the potential challenges to safety systems such a
shutdown might entail. When the AC vital instrument bus is
powered from its constant voltage source, it is relying upon
interruptible AC electrical power sources (offsite and
onsite). The uninterruptible inverter source to the AC
vital instrument buses is the preferred source for powering
instrumentation trip setpoint devices.
Planned inverter maintenance or other activities that require entry into Required Action A.1 will not be
undertaken concurrent with the following:
- a. Planned maintenance on the associated train Diesel Generator (DG): or
- b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.
These actions are taken because it is recognized that with a required inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated DG
following a loss of offsite power event. B.1 and B.2 If the required inoperable devices or components cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO
does not apply. To achieve this status, the unit must be
brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5
within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are
reasonable, based on operating experience, to reach the
required unit conditions from full power conditions in an
orderly manner and without challenging unit systems. basedonacombinationof deterministicdefense-in-depthandsafety margininherentinthe electricaldistribution systemwithrisk insightsfromthe station'sinternal eventsPRAmodel.
Alternatively,aCompletionTimecan bedeterminedin accordancewiththe RiskInformed CompletionTime
Program.Insert17 C CB3.8.7 Insert 17: B 3.8.7-4 B.1 With two or more required inverters inoperable, the Required Action is to restore all but
one required inverter to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to regain AC electrical power to the vital buses. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration of at least one required inverter. Alternately, a
Completion Time can be determined in accordance with the Risk Informed Completion
Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent required inverter is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service. The Required Action is only applicable if one required inverter is inoperable for any reason and additional required inverters are found to be inoperable, or if two or more required
inverters are found to be inoperable at the same time. Note 2 provides constraints for
this condition, the applicable constraints are located in TS section 5.5.20.
Distribution Systems - Operating B 3.8.9 BASES (continued)
_______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.8.9-4 REVISION 63 ACTIONS A.1 With one or more required AC buses, load centers, or motor control centers (see Table B 3.8.9.-1), except AC vital
instrument buses, in one subsystem inoperable, the remaining
AC electrical power distribution subsystem in the other
train is capable of supporting the minimum safety functions
necessary to shut down the reactor and maintain it in a safe
shutdown condition, assuming no single failure. The overall
reliability is reduced, however, because a single failure in
the remaining power distribution subsystems could result in
the minimum required ESF functions not being supported.
Therefore, the required AC buses, load centers and motor
control centers must be restored to OPERABLE status within
8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Condition A worst scenario is one train (PBA or PBB) without AC power (i.e., no offsite power to the train and the
associated DG inoperable). In this condition, the unit is
more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operator's attention be
focused on minimizing the potential for loss of power to the
remaining train by stabilizing the unit, and on restoring
power to the affected train. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> time limit before
requiring a unit shutdown in this condition is acceptable
because of: a. The potential for decreased safety if the unit operator's attention is diverted from the evaluations
and actions necessary to restore power to the affected
train, to the actions associated with taking the unit
to shutdown within this time limit; and b. The potential for an event in conjunction with a single failure of a redundant component in the train
with AC power. B.1 With AC vital instrument bus(es) (Channels A or C, or Channels B or D) (see Table B 3.8.9-1) in one train
inoperable, the remaining OPERABLE AC vital bus electrical
power distribution subsystem is capable of supporting the
minimum safety functions necessary to shut down the unit
and maintain it in the safe shutdown condition. OverallorinaccordancewiththeRiskInformed CompletionTime
Program Distribution Systems - Operating B 3.8.9 BASES ______________________________________________________________________________ (continued) ______________________________________________________________________________ PALO VERDE UNITS 1,2,3 B 3.8.9-5 REVISION 63 ACTIONS B.1 (continued) reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions
not being supported. Therefore, the required AC vital
instrument buses must be restored to OPERABLE status within
2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> by powering the bus from the associated inverter via
inverted DC voltage or the Class 1E constant voltage
regulator. Condition B represents one train without adequate AC vital instrument bus power; potentially both the DC source and the
associated AC source are nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss
of all noninterruptible power. It is, therefore, imperative
that the operator's attention focus on stabilizing the unit, minimizing the potential for loss of OPERABILITY to the
remaining vital instrument buses, and restoring power to the
affected electrical power distribution subsystem.
This 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> limit is more conservative than Completion Times allowed for the vast majority of components that are without
adequate AC vital instrument power. Taking exception to
LCO 3.0.2 for components without adequate AC vital
instrument power, which would have the Required Action
Completion Times shorter than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> if declared
inoperable, is acceptable because of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)
and not allowing stable operations to continue; b. The potential for decreased safety by requiring entry into numerous Applicable Conditions and Required
Actions for components without adequate AC vital
instrument power and not providing sufficient time for
the operators to perform the necessary evaluations and
actions for restoring power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component.
The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time takes into account the importance to safety of restoring the AC vital instrument bus to
OPERABLE status, the redundant capability afforded by the
other OPERABLE vital instrument buses, and the low
probability of a DBA occurring during this period.
Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime
Program.
Distribution Systems - Operating B 3.8.9 BASES _______________________________________________________________________________
(continued)
_______________________________________________________________________________
PALO VERDE UNITS 1,2,3 B 3.8.9-6 REVISION 63 ACTIONS C.1 With DC bus(es) in one train (see Table B 3.8.9-1) inoperable, the remaining DC electrical power distribution
subsystem is capable of supporting the minimum safety
functions necessary to shut down the reactor and maintain it
in a safe shutdown condition, assuming no single failure.
The overall reliability is reduced, however, because a
single failure in the remaining DC electrical power
distribution subsystem could result in the minimum required
ESF functions not being supported. Therefore, the required
DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />
by powering the bus from the associated battery or battery
charger. Condition C represents one train without adequate DC power; potentially both with the battery significantly degraded and
the associated charger nonfunctioning. In this situation, the unit is significantly more vulnerable to a complete loss
of all DC power. It is, therefore, imperative that the
operator's attention focus on stabilizing the unit, minimizing the potential for loss of power to the remaining
DC buses and restoring power to the affected DC electrical
power distribution subsystem.
This 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> limit is more conservative than Completion Times allowed for the vast majority of components which would be
without power. Taking exception to LCO 3.0.2 for components
without adequate DC power, which would have Required Action
Completion Times shorter than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, is acceptable because
of: a. The potential for decreased safety by requiring a change in unit conditions (i.e., requiring a shutdown)
while allowing stable operations to continue; b. The potential for decreased safety by requiring entry into numerous applicable Conditions and Required
Actions for components without DC power and not
providing sufficient time for the operators to perform
the necessary evaluations and actions for restoring
power to the affected train; and c. The potential for an event in conjunction with a single failure of a redundant component. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).
Alternatively,aCompletionTime canbedetermined inaccordancewith theRiskInformed CompletionTime
Program.
Distribution Systems - Operating B 3.8.9 BASES ______________________________________________________________________________ ______________________________________________________________________________ (continued) PALO VERDE UNITS 1,2,3 B 3.8.9-7 REVISION 63 ACTIONS D.1 and D.2 (continued) If the inoperable distribution subsystem cannot be restored to OPERABLE status within the required Completion Time, the
unit must be brought to a MODE in which the LCO does not
apply. To achieve this status, the unit must be brought to
at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within
36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required unit
conditions from full power conditions in an orderly manner
and without challenging unit systems. E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety
function to be lost. When more than one Condition is
entered, and this results in the loss of a required safety
function, the plant is in a condition outside the accident
analysis. Therefore, no additional time is justified for
continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown. ______________________________________________________________________________ SURVEILLANCE SR 3.8.9.1 REQUIREMENTS This Surveillance verifies that the AC, DC, and AC vital instrument bus electrical power distribution systems are
functioning properly, with the required circuit breakers
closed and the buses energized. The correct breaker
alignment ensures the appropriate separation and
independence of the electrical divisions is maintained, and
the appropriate voltage is available to each required bus.
The verification of proper voltage availability on the buses
ensures that the required voltage is readily available for
motive as well as control functions for critical system
loads connected to these buses. The Surveillance Frequency
is controlled under the Surveillance Frequency Control
Program. Insert18 E E Insert 18: B 3.8.9-7 D.1 With two or more electrical power distribution subsystems inoperable, the Required Action is to restore electrical power distribution subsystem(s) to OPERABLE status
within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration. Alternately, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.
The Condition is modified by two Notes. Note 1 states that this condition is not applicable when the second or a subsequent electrical power distribution subsystem is intentionally made inoperable resulting in a loss of safety function. This Required Action is not intended for voluntary removal of redundant systems or components from service.
The Required Action is only applicable if one electrical power distribution subsystem is inoperable for any reason and a second electrical power distribution subsystem is found to be inoperable, or if two or more electrical power distribution subsystems are found to be inoperable at the same time. Note 2 provides constraints for this condition, the
applicable constraints are located in TS section 5.5.20.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 4 License Conditions and Regulatory Commitment Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 4 4-1 License Conditions and Regulatory Commitment License Conditions APS proposes the following change to the license conditions:
- 1. Plant procedures needed to implement the risk-informed completion time (RICT) program shall be in place before a RICT is used.
- 2. The risk assessment approach and methods, shall be acceptable to the NRC, be based on the as-built, as-operated, and maintained plant, and reflect the operating experience of the plant as specified in RG 1.200. Methods to assess the risk from extending the completion times must be PRA methods accepted as part of this license amendment, or other methods approved by the NRC. If the licensee wishes to use a newly developed method, and the change is outside the bounds of this license condition, the licensee will seek prior NRC approval, via a license amendment.
Additionally, APS requests that license conditions implemented by license amendment numbers 171 and 200 be deleted because these conditions are no longer applicable.
Regulatory Commitment
The commitment contained in this Attachment 4 supersedes the commitments provided in the original LAR (ADAMS Accession Number ML15218A300).
- 1. APS will resolve the eight not closed finding level facts and observations (F&O) listed in Attachment 6 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (ADAMS Accession Number ML17079A427). The not closed finding level F&O will be closed prior to utilizing the PRA models for use in the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 5
List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-1 List of Revised Required Actions to Corresponding Probabilistic Risk Assessment (PRA) Functions Section 4.0, item 2 of the NRC final safety evaluation (reference 1 of this attachment) for NEI 06-09, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 2 of this attachment) identifies the following needed content:
- The license amendment request (LAR) will provide identification of the technical specifications TS limiting conditions of operation (LCO) and action requirements to which the RMTS will apply.
- The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSC) subject to those LCO actions.
- The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions [i.e., 50.46 emergency core cooling system (ECCS) flow rates] for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.
This attachment provides confirmation that the Palo Verde Nuclear Generating Station (PVNGS) PRA models include the necessary scope of SSCs and their functions to address each proposed application of the risk-informed completion times (RICT) program to the proposed scope TS LCO conditions, and provides the information requested for Section 4.0, item 2 of the NRC final safety evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program. The PVNGS PRA model has the capability to model directly or through use of a bounding surrogate the risk impact of entering each of the TS LCOs in the scope of the RICT Program.
Table A5-1, In Scope TS/LCO Conditions to Corresponding PRA Functions, lists each TS LCO Condition to which the RICT program is proposed to be applied, and documents the following information regarding the TS with the associated safety analyses, the analogous PRA functions, and the re sults of the comparison:
- Column "TS LCO/Condition": Lists all of the LCOs and condition statements within the scope of the submittal.
- Column "SSCs Modeled in PRA": Indicates whether the SSCs addressed by the TS LCO/conditions are included in the PRA.
- Column "Function Covered by TS LCO/Condition": Contains a summary of the required functions from the design basis analyses.
- Column "Design Success Criteria": Lists a summary of the success criteria from the design basis analyses.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-2
- Column "Disposition": Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A.
The corresponding SSCs for each TS LCO and th e associated TS functi ons are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT program. Differences in success criteria typically arise due to the requirement in the PRA standard to make PRAs realistic rather than overly conservative, whereas design ba sis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to Capability Category II of the PRA standard as required by NEI 06-09-A.
Examples of calculated RICTs are provided for each individual condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable) in this Attachment under Table A5-2, Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate. Actual RICT values will be calculated based on the actual plant configuration using a current revision of the PRA model which represents the as-built/as-operated condition of the plant, as required by NEI 06-09-A and the NRC final safety evaluation, and may differ from the RICTs presented.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-3 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.3.6 ESFAS Logic and Manual Trip
Condition B - One or more Functions with one Manual Trip or Initiation Logic channel inoperable.
4 Manual Trip Channels
4 Initiating Logic Channels
Yes Yes Initiate safety systems to protect against violating core design limits and RCS pressure boundary, and to mitigate accidents. 2 of 4 channels
2 of 4 channels Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
3.3.6 ESFAS
Logic and Manual Trip
Condition D - One or more Functions with one Actuation Logic channel inoperable.
2 Actuation Logic Channels
Yes
Initiate safety systems to protect against violating core design limits and RCS pressure boundary, and to mitigate accidents. 1 of 2 channels
Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
3.4.10 Pressurizer Safety Valves
Condition A - One pressurizer safety valve inoperable.
4 Pressurizer Safety Valves Yes Prevent RCS pressure from exceeding safety limit. 4 of 4 Pressurizer Safety Valves 4 of 4 Pressurizer Safety Valves (PSV) for limiting anticipated transient without scram (ATWS); 1 of 4 PSVs for non ATWS scenarios SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
3.4.12 Pressurizer Vents
Condition A - Two or three required pressurizer vent paths inoperable. 4 Pressurizer Vent Paths Yes Depressurize the RCS during a steam generator tube rupture (SGTR) with loss of offsite power (LOP). 1 of 4 Pressurizer Vent Paths Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.4.12 Pressurizer Vents
Condition B - All pressurizer vent paths inoperable. See LCO Condition 3.4.12.A
3.5.1 SITs
Condition C - Two or more SITs inoperable for reasons other than Condition A. 4 Safety Injection Tanks (SITs) Yes Emergency core cooling system (ECCS) injection during a large loss-of-coolant accident (LOCA). 3 of 4 SITs 2 of 3 intact cold legs (assumed one SIT lost out break) for large LOCA; 4 of 4 SITs for small LOCA during a failure of both HPSI trains SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
Two SITs are required to inject borated water into the RCS for large LOCAs. The UFSAR requirement of 3 SITs is based on the extremely conservative 10CFR50 App. K analysis criteria. Best estimate analysis in WCAP-15701 [see Table 6.1-6] (Reference 3 of this Attachment) by Combustion Engineering has shown that 1 SIT with either one train of HPSI or LPSI is adequate to cool/reflood the core. The requirement for 2 is used, because HPSI is not credited for large LOCAs in the PRA model.
Note that for small LOCAs with failure of both high pressure safety Injection (HPSI) trains, the PRA credits operator manual depressurization and requires 4 of 4 SITs to inject. This scenario is beyond design basis due to failure of both HPSI trains, which is assumed to be available in the design basis small LOCA scenarios.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-4 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.5.3 ECCS Operating
Condition A - One LPSI subsystem inoperable. 2 Low Pressure Safety Injection (LPSI) subsystems (Train A and Train B)
Associated flowpaths (piping, valves, instruments and controls) Yes The Emergency Core Cooling System (comprised of the LPSI and HPSI subsystems) provides core cooling and negative reactivity to ensure the reactor core is protected after design basis accidents during both phases of ECCS Operation (injection and recirculation).
1 of 2 LPSI subsystems
Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.5.3 ECCS Operating
Condition B - One or more trains inoperable for reasons other than Condition A.
A ND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available. 2 High Pressure Safety Injection (HPSI) trains (Train A and Train B)
2 Low Pressure Safety Injection (LPSI) trains (Train A and Train B)
Associated flowpaths (piping, valves, instruments and controls) Yes The Emergency Core Cooling System (comprised of the LPSI and HPSI subsystems) provides core cooling and negative reactivity to ensure the reactor core is protected after design basis accidents during both phases of ECCS Operation (injection and recirculation).
1 of 2 HPSI trains
1 of 2 ECCS trains (HPSI and LPSI)
Same
Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.5.5 Refueling Water Tank (RWT)
Condition B - RWT inoperable for reasons other than Condition A. RWT Yes Supply borated water to ECCS and CS system during LOCA injection phase for:
(a) containment cooling and depressurization
(b) core cooling and replacement inventory
(c) negative reactivity for reactor shutdown 1 of 1 RWT Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.6.2 Containment Air Locks
Condition C - One or more containment air locks inoperable for reasons other than Condition A or B. 2 air locks (personnel and emergency), each with interlock mechanisms No Airlock leakage within limits. 2 of 2 air locks isolable Not modeled SSCs for the containment air locks can be evaluated by a bounding assessment as permitted by NEI 06-09-A. In this case containment is conservatively considered failed and LERF is set to the base CDF value.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-5 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.6.3 Containment Isolation Valves
Condition A - One or more penetration flow paths with one required containment isolation valve inoperable except for purge valve leakage not within limit. 2 containment isolation valves on each penetration Yes Each containment penetration isolated within the limits assumed in the safety analysis. 1 of 2 containment isolation valves or isolation devices per penetration 1 of 2 containment isolation valves per penetration for:
containment purge; radwaste drain; charging; letdown; reactor drain tank (RDT) discharge; RDT Makeup; RDT vent; nitrogen supply; instrument air and reactor coolant pump (RCP) seal bleedoff
The PRA does not explicitly model the impact of excessive stroke time. This condition can be addressed for the RICT Program by removing the inoperable containment isolation valve from service if it is open.
Therefore, this LCO condition can be evaluated using the CRMP tool model.
Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.
The success criteria in the PRA are consistent with the design basis criteria. 3.6.3 Containment Isolation Valves
Condition B - One or more penetration flow paths with two required containment isolation valves inoperable except for purge valve leakage not within limit. See LCO Condition 3.6.3.A
3.6.3 Containment
Isolation Valves
Condition C - One or more penetration flow paths with one required containment isolation valve inoperable. 1 containment isolation valve on each penetration line with a closed system Yes Each containment penetration isolated within the limits assumed in the safety analysis. Redundant function also performed by closed system inside containment. 1 of 2 containment isolation barriers per penetration Same The PRA does not explicitly model the impact of excessive stroke time.
Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-6 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.6.3 Containment Isolation Valves
Condition D - One or more penetration flow paths with one or more containment purge valves not within leakage limits. 4 containment purge penetrations (56, 57, 78 and 79), each with 2 valves in series. Two penetrations are 8 inch diameter and two penetrations are 42 inch diameter.
Blind Flange can be used as an alternate containment isolation device for penetrations 56 and 57 per TS 3.6.3 note 5. Yes Purge valve and blind flange leakage rates within limits for each penetration. 1 of 2 purge valves per penetration within purge valve leakage limit.
Blind flange within purge valve leakage limits when the blind flange is used in place of purge valve. Same Any individual penetrations not explicitly modeled in the PRA have been evaluated to be less than the 1.27" diameter effective LERF threshold for PVNGS. Multiple open penetrations can be modeled by failing a surrogate penetration found in the PRA model.
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.6.6 Containment Spray (CS)
System
Condition A - One containment spray train inoperable. 2 CS trains Yes Containment atmosphere cooling to limit post-accident pressure and temperature.
Iodine removal to reduce the release of fission product radioactivity from containment to the environment. 1 of 2 CS trains
Same
CS is credited in PRA for containment heat removal. However, iodine removal is not a mitigating function to prevent core damage or large early release.
The success criteria in the PRA are consistent with the design basis criteria. 3.7.2 Main Steam Isolation Valves (MSIVs)
Condition F - One MSIV inoperable in MODE 1. 4 MSIVs Yes Isolate steam flow from the secondary side of the steam generators following a high energy line break (HELB). 1 of 4 MSIVs fail to close Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
3.7.2 MSIVs
Condition G - Two or more MSIVs inoperable in MODE 1. See LCO Condition 3.7.2.A
3.7.3 Main Feedwater Isolation Valves (MFIVs)
Condition A - One or more MFIVs inoperable. 4 economizer MFIVs and 4 downcomer MFIVs. There are a total of 8 MFIVs, with 2 redundant MFIVs on each of the 4 piping segments. No Isolate Main Feedwater (MFW) flow to the secondary side of the steam generators following a High Energy Line Break (HELB). 1 of 4 MFIVs fail to close Not modeled The PRA models the failure of the two downcomer paths (each path with 2 MFIVs) to provide sufficient flow of feedwater to the steam generators.
The closure of the MFIVs to prevent Containment failure or RCS overcooling is not explicitly modeled in the current PRA due to the redundancy of the MFIVs and low likelihood of the applicable initiating events. However, to address this condition for a RICT, the PRA will be adjusted to explicitly model the risk significance of a MFIV failure to close on Containment integrity and RCS overcooling. Failure of both MFIVs to close for the affected initiating events will be assumed to result in core damage and Containment failure. 3.7.3 MFIVs
Condition B - Two valves in the same flow path inoperable. See LCO Condition 3.7.3.A Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-7 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.7.4 Atmospheric Dump Valves (ADVs)
Condition A - One required ADV line inoperable. 4 ADV lines (two per SG, each with ADV and block valve) Yes Cool unit to Shutdown Cooling (SDC) entry conditions.
1 of 4 ADVs Same except for rapid depressurization of RCS to SDC conditions, then 2 of 4 ADVs The success criteria in the PRA is consistent with the design basis criteria, and more conservative for mitigation of rapid depressurization of RCS to SDC conditions scenarios.
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
3.7.4 ADVs
Condition B - Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs. See LCO Condition 3.7.4.A
3.7.5 Auxiliary
System
Condition A - One steam supply to turbine driven AFW pump inoperable. 2 steam lines with associated supply valves for the turbine driven AFW pump Yes Provide steam to turbine-driven AFW pump. 1 of 2 steam lines Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.7.5 AFW System
Condition B - One AFW train inoperable for reasons other than Condition A. 1 safety related (SR) motor-driven train 1SR turbine-driven train 1 non SR motor driven train
Associated flow paths (piping, valves, instruments and controls) Yes Supply feedwater to the SGs to remove RCS decay heat. 1 SR motor-driven train or 1 SR turbine-driven train 1 of 3 trains (1 SR motor-driven train, 1 SR turbine-driven train, or 1 non SR motor driven train)
The operability of the non-safety related (SR) motor driven AFW pump is important from a risk perspective; this pump is not credited in the PVNGS Accident Analyses. The difference between the Design Success Criteria and PRA Success Criteria is due to the design basis being highly conservative whereas the PRA is realistic.
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
3.7.5 AFW System
Condition C - Two AFW trains inoperable. See LCO Condition 3.7.5.A and 3.7.5.B
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-8 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.7.7 Essential Cooling Water (EW)
System
Condition A - One EW train inoperable. 2 trains, each with 1 pump, 1 surge tank , 1 heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. 1 of 2 trains Same The PRA also credits EW to Nuclear Cooling as a backup for cooling RCP seals.
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.7.7 Essential Cooling Water (EW)
System
Condition B - Two EW trains inoperable. See LCO Condition 3.7.7.A
3.7.8 Essential
Spray Pond System
Condition A - One ESPS train inoperable. 2 trains, each with 1 pump, 1 EW heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat sink for removal of process and operating heat from the EW system. 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.7.8 Essential Spray Pond System
Condition B - Two ESPS trains inoperable. See LCO Condition 3.7.8.A
3.7.10 Essential Chilled Water System
Condition A - One EC train inoperable. 2 trains, each with 1 pump, 1 surge tank , 1 heat exchanger and associated flow paths (piping, valves, instruments and controls) Yes Heat transfer system to the Ultimate Heat Sink for the removal of process and operating heat from selected safety related air handling systems during a Design Basis Accident (DBA) or transient. 1 of 2 trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.7.10 Essential Chilled Water System
Condition B - Two EC trains inoperable. See LCO Condition 3.7.10.A
3.8.1 AC Sources - Operating
Condition A - One required offsite circuit inoperable. 2 offsite circuits, each with breakers, transformers, switches, interrupting devices, cabling and controls Yes Supply power from the transmission network to the 4.16 kV Class 1E buses. 1 of 2 offsite circuits Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
3.8.1 AC Sources - Operating
Condition B - One Diesel Generator (DG) inoperable. 2 diesel generators (DGs) Yes Upon loss of preferred power, supply the ESF loads in sufficient time to mitigate the consequences of a DBA. 1 of 2 DG Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
Two Station Blackout Generators (SBOG) are also credited in the PRA model.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-9 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.8.1 AC Sources - Operating
Condition C - Two required offsite circuits inoperable. See LCO Condition 3.8.1.A
3.8.1 AC Sources - Operating
Condition D - One required offsite circuit inoperable.
A ND One DG inoperable. See LCO Condition 3.8.1.A and 3.8.1.B
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
Two Station Blackout Generators (SBOG) are also credited in the PRA model. 3.8.1 AC Sources - Operating
Condition E - Two DGs inoperable. See LCO Condition 3.8.1.B
3.8.1 AC Sources - Operating
Condition F - One automatic load sequencer inoperable. 2 automatic load sequencers Yes Return loads to service within time limits after initiating signal, in predetermined sequence to prevent over-loading the power source by automatic load application. 1 of 2 automatic load sequencers Same
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
3.8.1 AC Sources - Operating
Condition H - Three or more required AC sources inoperable. See LCO Condition 3.8.1.A and 3.8.1.B
SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
Two Station Blackout Generators (SBOG) are also credited in the PRA model. 3.8.4 DC Sources - Operating
Condition A - One battery charger on one subsystem inoperable. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 DC batteries, a battery charger for each battery, associated control equipment and interconnecting cabling Yes Provide control power to AC emergency power system, motive and control power to selected safety related equipment and preferred AC vital instrument bus power (via inverters). 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.8.4 DC Sources - Operating
Condition B - One DC electrical power subsystem inoperable for reasons other than Condition A. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 DC batteries, a battery charger for each battery, associated control equipment and interconnecting cabling Yes Provide control power to AC emergency power system, motive and control power to selected safety related equipment and preferred AC vital instrument bus power (via inverters). 1 of 2 electrical power subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-10 Table A5-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO / Condition SSCs Covered by TS LCO/
Condition SSCs Modeled in PRA Function Covered by TS LCO/Condition Design Success Criteria PRA Success CriteriaDisposition 3.8.4 DC Sources - Operating
Condition C - Two DC electrical power subsystems inoperable. 2 Class 1E DC electrical power subsystems (Train A and Train B), each with 2 channels per subsystems See LCO Condition 3.8.4.A and 3.8.4.B
3.8.7 Inverters
- Operating
Condition A - One required inverter inoperable.
2 Inverters per Train (A and B) Yes Provide the preferred source of power for the AC vital buses. This is an uninterruptible power for the instrumentation and controls of the reactor protection system (RPS) and ESFAS. 1 of 2 inverter trains Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.8.7 Inverters - Operating
Condition B - Two or more required inverters inoperable. 2 inverters per Train (A and B), each with 2 channels per train
See LCO Condition 3.8.7.A
3.8.9 Distribution
Systems -
Operating
Condition A - One AC electrical power distribution subsystem inoperable. 2 subsystems [4.16 kV Engineered Safety Feature (ESF) buses, secondary AC electrical power distribution panels, load centers and motor control centers] Yes Provide necessary power to ESF systems. 1 of 2 AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -
Operating
Condition B - One AC vital instrument bus electrical power distribution subsystem inoperable. 2 subsystems (Train A and Train B), each with 2 channels per subsystems Yes Provide necessary power to ESF systems. 1 of 2 vital AC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -
Operating
Condition C - One DC electrical power distribution subsystems inoperable. 2 subsystems (Train A and Train B), each with 2 channels per subsystems Yes Provide necessary power to ESF systems. 1 of 2 vital DC subsystems Same SSCs are modeled consistent with the TS scope and so can be directly evaluated using the CRMP tool model.
The success criteria in the PRA are consistent with the design basis criteria. 3.8.9 Distribution Systems -
Operating
Condition D - Two or more electrical power subsystems inoperable. See LCO Condition 3.8.9.A through 3.8.9.C
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-11 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -
Low Estimate 1 RICT Calculated -
High Estimate 1 Loss of Function (Yes/No/Maybe) 3.3.6 ESFAS Logic and Manual Trip Condition B - One or more Functions with one
Manual Trip or Initiation
Logic channel
inoperable. 30 day backstop 10 30 day backstop No Condition D - One or more Functions with one
Actuation Logic channel
2 days8,9,11 30 day backstop No 3.4.10 Pressurizer Safety Valves Condition A - One pressurizer safety valve
inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.4.12 Pressurizer Vents Condition A - Two or three required
pressurizer vent paths
inoperable. 30 day backstop 30 day backstop No Condition B - All pressurizer vent paths inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.5.1 SITs Condition C - Two or more SITs inoperable for
reasons other than Condition A. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.5.3 ECCS Operating Condition A - One LPSI subsystem inoperable. 30 day backstop 30 day backstop No Condition B - One or more trains inoperable for reasons other than Condition A.
AND At least 100% of the ECCS flow equivalent to
a single OPERABLE ECCS train available. 27 days 30 day backstop No 3.5.5 RWT Condition B - RWT inoperable for reasons other than Condition A. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.6.2 Containment Air Locks Condition C - One or more containment air locks inoperable for reasons other than Condition A or B.
9 days 9 30 day backstop No Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-12 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -
Low Estimate 1 RICT Calculated -
High Estimate 1 Loss of Function (Yes/No/Maybe) 3.6.3 Containment Isolation Valves Condition A - One or more penetration flow paths with one required containment isolation valve inoperable except for purge valve leakage not within limit.
10 days 9 30 day backstop No Condition B - One or more penetration flow paths with two required containment isolation valves inoperable except
for purge valve leakage not within limit. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 Condition C - One or more penetration flow paths with one required containment isolation valve inoperable.
9 days 9 30 day backstop No Condition D - One or more penetration flow paths with one or more containment purge valves not within leakage limits. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 9 days 9 Maybe 12 3.6.6 Containment Spray System Condition A - One containment spray train
inoperable. 30 day backstop 30 day backstop No 3.7.2 MSIVs Condition F - One MSIV inoperable in MODE 1. 30 day backstop 30 day backstop No Condition G - Two or more MSIVs inoperable in MODE 1. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.7.3 MFIVs Condition A - One or more MFIVs inoperable.
9 days 9 9 days 9 No Condition B - Two valves in the same flow
path inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.7.4 ADVs Condition A - One required ADV line
inoperable. 30 day backstop 30 day backstop No Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-13 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -
Low Estimate 1 RICT Calculated -
High Estimate 1 Loss of Function (Yes/No/Maybe) Condition B - Two or more ADV lines inoperable with both ADV lines inoperable on
one or more SGs. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 30 day backstop Maybe 3 3.7.5 AFW System Condition A - One steam supply to turbine driven AFW pump
inoperable. 30 day backstop 30 day backstop No Condition B - One AFW train inoperable for
reasons other than Condition A. 23 days 30 day backstop No Condition C - Two AFW trains inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 2 days Maybe 13 3.7.7 Essential Cooling Water (EW) System Condition A - One EW train inoperable. 30 day backstop 30 day backstop No Condition B - Two EW trains inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.7.8 Essential Spray Pond System Condition A - One ESPS train inoperable. 30 day backstop 30 day backstop No Condition B - Two ESPS trains inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.7.10 Essential Chilled Water System Condition A - One EC train inoperable. 30 day backstop 30 day backstop No Condition B - Two EC trains inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.8.1 AC Sources -
Operating Condition A - One required offsite circuit
inoperable. 30 day backstop 30 day backstop No Condition B - One Diesel Generator (DG)
inoperable. 30 day backstop 30 day backstop No Condition C - Two required offsite circuits
inoperable. 30 day backstop 30 day backstop No Condition D - One required offsite circuit
inoperable AND one DG inoperable. 30 day backstop 30 day backstop No Condition E - Two DGs inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-14 Table A5-2: Units 1/2/3 In Scope TS/LCO Conditions RICT Estimate TS LCO Condition RICT Calculated -
Low Estimate 1 RICT Calculated -
High Estimate 1 Loss of Function (Yes/No/Maybe) Condition F - One automatic load sequencer inoperable. 19 days 30 day backstop No Condition H - Three or more required AC sources inoperable.
11 hrs 5 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2 3.8.4 DC Sources -
Operating Condition A - One battery charger on one subsystem inoperable. 30 day backstop 30 day backstop No Condition B - One DC electrical power subsystem inoperable
for reasons other than Condition A. 3 days 6 days No Condition C - Two DC electrical power subsystems inoperable.
less than 1 hr 6 less than 1 hr 6 Yes 2 3.8.7 Inverters -
Operating Condition A - One required inverter
inoperable. 30 day backstop 30 day backstop No Condition B - Two or more required inverters
inoperable. 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop 30 day backstop Maybe 4 3.8.9 Distribution Systems - Operating Condition A - One AC electrical power distribution subsystem
inoperable. 6 days 22 days 9 No Condition B - One AC vital instrument bus electrical power distribution subsystem
inoperable. 30 day backstop 30 day backstop No Condition C - One DC electrical power distribution subsystems
inoperable. 3 days 6 days No Condition D - Two or more electrical power subsystems inoperable.
less than 1 hr 7 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop Yes 2
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-15 Notes: 1. RICTs are based on the internal events, internal flood, internal fire and seismic PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A. RICTs are rounded to nearest number of days for illustrative purposes.
- 2. This is considered a loss of specified safety function. Use of a RICT is permitted for emergent conditions which represent a loss of a specified safety function or inoperability of all required trains of a system required to be OPERABLE if one or more of the trains are considered "PRA functional" as defined in section 2.3.1 of NEI 06-09-A. The RICT for these loss of function conditions may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- 3. This is considered a loss of specified safety function only if all four ADVs are inoperable. Therefore if all four ADVs are inoperable then the RICT for this loss of function conditions may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- 4. If two inverters on the same train remain operable, there is NOT a loss of safety function. However, when there is a loss of safety function the RICT for a loss of function condition may not exceed 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
- 5. This was evaluated with both Diesel Generators and sour ces of offsite power being impacted to account for the "or more" condition of the LCO.
- 6. This was evaluated with both Class 1E DC electrical power subsystems [Train A and Train B - (all four channels)] being impacted.
- 7. This was evaluated with all AC Safety, DC and AC vital instrument buses being impacted to account for the "or more" condition of the LCO.
- 8. This was evaluated with all Train A engin eered safety features actuation system (ESFAS) signals being impacted to account for the "or more" condition with one Actuation Logic channel of the LCO and thus is a bounding value.
- 10. The ESFAS is made up of 4 quality class input channels, 6 channels of Matrix Logic, 4 channels of Initiation Logic, 2 channels of Actuation Logic, and 4 channels of Manual Trip for 7 Functions; Safety Injection Actuation Signal (SIAS), Containment Isolation Actuation Signal (CIAS), Recirculation Actuation Signal (RAS), Containment Spray Actuation Signal (CSAS), Main Steam Isolation Signal (MSIS), Auxiliary Feedwater Actuation Signal to SG-1 (AFAS-1), and Auxiliary Feedwater Actuation Signal to SG-2 (AFAS-2). This was evaluated with both trains of SIAS, CIAS, CSAS, AFAS, MSIS, and RAS being impacted (increased failure probabilities) to account for the "or more" condition of the LCO.
- 11. For one actuation logic channel inoperable, the initiated equipment for one train of SIAS, CIAS, CSAS, or MSIS are assumed failed, and the initiation relay for one train of AFAS and RAS is failed.
- 12. This is considered a loss of function condition if more than one purge valve is inoperable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 5 5-16 13. This is considered a loss of function condition when two class (i.e. safety related)
AFW pumps are inoperable. If one of the two AFW trains that is inoperable is the non-class AFW pump, it would not be a loss of function.
References:
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No. ML071200238) dated May 17, 2007
- 2. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)
- 3. WCAP-15701, Determination of Realistic LOCA Success Criteria and Selected LOCA Based HRAs for PSA Applications, Revision 0, dated June 2002
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 6 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-1 Information Supporting Consistency with Regulatory Guide 1.200, Revision 2 Introduction NEI 06-09, Revision 0 - A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, (reference 1 of this attachment), section 2.3.4 states that the probabilistic risk assessment (PRA) shall be reviewed to the guidance of regulatory guide (RG) 1.200, Revision 2 (reference 2 of this attachment), for a PRA which meets Capability Category II for the supporting requirements (SRs) of the internal events at power PRA st andard, and that deviations from these capability standards shall be justified and documented. APS has performed its review of the PRA to the guidance in RG 1.200, Revision 2. Section 4.0, item 3 of the NRC final safety evaluation (reference 3 of this attachment), for NEI 06-09-A requires the license amendment request (LAR) to include a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RMTS, including the resolution or disposition of any identified deficiencies (i.e., findings and observations from peer reviews). The scope of this information includes the internal events PRA model, and other models for which additional standards have been endorsed by a revision to RG 1.200.
The following sections demonstrate that the quality and level of detail of the processes used in the risk-informed completion times (RIC Ts) are adequate. The PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed. The PRA models described within this LAR are the same as those described within the APS submittal of the LAR dated July 31, 2015, to revise the PVNGS TS to allow RICT (reference 29 of this attachment), with routine maintenance updates applied. Changes and plant modifications previously identified in reference 29 that were required to achieve an overall core damage frequency (CDF) and large early release frequency (LERF) consistent with NRC RG 1.174 (reference 31 of this attachment) have been completed.
Internal Events and Internal Flooding PRA The PVNGS RICT process for the internal events and internal flooding hazards will use peer reviewed plant-specific Internal Events and Internal Flooding PRA models in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA models used in this application reflects the as-built and as operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the Internal Events and Internal Flooding PRA models. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Events and Internal Flooding PRA models.
Seismic PRA The PVNGS RICT process for seismic hazards will use a peer reviewed plant specific Seismic PRA model in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Only industry consensus methods were utilized in the development of the seismic hazards for the seismic PRA. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Seismic PRA model.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-2 Fire PRA The PVNGS RICT process for fire hazards will use a peer reviewed plant specific Internal Fire PRA model in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). The APS risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for each of the PVNGS units. Industry consensus methods were utilized in the development of the Internal Fire PRA model. While APS was not an applicant to implement national fire protection association standard (NFPA) 805 in accordance with 10 CFR 50.48, the Internal Fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes NRC approved methods. As part of the ongoing PRA maintenance and update process described in Attachment 11 of this enclosure, APS will address Internal Fire PRA methods approved by the NRC since the development of the Internal Fire PRA. Note that APS does not credit incipient fire detection systems in the Internal Fire PRA model. Attachment 9 of this enclosure identifies the Baseline Average Annual CDF and LERF for the Internal Fire PRA model.
Other External Hazards PRA The PVNGS RICT process for the external hazards will use a peer reviewed plant-specific screening in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). Each external hazard was evaluated with respect to applicability and/or risk. The ASME PRA Standard RA-Sa-2009, Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (reference 4 of this attachment) outlines preliminary and progressive screening approaches that are acceptable for this task. The screening started with the top approach and progressed downward until the hazard in question screened with respect to risk. If none of the screening approaches were successful, then the hazard was analyzed using a detailed PRA approach that meets applicable requirements in the ASME PRA Standard RA-Sa-2009. Implicit in these screening criteria (ones that do not present a quantitative measure) is the assumption that successfully meeting a criterion for screening indicates that the bounding CDF from that hazard is considered to be lower than 1E-6 per year. Attachment 8 of this enclosure provides a summary of the other external hazards scr eening results and the progressive screening approach for addressing external hazards.
PRA Review Process Results The PRA models described above with the exception of the seismic PRA have been peer reviewed per NEI guidance endorsed in RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities , Revision 2 (Reference 2 of this Attachment) consistent with NRC RIS 2007-06, Regulatory Guide 1.200 Implementation (reference 32 of this attachment). The Seismic PRA was peer reviewed per NEI 12-13 (reference 27 of this attachment) since RG 1.200 Revision 2 did not endorse an y seismic PRA peer review guidance (since NEI 12-13 was issued after RG 1.200 Revision 2)
The Internal Events PRA model was peer reviewed in July 1999 by the combustion engineering owners group (CEOG) prior to the issuance of Regulatory Guide 1.200 (reference 7 of this attachment). As a result, a self-assessment of the Internal Events PRA model was conducted by APS in March 2011 (reference 6 of this attachment) in accordance with Appendix B of RG 1.200, Revision 2 (reference 2 of this attachment), to address the PRA quality requirements not considered in the CEOG peer review. APS conducted a full scope Internal Flooding PRA model peer review (reference 8 of this attachment) in November 2010, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-3 The Internal Events PRA quality (including the CEOG peer review and self-assessment results) has previously been reviewed by the NRC in requests to extend the Inverter Technical Specification Completion Time dated September 29, 2010 (reference 33 of this attachment), and to implement TSTF-425, Relocate Surveillance Fr equencies to Licensee Control RITSTF Initiative 5b, December 15, 2011 (reference 5 of this attachment). All PRA upgrades [as defined by the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment)] implemented since conduct of the CEOG peer review in 1999 have been peer reviewed.
APS conducted a full scope Internal Fire PRA model peer review (reference 10 of this attachment) in December 2012 in accordance with RG 1.200, Revision 2 (reference 2 of this attachment). APS conducted a second focused scope peer review of the Internal Fire PRA in December 2014 (reference 11 of this attachment), to address ASME PRA Standard (reference 4 of this attachment) supporting requirements determined not met to Capability Category II in the first peer review, not just the associated facts and observations (F&Os) from the first peer review. Thus, the second peer review generated new F&Os which replaced in their entirety the finding level F&Os fr om the first peer review.
APS conducted a full scope Seismic PRA model peer review (reference 34 of this attachment) in February 2013, in accordance with the current endorsed standard ASME/ANS RA-Sa-2009 (reference 4 of this attachment) and NEI 12-13 (reference 27 of this attachment), including NRC comments on NEI 12-13 (reference 28 of this attachment). APS conducted a full scope External Hazards screening peer review (reference 35 of this attachment) in December 2011, in accordance with RG 1.200, Revision 2 (reference 2 of this attachment).
An F&O closure peer review was performed in June 2017, in accordance with NRC letter dated May 3, 2017 (reference 12 of this attachment) to assess the closure of all PRA Model finding level F&Os from these peer reviews (reference 13 of this attachment) that were not otherwise addressed by focused scope peer reviews that re-reviewe d the associated ASME PRA supporting requirements in their entirety. The F&O closure review was conducted to ensure the findings had been satisfactorily resolved to meet the ASME PRA Standard RA-Sa-2009 (reference 4 of this attachment) to Capability Category II, the sub-element criteria for the CEOG from Internal Events PRA peer review (reference 7 of this attachment), and RG 1.200, Revision 2 (reference 2 of this attachment).
The F&O closure peer review assessed the sixty finding level F&Os from the prior peer reviews and concluded that all we re closed with the exception of eight findings. Of the eight not closed findings, six were assessed as partially closed, and two were assessed as open. The eight not closed findings and their dispositions are described in Table A6-1, Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Clos ure Review Process. During the closure review, a concurrent focused scope peer review was also performed for two separate F&O resolutions that were considered an upgrade per ASME PRA Standard (reference 4 of this attachment). The two F&O resolutions that were considered:
- HR-03, common cause miscalibration errors modeled in HRA calculator using Techniques for Human Error Rate Prediction (THERP) approach
- SHA-E1-01, use of site specific data collected as part of Near Term Task Force (NTTF) 2.1 analysis Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-4 No new F&Os were identified for the two F&Os for which a concurrent focus scope peer review was performed.
APS has committed in Attachment 4 of this enclosure to resolve the eight not closed finding level F&Os listed in Table A6-1 and validate them closed by a subsequent F&O closure review conducted in accordance with NRC letter dated May 3, 2017 (Reference 12 of this Attachment). These not closed finding level F&Os will be closed prior to utilizing the PRA models for RICT. Resolution of the not closed finding level F&Os is not expected to have a significant impact on overall CDF or LERF based on the dispositions described in Table A6-1.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-5 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition IE-07 (B) / IE-12 Internal Events The Interfacing Systems Loss of Coolant Accident (ISLOCA) treatment for the shutdown cooling suction line appears to have some questionable assumptions. First, it is assumed that the Low Temperature Over Pressure (LTOP) valve would always open. While this is the most likely scenario, the LTOP valve can fail to open. Qualitative arguments were made that should this happen, the resulting LOCA would be inside containment (primarily based on relative pipe lengths). This ignores the fact that the high stress points and stress concentration points are outside containment.
Furthermore, the shutdown cooling warmup crossover piping was not considered. Status: Partially Closed. Basis: Insufficient justification is provided in "Impact 200- 84.pdf" to demonstrate that the frequency of the scenario in question is negligible. The resolution of this finding only provides qualitative argument that this ISLOCA scenario will require failure of two MOVs, failure to open of the LTOP valve, and failure of the warmup piping or the bypass valve. No quantitative values and LTOP valve capacity were provided to demonstrate that the frequency of this scenario is negligible. Note that the likelihood of failure of the piping outside containment is relatively high.
Furthermore, it is not clear if the capacity of the LTOP valve is sufficient to relieve the relatively large flow that may result from the catastrophic ruptures of the two upstream MOVs. Finally, ISLOCA may also result from leakage of both of the two upstream MOVs, or a combination of leakage and rupture of the two upstream MOVs, in conjunction with failure of the LTOP valve to open and failure of the downstream piping.
This scenario would have a greater frequency than catastrophic ruptures of both MOVs because the frequency of MOV leakage is significantly greater than its catastrophic rupture. Recommendation: Provide additional justifications (including the capacity of the LTOP valve, all of the possible failure mode combinations and their probabilities of occurrence, LERF value, etc.) to demonstrate that the frequency of the scenario in question is indeed negligible compared to the LERF. The Closure Review Team recommendation will be addressed by evaluating all ISLOCA failure modes of the shutdown cooling system piping.
Justification for screening out any negligible scenarios will be provided.
Leakage, spurious operation, and catastrophic failure modes of valves will be considered, as well as the LTOP relief valve failure to open or exceedance of the relief capacity. These changes are not expected to have a significant impact on total CDF or LERF since the current internal events contribution to total CDF and LERF is less than 2% and 0.5%, respectively. While the resulting LERF contribution from these scenarios may not be negligible, they are expected to be minimal based on industry operating experience. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-6 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition AS-03 (B) / AS-24 Internal Events There are some differences between treatment of a small LOCA associated with a pipe break and an induced small LOCA (pressurizer safety valve reclosure) in the transient event trees. For example:
- In the small LOCA event tree, successful high pressure injection and recirculation lead to questioning whether containment heat removal is successful. In the Transient Type 2 and Transient Type 3 event trees, RCS integrity can be lost if pressurizer safety valves do not reset after lifting. In the sequences from these event trees where high pressure injection and recirculation are successful, the question relating to containment heat removal is not asked. Status: Open. Basis: Containment heat removal (CHR) is only asked in the small LOCA event tree when the success path is relying on high pressure sump recirculation (HPSR) with a failure of the operators to depressurize and cooldown with successful SG heat removal. In this case the RCS remains at temperature so that there is substantial heat transfer to the containment. Table 4 of 13-NS-B065 R007 (Reference 14 of this Attachment) presents MAAP results for LOCA cases with failure of CHR from spray recirculation. Based on a reply to the reviewer's question, Table 4 indicates that <2" diameter breaks may just require CHR because s1_2_1a with SG cooling and failure of SG depressurization exceeds a containment pressure of 50 psig at just 6.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Smaller holes as represented by case s1_1_1a for a 1" break do not exceed even 50 psig until 22.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The ultimate containment failure pressure is 141 psig (i.e. 50% chance of failure) so assuming failure at 50 psig as a basis for success is conservative. It is therefore also conservative to assume that all small LOCA sizes (3/8" to 2.35") require CHR under these circumstances. The small LOCA event tree may also need to ask CHR in cases where the SGs are not depressurized; i.e. sequences 1 and 3. For a loss of main feedwater pumps (Type2), containment heat removal is not asked for any sequences. Either SG cooling prevents the PSV from lifting at all so there is no LOCA or the operators depressurize the RCS for alternate AFW (at low pressure) though the PSVs are assumed to lift and may fail to reseat. Failure of at least one PSV to reseat (equivalent hole size of 2.3") requires HPSI but the SGs are at low temperature in this scenario so CHR is currently assumed not required for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Consideration should be given to containment failure at later times which may lead to subsequent core damage due to failure of sump recirculation at the time of containment failure. The Closure Review Team recommendation will be addressed by modeling CHR in the small LOCA event tree, and event scenarios with failure of the PSV to reseat. MAAP analyses will be performed to include PSV failure to reseat in the small break sizes and determine the necessity of CHR for long-term stable end-state. These changes are not expected to have a significant impact on total CDF or LERF since the current internal events contribution to total CDF and LERF is less than 2% and 0.5%, respectively. The likelihood of a small LOCA with a loss of CHR for longer than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is very small. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-7 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition AS-03 (B) / AS-24 Internal Events (cont.)
- In the small LOCA event tree, RCS depressurization and use of low pressure injection and recirculation are considered if high pressure injection or recirculation fail. In the Transient Type 2 and Transient Type 3 event trees, consideration of RCS depressurization and use of low pressure systems is not included because the likelihood of high pressure injection or high pressure recirculation are small. It would seem that this assumption should apply to both cases, or not. For a loss of condenser vacuum (Type3), it's similar to the type2 event tree. Therefore, for LOCA scenarios with a hole size no larger than 2.3" equivalent in diameter, with or without SG depressurization, further justification is needed to not require CHR to protect the containment. The following information is useful in reviewing the documents associated with this F&O. Page 337, Figure 3.27.4 of 13-NS-B061, Revision 5 (Reference 15 of this Attachment) is the small LOCA event tree. Type 2 initiators with RT before turbine trip only challenge the PSVs if all SG cooling is lost. Event tree for loss of main feedwater pumps in 3.9.4 on Page 130 shows that containment heat removal is not asked because if secondary heat removal is lost, core damage is assumed. Type 3 initiators are where turbine trips first and may challenge the PSVs. Figure 3.6.4 on page 102 shows the loss of condenser vacuum ET which is type 3 initiator. Containment heat removal is not asked. Type 2 and type 3 initiators presently have about the same contribution to CDF for internal events, as does small LOCA; i.e. around 12%. Recommendation: Perform a set of MAAP sensitivity analyses assuming a stuck open PSV with equivalent hole diameter of 2.3" to investigate the possibility of success without CHR. Expand the discussions in the MAAP report to better describe the basis for the 2" hole size as the critical break size. Further, the assumed mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> may be too short for consideration of containment failure. A loss of CHR that results in an exceedance of the pressure capacity at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is not a stable state at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and is still of concern. In other words, breaks with sizes smaller than 2" may also require CHR under the circumstances postulated in this F&O. One possibility is to add the events asking for CHR to the event trees for small LOCA, type2, and type3 initiators to see if the change in assumed success criteria makes any difference to CDF. The saturation temperatures corresponding to 50 psig is approximately 300°F.
If it can be shown that SG cooldown limits the exiting RCS coolant temperature to less than these values prior to reaching 50 psig, then containment integrity should be assured.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-8 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition 1-1/ IFSO-B2 Internal Flooding As noted in SRs IFSO-A1, IFSO-A3, and IFSO-A5, some areas of the documentation do not provide sufficient detail about the process used. Specific items for which improved documentation is needed include:
- a. Documentation of sources in the Turbine Building.
- b. The basis for screening sources in the Fuel, Radwaste, and Turbine Buildings (i.e., the way in which the specified criteria are met for each source is not documented). For example, a walkdown during the peer review revealed that there is section of the wet pipe fire protection (FP) system running above the turbine cooling water (TC) pumps that could potentially spray both pumps. It is not clear based on 13-NS-C093 (Reference 16 of this Attachment) and 13-NS-C094 (Reference 17 of this Attachment) that this impact was considered and dispositioned. Likewise, feedline breaks in the turbine building are assumed to be bounded by the loss of main feedwater initiating event, but may have different impacts such as loss of instrument air due to humidity impacts.
- c. The temperature and pressure of flood sources. Status: Partially Closed. Basis: The documentation (Sections 4.2.5 and 4.2.6 of Study 13- NS-C094, Revision 1, and footnote in Table C.1 of 13-NS-C093 Revision 1) have been revised to address the Findings. Section 4.2.6 of Study 13- NS-C094 (Reference 17 of this Attachment), Revision 1 discusses the flood sources in the TB and the impact of these flood sources, if any, on equipment in TB that are modeled in the PRA. The rationale for not including the temperature and pressure of fluid systems based on Assumption 2 of PRA Study 13-NS-C096 Revision 2 (Reference 18 of this Attachment) must be supported by the fact that there will be no propagation of steam (due to HELB) from the location of the piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s). Also, for feedwater line break in the TB, it must be verified that this event will not impact other PRA equipment such as the instrument air system due to steam and humidity. Recommendation: Verify and document the fact that propagation of steam (due to a HELB) will not occur from the location of piping system break to the adjacent location(s) and impacting PRA equipment in the adjacent location(s) and that a feedwater line break in the TB will not impact other PRA equipment such as the instrument air system due to steam and humidity. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. Preliminary review indicates that steam propagation will have minimal impact on impacted PRA equipment in adjacent locations. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-9 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition 1-2/ IFEV-A7 Internal Flooding Potential flooding mechanisms are primarily limited to failures of components. Human-induced flooding is screened based on plant maintenance practices (see 13 NS-C093 (Reference 16 of this Attachment), Section 3.2, Item 4 and 13-NS-C097 (Reference 19 of this Attachment), Section 3.5). This does not indicate that there was any search of plant operating experience and plant maintenance procedures to verify no potential for human-induced flood mechanisms. Status: Partially Closed. Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) addressed the finding with the discussion of the potential for human and maintenance induced flooding events. Maintenance activities/procedures were reviewed and a search of plant operating experience (APS PVAR/CRDR database, plat trip history and LERs) using flood-related keywords for flooding events was performed as documented in this section (4.1) of the System Study. It is stated in Section 3.5 of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) that maintenance activities, which involve the replacement of pumps or cleaning of heat exchangers, have the potential to induce a significant flooding event are not performed on-line at the plant. However, there was a PVNGS event that involved the plugging of the condenser tubes during plant operation. There is also a potential for on-line heat exchanger tube plugging if a heat exchanger tube leak is detected. Such events were not considered in the discussion of maintenance/human induced flooding in Section 3.5 of Study 13-NS-C097 Revision 2 (Reference 19 of this Attachment). Recommendation: To be consistent with the state of the industry practice, identify and evaluate human-induced floods during plant operation for scenarios that may result from risk-significant maintenance activities (e.g., plugging of the condenser tubes and heat exchanger tubes), and include applicable maintenance-induced failure modes in the next update of the internal flooding PRA to incorporate the revised system pipe break frequency values from EPRI Report 3002000079, "Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment", Revision 3 (Reference 20 of this Attachment). The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. There have been a very limited number of human induced flood events that were screened out. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-10 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition 1-3/ IFSN-A6 Internal Flooding RG 1.200 Revision 2 (Reference 2 of this Attachment) documents a qualified acceptance of this supporting requirement (SR). The NRC resolution states that to meet Capability Category II, the impacts of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement) must be qualitatively assessed using conservative assumptions. Status: Partially Closed. Basis: Assumption 2 in Section 3.1.3 of 13-NS-C096 (Reference 18 of this Attachment) states that "All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., water-proofing), spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect." This assumption is appropriate and effectively bounds the potential impacts from jet impingement, pipe whip, spray, submergence, etc. However, this assumption of susceptible equipment failure in the flood originating room does not always bound the impact of humidity, condensation, and temperature concerns because of the potential propagation of the flooding effects (e.g., steam). From this consideration, the assumption is nonconservative. Recommendation: For the applicable flood scenarios in relevant locations, evaluate the effects of humidity, condensation, and temperature by considering the possible propagation from the initiating room to all connecting rooms. Also see F&O 1-1. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-11 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition 1-4/ IFEV-A6 Internal Flooding There is no evidence in 13-NS-C097 (Reference 19 of this Attachment) that a search was made for plant-specific operating experience, plant design features, and conditions that may impact flood likelihood and no Bayesian updating was performed.
However, adjustments are made to some initiating event frequencies based on system run times to account for differences between impacts when the pumps are running or in standby. Status: Partially Closed. Basis: Section 4.1 (pages 24 - 25) of study 13-NS-C097 Revision 2 (Reference 19 of this Attachment) addressed the finding on "lack of search for plant-specific operating experience, plant design features, and conditions that may impact flood likelihood" with a discussion of the search of flood type events in the PVNGS Site Work Management System database and License Event Reports. It also discusses the review of the PVNGS maintenance procedures on flood prevention guidelines and the potential of maintenance induced flooding. No Bayesian update was performed on the flood initiating event frequency due to insufficient flood data at PVNGS. However there were a few events associated with leaks/flooding that were screened based on the impact of those events on safety-related or PRA equipment. The criteria for screening of flooding events based on impact may not be applicable to the screening of flood events performed for the purpose of evaluating the likelihood of flooding. Recommendation: Develop criteria for screening of flood events for the purpose of evaluating the likelihood of flooding or flooding frequency. The criteria may be in terms of potential spatial impact of the flood event. Use the criteria to re-evaluate the flooding events at PVNGS for the purpose of flood frequency update. Unscreened flooding events should then be used for updating the applicable flooding frequency. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have a significant impact on CDF or LERF since the current internal flood contribution to total CDF and LERF is less than 0.7% and 0.2%, respectively. There have been a very limited number of flood events that were screened out. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-12 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition SHA-E2-01 / SHA-E2 Seismic The evaluation and incorporation of uncertainties in the site response velocity profile may not be properly incorporated because of insufficient or unreviewable site-specific data and/or its documentation. Also, the site response evaluation was completed using a Senior Seismic Hazard Analysis Committee (SSHAC) Level 1 (L1) process which does not meet the ASME general
Capability Category II guidelines (Reference 4 of this Attachment). Status: Open. Basis: Finding SHA-E2 is considered as Open. The technical basis for this conclusion is summarized below and is supported by the documentation as found in LCI Report 2211-PR-07-Rev. 4 (Reference 21 of this Attachment),
Seismic Hazard Evaluation for Palo Verde Nuclear Generating Station, dated 8/27/2013 (referred to as LCI, 2013), and LCI Report PC No. PV-001-PC-05, Rev. 0 (Reference 22 of this Attachment), Soil Hazard and GMRS/FIRS Calculation for Palo Verde Nuclear Generating Station, dated 2/27/2015 (referred to as LCI, 2015b). LCI (2013) provides a set of soil hazard curves fractiles and for peak ground acceleration (pga) a set of 96 aggregate pga hazard curves. It is assumed that the aggregate pga hazard curves were derived for use as part of the seismic risk quantification. LCI (2013) provides an adequate summary of how the aggregate pga hazard curves were developed and compared to the pga hazard curve fractiles. LCI (2015b) provides an updated set of soil hazard curves in part based on the updated site response evaluation completed at the Palo Verde site. LCI (2015b) provides sufficient technical material to understand how the site response results were combined with the soil hazard curves for rock site conditions to produce and updated set of soil hazard curves for the Palo Verde site. Finding SHA-E2 is related to the assessment of aleatory and epistemic uncertainties in site response, and their subsequent impact on the derivation of soil hazard curves. The disposition to this finding states, "A SSHAC L3 analysis was performed subsequent to the seismic PRA development as part of the NTTF response to the NRC 50.54f letter on Fukushima. The SSHAC L3 analysis produced a site hazard curve which is bounded by the SSHAC L1 hazard curve developed and used in the Seismic PRA model. Therefore, the issue is resolved by the updated SSH AC L3 hazard analysis". While the updated probabilistic seismic hazard analysis completed for the Palo Verde site included SSHAC L3 seismic source characterization and ground motion characterization models, the site response analysis was not completed using an explicit SSHAC process. It is important to note that there is no mandate to complete the site response analysis following the SSHAC guidance; the approach and method documented in LCI [2015a and 2015b (References 23 and 22 of this Attachment)] is consistent with expectation documented as part of EPRI guidance (SPID) which has been endorsed by the NRC. The updated seismic hazard curves provided by LCI (2015b) and associated impacts on fragilities will be incorporated into the seismic PRA. These changes are not expected to have a significant impact on CDF or LERF based on the NRC review of the updated seismic hazard curves LCI (2015b) which found the updated seismic hazard is bounded by the current design-basis safe shutdown earthquake at most frequencies above 1 Hertz and minor exceedances above 1 Hertz to be considered "de minimis" ,ADAMS Accession No. ML16221A604 (Reference 24 of this Attachment) These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-13 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition SHA-E2-01 / SHA-E2 Seismic (cont.) However, the seismic hazard curves provided by LCI (2015b) (Reference 22 of this Attachment) were not explicitly compared to those derived in LCI (2013)
(Reference 21 of this Attachment) to corroborate the disposition provided. LCI (2015b) (Reference 22 of this Attachment) does not include updated hazard curve fractiles for pga that can be compared to either the pga fractiles or the aggregate pga hazard curves as found in LCI (2013) (Reference 21 of this Attachment). Comparison of the mean pga hazard curves [Table 7.1 from LCI (2013) (Reference 21 of this Attachment) to Table 2 from LCI (2015b)]
indicates that the updated pga hazard has increased, thus it is not clear if the seismic risk quantification using the pga hazard curves form LCI (2013) (Reference 21 of this Attachment) is appropriate. For example at a pga = 0.5g the mean hazard has increased from 1.72E-6 [Table 7.1 from LCI (2013) (Reference 21 of this Attachment)] to 6.53E-6 Table 2 from LCI (2015b)
(Reference 22 of this Attachment)]. In summary, insufficient information has been provided to demonstrate that the updated pga soil seismic hazard curves is bounded by the pga soil hazard curve used in the Seismic PRA model. Recommendation: Demonstrate that the updated set of soil pga hazard curves fractiles (mean, and 5th, 16th, 50th, 84th, 95th) is bounded by the soil pga hazard curves used in the Seismic PGA model. If the updated set of soil pga hazard curves is greater than those used in the Seismic PRA model, the impact on Seismic risk quantification should be assessed.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-14 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition SFR-F3-01 / SFR-F3 Seismic The draft report LTR-RAM-II-12-074 indicates that the draft relay assessment uses the IPEEE relay assessment as the starting point but accounts for the updated seismic hazard curve at the site. However, the report includes the following statement in Section 2.3 (Unaddressed Relays): This list (unaddressed relays) included 69 such relays. Of the relays that have been included in the SPRA, their seismic fragility events are found in many of the dominant CDF cutsets. Status: Partially Closed. Basis: In response to F&O SFR-F3-01, two documents were provided: 1) Westinghouse Letter LTR-RAM-II-12-074 R002 - PV SPRA - Relay Assessment.pdf (Reference 25 of this Attachment), and 2) 11c4043-cal-028 rev0 (Reference 26 of this Attachment) Seis Frag for Sel Relays.pdf. These two documents were reviewed to support the conclusion that the previously unaddressed relays have been addressed and are included in the SPRA model and quantification. The following paragraphs provide the basis for the conclusion that the reported fragilities are reasonable, and provide recommendations for completeness of documentation. Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) - PV SPRA incorporates into the existing relay database 288 additional relays including the 69 previously unaddressed in the IPEEE. This document develops the first round relay fragilities based on the relay analysis performed as part of the plant IPEEE. Several relays, including some of the 69 relays that were not addressed in IPEEE, are screened because they are not chatter sensitive. The relays for which chatter is not acceptable are assigned initial HCLPF values based on the IPEEE review level earthquake (RLE) PGA of
0.5 scaled
in accordance with the location specific spectral acceleration ratios of the IPEEE ISRS and the SPRA ISRS. These initial HCLPF values are substantiated with walkdowns of host components. The reported initial quantification using these HCLPF and generic betas identified the dominant relay contributors. Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) - PV SPRA describes the modelling of the relays in the SPRA. S&A Calculation 11c4043-cal-028 (Reference 26 of this Attachment) documents the detailed fragility analysis using separation of variable for 13 relays selected from the top contributors. The median capacity is based on the in-cabinet seismic demand on the relays associated with the SPRA ISRS, and EPRI relay GERS. The associated uncertainty parameters are obtained by using the separation of variables method. The resulting fragility parameters are scaled to conform to the revised seismic hazard and the revised GMRS. We concur with the analysis and feel that the resulting fragilities are sufficiently realistic. The Closure Review Team recommendation will be implemented as written. These changes are not expected to have any impact on CDF or LERF since the recommendations are associated with documentation changes to better explain modeling rationale. These changes will be implemented and the finding verified closed by a subsequent F&O Closure Review as a pre-requisite to RICT implementation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-15 Table A6-1 Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items from Facts and Observation Closure Review Process Finding F&O ID / Requirement Description Closure Review Team Recommendation(s)
Disposition SFR-F3-01 / SFR-F3 Seismic (cont.) Finding SFR-F3-01 could be resolved on the basis that APS will take actions to implement the recommendations provided below and update WEC Document LTRRAM-II-12-074 Rev. 2 (Reference 25 of this Attachment), and S&A Calculation 11c4043-cal-028 Rev. 0 (Reference 26 of this Attachment). Recommendation: The detailed fragility evaluation for dominant relay contributors should demonstrate that the seismic demand is an appropriate median based response, and that the important uncertainties are included in obtaining log standard deviations. We recommend that the following be incorporated into the Westinghouse Document LTR-RAM-II-12-074 R002 (Reference 25 of this Attachment) for completeness: 1. During the closure review, the following information was communicated to the reviewers regarding the unaddressed relays via an e-mail: "The initial fragilities for relays were estimated based on the IPEEE analysis for 0.5g RLE. The 69 relays that were not addressed in Rev. 1 of the Relay Fragility Assessment were subsequently incorporated into the Relay Fragility Assessment Rev. 2. Twenty-nine of the 69 relays were screened out from modeling. However, 40 relays were modeled. They were assigned simplified fragilities based on walkdowns that were already performed on the parent cabinets." The above information in the e-mail communication should be documented in WEC Document LTR-RAM-II-12-074 Rev. 2." 2. In Table 34: Detailed Fragility Candidates, document the source of the factor SFbldg. We also recommend that the following be incorporated into the S&A Calculation 11c4043-cal-028 rev0 (Reference 26 of this Attachment) for completeness of documentation: 1. Justify the use of Best Estimate ISRS as the median. In our opinion, the SSI analysis using BE soil properties, best estimate structure stiffness and a conservative estimate of best estimate structure damping results in a 84th percentile response. 2. The u associated with SSI is obtained using the BE, UB and LB envelop as the 84th and the BE alone as the median. Please explain the rationale that this results for the same building (Control Building) a wide range of SSI c from 0.09 to 0.22. 3. Explain why the uncertainties associated with structure stiffness and damping, time history simulation and earthquake component combination are ignored in the SOV calculations.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-16
References:
- 1. NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0, dated November 2006 (ADAMS No. ML12286A322)
- 2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activi ties, Revision 2, March 2009
- 3. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Agencywide Documents Access and Management System (ADAMS) Accession No., ML071200238) dated May 17, 2007
- 4. ASME/ANS RA-Sa-2009, Standard for Level I/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009
- 5. NRC Letter Palo Verde Nuclear Generating Station, Units 1,2, And 3 Issuance of Amendments Re: Adoption of TSTF-425, Revision 3, "Relocate Surveillance Frequencies to Licensee Control RITSTF Initiative 5b" (ADAMS Accession No., ML112620293), dated December 15, 2011
- 6. Palo Verde Engineering Evaluation 3579223 Revision 1, PRA Input to the Risk-Informed Task Force (RITS) 5b License Amendment, dated March 10, 2011
- 7. ABB Combustion Engineering letter to APS ST-99-542, Probabilistic Safety Assessment Peer Review for Palo Verde Nu clear Generating Station, dated July 12, 1999 8. Westinghouse Letter LTR-RAM-II-10-082, Focused Scope RG 1.200 PRA Peer Review Against the ASME/ANS PRA Standard Requirements for the Palo Verde Nuclear Generating Station Probabilistic Risk Assessment, dated November 5, 2010
- 9. Not used.
- 10. Westinghouse Letter LTR-RAM-12-13, Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements from Section 4 of the ASME/ANS PRA Standard for the Palo Verde Nuclear Generating Station Fire Probabilistic Risk Assessment, dated January 2, 2013
- 11. Hughes Associates Report 001014-RPT-01, Palo Verde Nuclear Generating Station Fire PRA Focused-Scope Peer Review Report, Revision 0, dated January 22, 2015
- 12. NRC Letter U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-out of Facts and Observations (F&Os) (ADAMS Accession No., ML17079A427), dated May 3, 2017
- 13. ABS Consulting Report R-3882824-2037, Palo Verde Gen erating Stations PRA Finding Level Fact and Observation Closure Review, June 23, 2017.
- 15. 13-NS-B061, At-Power PRA Event and Success Criteria, Revision 5.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-17 16. 13-NS-C093, Internal Flooding PRA - Input Data and Walkdown Validation , Revision 1.
- 17. 13-NS-C094, Internal Flooding PRA - Qualitative Screening Evaluation , Revision 1.
- 18. 13-NS-C096, Internal Flooding PRA - Characterization of Flood Scenarios , Revision
- 2. 19. 13-NS-C097, Internal Flooding PRA - Estimation of Initiating Event Frequencies , Revision 2.
- 20. EPRI Report 3002000079, Pipe Rupture Frequencies for Internal Flooding Probabilistic Risk Assessment, Revision 3.
- 21. LCI Report 2211-PR-07 (LCI 2013), Seismic Hazard Evaluation for Palo Verde Nuclear Generating Stating, Revision 4, dated August 2013.
- 22. LCI Report PC No. PV-001-PC-05 (LCI 2015b), Soil Hazard and GMRS/FIRS Calculation for Palo Verde Generating Station, Revision 0, dated February 2015.
- 23. LCI Report PC No. PV-001-PC-04 (LCI 2015a), Development of Site Profile and Amplification for Palo Verde Nuclear Generating Station, Revision 0, dated February 2015. 24. NRC Letter Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Staff Assessment of Information Provided Under Title 10 of the Code of Federal Regulations Part 50, Section 50.54(f), Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force review of Insights from the Fukushima Dai-ichi Accident and Staff Closure of Activities Associated with recommendation 2.1, "Seismic" (CAC NOS. MF5277, MF5278 and MF5279) (ADAMS Access Number ML16221A604), dated September 13, 2016.
- 26. 11C4043-CAL-028, Seismic Fragility for Selected Relays, Revision 0.
- 28. NRC Letter U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, "External Hazards PRA Peer Review Process Guidelines" (ADAMS Accession No., ML12321A280), dated November 16, 2012.
- 29. License Amendment Request to Revise Technical Specifications to implement Risk-Informed Completion Times (ADAMS Accession Number ML15218A300), dated July 31, 2015.
- 30. NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, dated September 2005.
- 31. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk- Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated April 2015.
- 32. NRC Regulatory Issue Summary 2007-06 Regulatory Guide 1.200 Implementation, (ADAMS Accession No. ML070650428) dated March 22, 2007.
- 33. Palo Verde Nuclear Generating Station, Units 1, 2, and 3, Issuance of Amendments Re: Changes To Technical Specification 3.8.7, Inverters-Operating (ADAMS Accession Number ML102670352), dated September 29, 2010.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 6 6-18 34. Westinghouse Letter to APS CVER-13-028, Transmittal of Palo Verde Seismic PRA - Final Peer Review Report, February 14, 2013.
- 35. Palo Verde Nuclear Generating Station Other External Hazards PRA Peer Review Report, December 2011
.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 7 7-1 ATTACHMENT 7 Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This attachment is not applicable to the PVNG S submittal. APS' proposal solely uses PRA models in its Risk-Informed Completion Ti me Program for which there are standards endorsed by the NRC in Regulatory Guide 1.200, Revision 2.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 8 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-1 Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PVNGS PRA Models Introduction Section 5.0, Item 5 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a justification for excluding any risk sources determined to be insignificant to the calculation of configuration-specific risk, and provide a discussion of any conservative or bounding analyses to be applied to the calculation of risk-informed completion times (RICTs) fo r sources of risk not addressed by the PRA models.
Scope NEI 06-09-A and the associated Pressurized Water Reactor Owners Group (PWROG) guidance (Reference 2 of this Attachment) do not provide a specific list of hazards to be considered in an RICT Program. However, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making (Reference 3 of this Attachment), provides guidance on how to trea t uncertainties associated with PRA in risk-informed decision making relative to hazards that are not considered in the PRA model. Specifically, Section 6.3.3.1 of NUREG-1855 provides the following list of external hazards that should be addressed either via a bounding analysis or included in a PRA calculation:
- Aircraft impacts
- External flooding
- Extreme winds and tornados (including generated missiles)
- External fires (addressed in Table A8-1, Screening Summary of External Hazards
, by the following two External Hazards: Forest or Range Fire and Industrial or Military Facility Accident)
- Accidents from nearby facilities
- Pipeline accidents (e.g., natural gas)
- Release of chemicals stored at the site
- Seismic events
- Transportation accidents
- Turbine-generated missiles The scope of this Attachment considers the above hazards for PVNGS, except for seismic events which are addressed by the PRA model.
Technical Approach The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of risk-managed TSs. Consistent with NUREG-1855, the process includes the ability to address external hazards by:
- Screening the hazard based on a low frequency of occurrence Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-2
- Bounding the potential impact and including it in the decision-making
- Developing a PRA model to be used to calculate RICTs and associated Risk Management Action Times (RMATs)
ASME/ANS PRA Standard RS-S-2008 (Reference 4 of this Attachment) has endorsed the following set of five external hazard screening criteria:
- 1) The hazard would result in equal or lesser damage than the events for which the plant has been designed. This requires an evaluation of plant design bases to estimate the resistance of plant structures and systems to a particular external hazard. 2) The hazard has a significantly lower mean frequency of occurrence than another event (taking into account the uncertainties in the estimates of both frequencies), and the hazard could not result in wors e consequences than the other event.
- 3) The hazard cannot occur close enough to the plant to affect it. Application of this criterion needs to take into account the range of magnitudes of the hazard for the recurrence frequencies of interest.
- 4) The hazard is included in the definition of another event.
- 5) The hazard is slow in developing, and it can be demonstrated that sufficient time exists to eliminate the source of the threat or to provide an adequate response.
The review of external hazards considers two aspects of the cont ribution to risk. The first is the contribution from the occurrence of beyond design basis conditions (i.e., winds greater than design). These beyond-design-basis conditions challenge the functionality of the systems, structures, and components (SSCs) to support safe shutdown of the plant. The second aspect addressed are the challenges caus ed by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (i.e., high winds causing loss of offsite power). While the plant design basis assures that the safety-related equipment necessary to respond to th ese challenges are prot ected, the occurrence of these conditions nevertheless causes a demand on these systems and can impact configuration risk.
Note that when the effect of a particular hazard is not able to be mitigated using the plant SSCs, then there is no impact on the changes in risk calculated to support the RICT Program, and these hazards can be screened out of the RICT Program as well. Only events which create a demand for mitigation equipment are potentially relevant to the RICT Program. The review and disposition of each external hazard is addressed in Table A8-1.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-3 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Aircraft Impact Y PS2 PS4 Airport hazard meets 1975 Standard Review Plan (SRP) requirements. Additionally, airways hazard bounding analysis per NUREG-1855 is < 1E-6/y. Avalanche Y C3 Not applicable to the site because of climate and topography. Biological Event Y C3, C5 Sudden influxes not applicable to the plant design [closed loop systems for Essential Cooling Water System (ECWS) and Component Cooling Water System (CWS)]. Slowly developing growth can be detected and mitigated by surveillance. Coastal Erosion Y C3 Not applicable to the site because of location. Drought Y C5 Plant design eliminates drought as a concern and event is slowly developing. External Flooding Y PS2 Plant design meets 1975 SRP requirements. Extreme Wind or Tornado Y PS2 PS4 The plant design basis tornado has a frequency < 1E-7/y. The spray pond nozzles (not protected against missiles) have a bounding median risk < 1E-7/y. Fog Y C1 Limited occurrence because of arid climate and negligible impact on the
plant. Forest or Range Fire Y C3 Not applicable to the site because of limited vegetation. Frost Y C1 Limited occurrence because of arid climate. Hail Y C1 C4 Limited occurrence and bounded by other events for which the plant is designed. Flooding impacts covered under Intense Precipitation. High Summer
Temperature Y C1 Plant is designed for this hazard.
Associated plant trips have not occurred and are not expected.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-4 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment High Tide, Lake Level, or River Stage Y C3 Not applicable to the site because of location. Hurricane Y C4 Covered under Extreme Wind or Tornado and Intense Precipitation. Ice Cover Y C3 C1 Ice blockage causing flooding is not applicable to the site because of location (no nearby rivers and climate conditions). Plant is designed for freezing temperatures, which are infrequent and short in duration. Industrial or Military
Facility Accident Y PS2 Explosive hazard impacts and control room habitability impacts meet the 1975 SRP requirements (RGs 1.91 and 1.78). Internal Flooding N None PRAs addressing internal flooding have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Flooding PRA. Internal Fire N None PRAs addressing internal fire have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA for this hazard which is addressed in the PVNGS Internal Fire PRA. Landslide Y C3 Not applicable to the site because of topography. Lightning Y C1 Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events. However, other causes are also included. The impacts are no greater than already modeled in the internal events PRA. Low Lake Level or River Stage Y C3 Not applicable to the site because of location.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-5 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Low Winter Temperature Y C1 C5 Extended freezing temperatures are rare, the plant is designed for such events, and their impacts are slow to develop. Meteorite or Satellite
Impact Y PS4 The frequency of meteorites greater than 100 lb striking the plant is around 1E-8/y and corresponding satellite impacts is around 2E-9/y.
Pipeline Accident Y C3 Pipelines are not close enough to significantly impact plant structures. Release of Chemicals in Onsite Storage Y PS2 Plant storage of chemicals meets 1975 SRP requirements. River Diversion Y C3 Not applicable to the site because of location. Sand or Dust Storm Y C1 C5 The plant is designed for such events. Also, a procedure instructs operators to replace filters before they become inoperable. Seiche Y C3 C1 Not applicable to the site because of location. Onsite reservoirs and spray ponds designed for seiches. Seismic Activity N None PRAs addressing seismic activity have indicated this hazard typically results in CDFs 1E-6/y. Also, the ASME/ANS PRA Standard requires a detailed PRA or Seismic Margins Assessment (SMA) for this hazard which is addressed in the PVNGS Seismic PRA. Snow Y C1 C4 The event damage potential is less than other events for which the plant is designed. Potential flooding impacts covered under external flooding. Soil Shrink-Swell Consolidation Y C1 C5 The potential for this hazard is low at the site, the plant design considers this hazard, and the hazard is slowly developing and can be mitigated. Storm Surge Y C3 Not applicable to the site because of location.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-6 Table A8-1 Screening Summary of External Hazards External Hazard Screening Result Screened?(Y/N) Screening Criterion(Note a) Comment Toxic Gas Y C4 Toxic gas covered under release of chemicals in onsite storage, industrial or military facility accident, and transportation accident. Transportation
Accident Y PS2 PS4 C3 C4 Potential accidents meet the 1975 SRP requirements. Bounding analyses used for offsite rail shipment of chlorine gas and onsite truck shipment of ammonium hydroxide. Marine accident not applicable to the site because of location. Aviation and pipeline accidents covered under those specific categories. Tsunami Y C3 Not applicable to the site because of location.
Turbine-Generated Missiles Y PS2 Potential accidents meet the 1975 SRP requirements. Volcanic Activity Y C3 Not applicable to the site because of location.
Waves Y C3 C4 Waves associated with adjacent large bodies of water are not applicable to the site. Waves associated with
external flooding are covered under that hazard.
- See references of this Attachment Note a - See Table A8-2, Progressive Screening Approach for Addressing External Hazards, for descriptions of the screening criteria.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-7 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Initial Preliminary Screening C1. Event damage potential is < events for which plant is designed. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C2. Event has lower mean frequency and no worse consequences than other events analyzed. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C3. Event cannot occur close enough to the plant to affect it. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 C4. Event is included in the definition of another event. NUREG/CR-2300 and ASME/ANS Standard RA-Sa-2009 Not used to screen. Used only to include within another event.
C5. Event develops slowly, allowing adequate time to eliminate or mitigate the threat. ASME/ANS Standard Progressive Screening PS1. Design basis hazard cannot cause a core damage accident. ASME/ANS Standard RA-Sa-2009 PS2. Design basis for the event meets the criteria in the NRC 1975 Standard Review Plan (SRP). NUREG-1407 and ASME/ANS Standard RA-Sa-2009 PS3. Design basis event mean frequency is < 1E-5/y and the mean conditional core damage probability is <
0.1. NUREG-1407 as modified in ASME/ANS Standard RA-Sa-2009 PS4. Bounding mean CDF is < 1E-6/y. NUREG-1407 and ASME/ANS Standard RA-Sa-2009 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 8 8-8 Table A8-2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Detailed PRA Screening not successful. PRA needs to meet requirements in the ASME/ANS PRA Standard. NUREG-1407 and ASME/ANS Standard RA-Sa-2009 *See references of this Attachment
References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. WCAP-16952-NP, Supplemental Implementation Guidance for the Calculation of Risk-Informed Completion Time and Risk Managed Action Time for RITSTF Initiative 48, August 2010
- 3. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Volume 1, March 2009
- 4. American Society of Mechanical Engi neers and American Nuclear Society, Addenda to ASME/ANS RA-S-2008 Standard for Levei1/Lar ge Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, New York (NY), February 2009.
- 5. NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, 1975 6. NUREG/CR-2300, PRA Procedures Guide, January 1983
- 7. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 9 Baseline Core Damage Frequency (CDF) and Large Early Release Frequency (LERF)
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 9-1 Baseline Core Damage Frequency and Large Early Release Frequency Section 4.0, item 6 of the NRC final safety evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide the plant specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm that these are less than 1E-4/year and 1E-5/year respectively, thus assuring that the potential risk increases allowed under the RMTS program are consistent with Regulatory Guide (RG) 1.174, Revision 1 (Reference 2 of this Attachment). RG 1.174, Revision 2 (Reference 3 of this Attachment) issued by the NRC in May 2011, did not revise these limits.
This attachment demonstrates that the total CDF and total LERF are less than the guidance of RG 1.174, such that the risk metrics of NEI 06-09-A may be applied to the PVNGS Risk-Informed Completion Time (RICT) Program.
Table A9-1, Total Unit 1/2/3 Baseline Average CDF/LERF, provides the CDF and LERF values that resulted from a quantification of the ba seline average annual mode ls (References 4, 5, 6, 7, and 8 of this Attachment), which include contributions from internal events, internal flooding, internal fire, and seismic hazards. Other external hazards are below accepted screening criteria and do not contribute significantly to the totals.
The CDF and LERF for each unit at PVNGS are the same because each unit is nearly identical to the others by design and through the modification process. There are small differences between the units that have been evaluated and found to have minimal risk significance. Examples include:
- Unit 1 has a manual transfer switch between each of its four trains of safety-related inverters and their backup regulated power source, while the other two units have automatic transfer switches.
- Field routed cabling As demonstrated in the table, the total CDF and total LERF are within the guidance of RG 1.174 to permit small changes in risk which may occur during implementation of RICTs. Therefore, the PVNGS RICT Program is consistent with NEI guidance.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 9-2 Table A9-1: Total Unit 1/2/3 Baseline Average Annual CDF/LERF 1 Hazard CDF (per reactor-yr)
LERF (per reactor-yr)
Internal Events 1.3E-6 4.3E-8 Internal Flooding 4.6E-7 2.1E-8 Seismic 3.1E-5 5.7E-6 Internal Fire 2.9E-5 2.4E-6 Total 6.2E-5 1 8.2E-6 1 Note: 1. The Baseline Average Annual CDF/LERF include average maintenance unavailability of structures, systems, and components (SSCs). The configuration risk management program model used for the RICT Program does not include maintenance unavailability of SSCs unless specific to the configuration.
References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)
Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 November 2002
- 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. PVNGS Study 13-NS-B067, At-Power PRA Quantification, Revision 6
- 7. PVNGS Study 13-NS-C099 "Internal Flooding PRA - PRA Modeling and Quantification, Revision 2
- 8. Westinghouse Calculation CN-RAM-12-022, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, Revision 1
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 9 10-1 ATTACHMENT 10 Justification of Application of At-Power PRA Models to Shutdown Modes This attachment is not applicable to the PVNGS submittal. APS is not proposing to apply the Risk-Informed Completion Time Program in shutdown modes, but only in Modes 1 and 2.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 11 Probabilistic Risk Assessment Model Update Process
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 11-1 Probabilistic Risk Assessment Model Update Process Summary Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a discussion of the licensee's programs and procedures which assure the probabilistic risk assessment (PRA) models which support the RMTS are maintained consistent with the as-built/as-operated plant. Palo Verde Nuclear Generating Station (PVNGS) procedure 70DP-0RA03 Probabilistic Risk Assessment Model Control (Reference 2 of this Attachment), controls update and maintenance of the PRA models. This procedure is in full compliance with ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 3 of this Attachment) for PRA model maintenance and update.
This attachment describes the administrative controls and procedural processes applicable to the configuration control of PRA models used to support the Risk-Informed Completion Time (RICT) program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions, will be identified and reviewed prior to implementation to determine if they could impact the PRA models. The PRA Configuration Control Program will ensure these plant changes are incorp orated into the PRA models as appropriate. The process will include discovered conditions associated with the PRA models, which will be addressed through the PVNGS Corrective Action Program.
Should a plant change or a discovered condition be identified that has a significant impact to the RICT program calculations as defined by the Configuration Risk Management Program (CRMP), an interim update of the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic PRA model updates will be performed no less frequently than every two refueling cycles (i.e., three years), consistent with the guidance of NEI 06-09-A.
PRA Model Update Process The PRA Configuration Control Program ensures that the applicable PRA model used for the RICT Program reflects the as-built, as-operated plant for the three PVNGS units. The PRA Configuration Control Program delineates the responsibilities and guidelines for updating the full-power internal event, internal flood, internal fire, and seismic PRA models, and includes both periodic and interim PRA model updates. The procedure requires an update to be initiated at least once every three years to reflect industry operating experience (other than data), plant design and procedure changes. An update of PRA model data, including initiating event, component unavailability, component reliability, and common cause data is also required by the procedure to be initiated at least once every three years. The program includes guidance on identifying, evaluating, and documenting potential impacts (e.g., plant changes, plant/industry operational experience, or errors or limitations identified in the model). In addition, guidance is provided on assessing individual and cumu lative risk impacts of pending changes. Finally, the PVNGS software quality assurance program records Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 11 11-2 the controlled version of the PRA and CRMP models and associated references.
Review of Plant Changes for Incorporation into the PRA Model
- 1) Plant changes or discovered conditions, as defined in the PRA Configuration Control Program, are reviewed for potential impact to the PRA models, including the CRMP model and the subsequent risk calculations which support the RICT Program. 2) Plant changes that meet the criteria defined in the PRA Configuration Control Program (including consideration of the cumulative impact of other pending changes) will be incorporated in the applicable PRA model(s), consistent with the NEI 06-09-A guidance. Otherwise, the change is assi gned a priority and is incorporated at a subsequent periodic update consistent with procedural requirements.
- 3) PRA updates for plant changes are initiated at least once every two refueling cycles, consistent with the guidance of NEI 06-09-A.
- 4) If a change is required for the CRMP model, but cannot be immediately implemented for a significant plant change or discovered condition, either:
A. Alternative analyses to conservatively bound the expected risk impact of the change will be performed. In such a case, these alternative analyses become part of the RICT Program calculation process until the plant changes are incorporated into the PRA model during the next update. The use of such bounding analyses is consistent with the guidance of NEI 06-09-A. or B. Appropriate administrative restrictions on the use of the RICT Program will be put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A.
References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. PVNGS Procedure 70DP-0RA03, Probabilistic Risk Assessment Model Control
- 3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 12 Attributes of the Configuration Risk Management Program (CRMP)
Model Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-1 Attributes of the Configuration Risk Management Program (CRMP)
Model Introduction Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of probabilistic risk assessment (PRA) models and tools used to support RMTS, including identification of how the baseline PRA model is modified for use in the Configuration Risk Management Program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. The scope of structures, systems, and components (SSCs) within the CRMP will be provided. This item should also confirm that the CRMP tools can be readily applied for each Technical Specification (TS) limiting condition for operation (LCO) within the scope of the plant specific RMTS submittal.
This attachment describes the necessary changes to the peer reviewed baseline PRA models for use in the CRMP software to support the Risk-Informed Completion Time (RICT) Program. The process employed to adapt the baseline models for CRMP use is demonstrated: (1) to preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; (2) to maintain the quality of the peer reviewed PRA models; and (3) to correctly accommodate changes in risk due to time-of-year, time-of-cycle, and configuration-specific considerations. Quality controls and training programs applicable for the CRMP are also discussed in this enclosure.
Translation of Baseline PRA Model for Use in CRMP: The baseline PRA models for internal events, including internal floods, internal fires, and seismic events, are the peer reviewed models, updated as described in Attachment 11 of this Enclosure to reflect the as-built
/as-operated plant. These models are modified to include changes that are needed to facilitate configuration-specific risk calculations to support the RICT Program implementation. The baseline models, and the changes made to create the CRMP model used in the RICT Program, are controlled using plant calculations, which include the necessary quality controls and reviews. The changes to the models to account for variations in system success criteria based on time-of-year or time-in-operating cycle, and other specific changes needed to properly account for configuration-specific issues, which are either not evaluated in the baseline average annual model or are evaluated based on average conditions encountered during a typical operating cycle, are described in Table A12-1, Changes Made for Configuration-Specific Risk.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-2 TABLE A12-1 CHANGES MADE FOR CONFIGURATION-SPECIFIC RISK DESCRIPTION BASIS FOR CHANGE Plant Availability The baseline PRA models account for the time the reactor operates at power by using a plant availability factor. This is appropriate for determining the average annual (time-based) risk, but the factor is not applicable to configuration-specific risk calculated for the RICT Program. In order to account for the assumption that the plant is always operating in the RICT Program, the frequency of initiating events which include an availability factor are adjusted. This change is necessary to adjust the modeled initiating event frequencies from a "per year" to a "per reactor year" basis for use in the CRMP. Maintenance Alignment Probabilities Maintenance alignment probabilities in the baseline PRA models have probabilities based on the fraction of the year the equipment is unavailable. For the CRMP model, the actual configuration of equipment is evaluated, so the maintenance alignment probabilities are set to zero. This is also done for the system initiating events, which include maintenance contributions.
Excluded Maintenance Combinations The PRA models will not remove excluded maintenance combinations allowed by the technical specifications (i.e., both trains of a single safety system being simultaneously unavailable).
Room Cooling Success Criteria The baseline PRA models include conservative success criteria for room cooling and do not use average annual criteria; therefore, no changes to the CRMP model for room cooling success criteria are required.
Unfavorable Exposure Time (UET) for anticipated transient without trip (ATWT)
Events The current PVNGS core design reflected in the baseline PRA model for ATWT events includes a UET for variable success criteria based on time of core life (i.e., moderator temperature coefficient early in cycle life). The event is set to the fraction of the year for which the UET applies and will be changed to a probability of 1 or 0 based on operator input using the CRMP tool, depending on the actual time in the operating cycle. Quality Requirements and Consistency of PRA Model and CRMP Tools The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA maintenance and update process described in Attachment 11 of this Enclosure and the use of self-assessments and independent peer reviews described in Attachment 6 of this Enclosure
. The information provided in Attachment 6 demonstrates that the PVNGS internal event, internal flood, internal fire, and seismic PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200 Revision 2 (Reference 2 of this Attachment). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.
The current PRA models will either be combined into a single CRMP model for use in the CRMP software tool, or will be used to generate pre-solved solutions for routine plant configurations which will be entered into the CRMP software tool. PVNGS has been using a single CRMP model in EPRI CRMP model for more than eight years based on combined internal events and internal fire models. The CRMP model is rigorously checked against the individual PRA model results to validate the CRMP model quality. If a new CRMP model Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-3 including the upgraded fire and new seismic PRA models cannot be developed that meets work management and scheduling needs for solution speed, PVNGS will take the approach used by South Texas Project by pre-solving thousands of routine expected configurations and saving the results of those solutions in the CRMP software tool. When unanalyzed configurations occur, PRA would promptly solve the PRA models to determine the RICT as well as comply with existing Maintenance Rule configuration risk monitoring requirements. PVNGS currently has and will continue to provide a qualified PRA engineer on call 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day, 7 days a week to support Operations and Work Management in assessing the risk of planned and emergent plant configurations.
Changes made to the baseline PRA model in translation to the CRMP model will be controlled and documented per procedure 70DP-0RA03 to maintain the existing CRMP model. An acceptance test is performed after every CRMP model update to verify proper translation of the baseline PRA models and acceptance of all approved changes made to the baseline PRA models pursuant to translation to the CRMP model. This testing also verifies correct mapping of plant components to the basic events in the CRMP model. Training and Qualification The PVNGS PRA staff is responsible for development and maintenance of the CRMP model. The PRA staff is trained in accordance with the site Engineering personnel training program and has passed specific qualifications on each major element of the PRA development and use. Operations and Work Control staff will use the CRMP tool under the RICT Program and are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is accredited by I N PO. Application of the CRMP Tool to the RICT Program Scope PVNGS will use the EPRI CRMP tool for RICT Program calculations. The EPRI program already exists in an approved, issued version to support the RICT Program. PVNGS currently uses the EPRI tool in the Maintenance Rule CRMP for at-power conditions. The EPRI CRMP tool meets RG 1.174 (Reference 3 of this Attachment) and PVNGS software quality assurance requirements.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 12 12-4 References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009
- 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 ATTACHMENT 13 Key Assumptions and Sources of Uncertainty
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-1 Key Assumptions and Sources of Uncertainty Introduction Section 4.0, Item 10 of the NRC Final Safety Evaluation (Ref erence 1 of this Attachment) for NEI 06-09-A requires that the license amendment request (LAR) provide a discussion of how the key assumptions and sources of uncertainty were identified, and how their impact was assessed and dispositioned. This attachment provides that discussion
. Process for Identification of Key Assumptions and Sources of Uncertainty Sources of model uncertainty and related assumptions, defined consistent with Regulatory Guide 1.200, Revision 2, (Reference 2 of this Attachment) and the ASME/ANS RA-Sa-2009, Standard for Level1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008 (Reference 3 of this Attachment), have been identified for the PVNGS PRA models using the guidance of NUREG-1855 (Reference 4 of this Attachment) and EPRI TR-1016737 Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessment (Reference 5 of this Attachment)
. The detailed process of identifying, characterizing and qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 and Section 3.1.1 of EPRI TR-1016737. The process in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups. Disposition of Key Assumptions and Sources of Uncertainty The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of configuration-specific changes in risk.
If the PVNGS model used a non-conservative treatment, or methods which are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine the impact on RICT Program calculations. Only those assumptions or sources of uncertainty that could significantly impact the configuration risk calculations were considered key for this application.
Key assumptions and sources of uncertainty for the RICT Program application are identified and dispositioned in Table A13-1, Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations. The conclusion of this review is that no additional sensitivity analyses are required to address PVNGS PRA model specific assumptions or sources of uncertainty except for the following:
- The seismic PRA model used for the RICT Program will increase all the seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-2 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The only plant system modeled in the PRA that is shared between the three units is the station blackout generators (SBOGs). Simultaneous multiple unit station blackout conditions are screened out based on low probability. SBOGs are
assumed aligned to one unit only during an event. SBOGs can be aligned to multiple units to supply limited loads.
The existing PRA model conservatively
does not credit SBOGs in more than one unit. Further, the plant design for FLEX and beyond FLEX modifications / capabilities provide additional 480V and 4160V supplies to safety buses not currently credited in the PRA models. For RICT Program implementation, PVNGS will consider, based on plant conditions and associated risk levels, risk management actions (RMAs) for use of FLEX equipment such as 480V and 4160V generators when electric power systems to risk significant equipment are unavailable under a RICT.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-3 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Reactor Coolant Pump (RCP)
Seal Leak or Rupture RCP Seal Leak or Rupture is not modeled as a loss of RCS Inventory safety function. Based on Westinghouse WCAP-15749 (Reference 6 of this Attachment) and pump seal vendor information, it was concluded that because of the very tight clearances, leakage into the seal package from the RCS is limited to about 17 gpm per pump. Each of the four RCPs has a seal package which
consists of three seals. As a result, even if the seal package on all four RCPs failed, the total leak rate would be within the capacity of two charging pumps and does not qualify as a LOCA.
An analysis showed that continuing to model RCP seal leakage and requiring charging pumps to mitigate the leakage represented an insignificant contribution to CDF or LERF, even assuming one of the three seals on each pump failed. The analysis also showed that modeling catastrophic failure due to operator failure to secure the pumps upon loss of cooling and seal injection was an insignificant contributor to CDF or LERF. If RCP seal parameters are not within normal limits indicating potential seal degradation while a RICT is in effect, RMAs will be used to ensure availability of charging pumps or other plant SSCs which can mitigate excessive RCP seal leakage. Loss of Coolant Accident (LOCA) Frequencies NUREG/CR-6928 (Reference 7 of this Attachment) restated the results from NUREG-1829 (Reference 8 of this Attachment). The LOCA frequencies are based upon expert elicitations. The LOCA sizes identified by the NRC are different from those estimated for PVNGS.
The slight variance in the range of break sizes for different LOCAs is not significant and is judged to have minimal impact on LOCA frequencies, within the uncertainties associated with the expert elicitation values, and of insignificant impact to RICT calculations. No special measures are required for the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-4 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Loss of Off-site Power (LOSP) Frequency The national LOSP data presented in the latest EPRI events reports (References 4 and 5 of this Attachment) was used to obtain point-estimates for switchyard centered and severe weather related LOSP frequencies. The EPRI Reports indicate that the generic LOSP data is subject to user modifications and scr eenings to fit the local plant designs and environmental conditions. This approach of LOSP screening is considered reasonable and necessary to avoid erroneous skewing of the LOSP data. The frequency of extreme weather LOSP category was obtained as that of the frequency of tornado occurrence with category F2 or higher. The frequency of grid related LOSP was obtained by Bayesian updating the reported value for western region (Western Electricity Coordinating Council) in the Draft NRC NUREG/CR-INEEL/EXT-04-02326 (Reference 9 of this Attachment). The LOSP frequencies are based on recent industry data and are appropriate to represent plant-specific conditions. SBOGs, as well as other additional electric power supplies, are available on site to mitigate LOSP. RMAs will consider, based on plant conditions and associated risk levels, these alternate AC sources for
applications of the RICT Program where LOSP events significantly contribute to configuration risk. Loss of Off-site Power at
Switchyard (LOSP) Associated Non-Recovery Probabilities The probabilities of offsite power non-recoveries were obtained from Table 4-1 of the draft NRC NUREG/CR-INEEL/EXT-04-02326. The error factors associated with LOSP frequencies and LOSP non-recovery probabilities were obtained from NUREG/CR-INEEL/EXT-04-02326 (when provided); otherwise, by using available in-house statistical programs for lognormal and Weibull distributions. The offsite power non-recovery probabilities are based on the best available data and are appropriate to represent plant-specific conditions. SBO diesel generators, as well as other additional electric power supplies, are available on site to mitigate LOSP. RMAs will consider, based on plant conditions and associated risk levels, these alternate AC sources for applications of the RICT Program where LOSP events significantly contribute to configuration risk.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-5 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Battery Life Assumptions The PVNGS batte ries are not credited in the long term, because they are conservatively assumed to be discharged after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Although the IEEE Class 1E batteries are designed to operate for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, Engineering has determined that the class batteries' life is at least 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Thus they are available for power recovery at the 3-hour point on the incident timeline. Crediting the actual higher capacities of the batteries and updated load shedding actions from Fukushima driven procedure changes would result in longer RICTs due to the additional mitigation capabilities made available. Therefore, the current PRA model use for the RICT Program is conservative and acceptable. Human Failure Events (HFEs) during a seismic event Accessibility for completion of non-screened human failure events (HFE) during a seismic event is assumed possible for all non-screened HFEs besides those which are assumed to fail in the case where the corridor building or turbine building collapses. Both the collapse of the corridor building and turbine building and their impact on the access to the Main Steam Support Structure is considered in the Seismic PRA model. There is a pinch point that leads into the MSSS that could restrict movement into the MSSS which would prevent local MSSS actions from being performed. A sensitivity analysis was performed evaluating the impact of not crediting the subject HFEs and there was minimal
impact on the CDF and LERF. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Seismic performance shaping factors (PSFs) with respect to seismic-induced flooding. Seismic-only PSFs applied to the internal events HEPs will over-ride the flooding PSFs based on the consideration that the seismic events are more global events than the specific flooding events. No additional mo difications are made to the internal events HEP to consider the possibility of seismic-induced flooding events. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-6 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The Seismic PRA HFE dependency analysis The Seismic PRA dependency analysis assumes that once an accident sequence is initiated, the operator action timing for a seismically induced event is similar to that of an internally induced event for main control room actions. The modification of the timing available due to seismic considerations may result in a longer response or identification time and consequently a higher HEP.
A sensitivity analysis was performed in the seismic PRA quanti fication increasing all the Seismic PRA human failure events (HFEs) derived from the internal events PRA model by a factor of 3 to address the uncertainty associated with main control room actions that might take longer in a seismic event versus an internal initiating event. The change in CDF and LERF was 9.7% and 5.3%, respectively. Therefore, the current Seismic PRA model used for the RICT Program will increase all Seismic HFEs by a factor of 3 to address this uncertainty.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-7 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic PRA Weighting factors applied to three approaches There is no standardized method to calculate human error probabilities (HEP) in a seismic PRA. Therefore, a mean HEP for each basic event was calculated by combining three accepted approaches [Surry, Kernkraftwerk Muhleberg (KKM), and Swiss Federal Nuclear Safety Inspectorate (ENSI) provided in Reference 10 of this Attachment] using the
following weighting factors: 0.7, 0.15, 0.15, respectively.
More emphasis was given to the Surry method since it was a selective combination of previous approaches and the most recently performed and published method. However, the Surry method has the potential to be the least conservative approach among the three methods. A sensitivity analysis was
performed that ran the Seismic PRA model using only the KKM and ENSI approaches, equally weighted. The change in CDF and LERF was -1.63% and 0.42%. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Relay chatter correlation Relay chatter between relays of the same manufacturer, model number, and plant location, i.e., building and elevation were assumed to be fully correlated. Also, each relay identified as a control switch, push button, or motor starter are fully correlated with other generic, like components. This is a conservative assumption because the demand experienced by a relay is dictated by in-cabinet response and not the in-structure response spectra (ISRS) which the binning is based. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Simplified Relay Fragility Parameters Low risk importance relays (based on Risk Achievement Worth) were treated with a simplified fragility analysis and higher importance relays (10 different types) were treated with a detailed fragility analysis. The simplified relay chatter fragility analysis assumed a c of 0.35 based on engineering judgment. This assumption is reasonable given that none of the c values for the relays evaluated using the detailed fragility analysis were determined to have a c below 0.33 and most had c of around 0.5. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-8 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure of relays and basic event mapping For the relays modeled in the Seismic PRA, the basic event associated with the seismic failure of the relay must be mapped to an existing internal events target basic event. A key source of modeling uncertainty is associated with the mapping of seismic basic events. Failure modes postulated for the PVNGS internal events model may not fully align with their assigned seismic
counterparts. PRA analyst experience is credited in the selection of the appropriate internal events PRA model component failure modes to reflect postulated seismic PRA model component failure modes. This selection was performed by Westinghouse PRA seismic experts and reviewed by APS PRA engineers. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Seismic PRA uses internal events PRA as a starting point The PVNGS Seismic PRA assumes that the internal events PRA that is used as a starting point meets the requirements of Capability Category II of the PRA standard.
The internal events PRA that was used to develop the Seismic PRA was evaluated separately for its PRA quality and was determined to meet Capability Category II of the PRA standard with the exception of System Notebook documentation, which is a commitment herein to fully address prior to RICT Program implementation.
Therefore, the current Seismic PRA model
used for the RICT Program is acceptable. Success criteria for Seismic
PRA If not otherwise specified, the success criteria associated with the internal events PRA logic are considered valid and applicable to accident sequences initiated by a seismic event. However, a standard 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time may not be suitable for a seismic-induced accident scenario because of the longer time needed for offsite power recovery. The base case Seismic PRA uses a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time for the run time of mitigating equipment. A sensitivity case was developed to assess the impact of using a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> mission time for equipment run failures. The change in overall CDF and LERF for this case is 2.73% and 0.69%, respectively.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-9 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Seismic failure correlation Seismic failures are assumed to be completely correlated. This assumption implies that a single basic event is used to model the seismic failure of components that are identified as pertaining to the same fragility. There's one exception to this where failures in the steam path in the Turbine Building are not considered correlated with failures of the feedwater lines. The validity of this assumption of complete correlation is still being discussed at the industry level. This is considered a conservative assumption.
Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Seismically induced Loss of Offsite Power (LOSP) The seismically induced LOSP is assumed to bound the fragility of non-seismic class system. This assumption implies that a number of non-seismic class systems are not addressed with a specific seismic failure.
The basis for this assumption is that seismically induced LOSP has a generally low seismic capacity. Scenarios where the non-seismic support systems incur seismically induced failures while offsite power is still available are considered realistic only for very low magnitude seismic events. Therefore, the most significant mitigating equipment will still be available. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the
RICT Program is acceptable. Seismic PRA LOSP recovery In the Seismic PRA, LOSP recovery is not credited for any seismic event above the safe shutdown earthquake (SSE), while it is credited with unchanged probability for a seismic event below the SSE.
It is realistic to consider that offsite power recovery is available for low magnitude seismic events. The selection of the SSE as a threshold between recovery/no-recovery of offsite power is arbitrary and conservative. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-10 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Screening of equipment in the Seismic Equipment List (SEL) Screening of equipment in the Seismic Equipment List (SEL) is based on fragility analysis. Equipment screened by the fragility team as inherently rugged is not modeled in the Seismic PRA for their seismic induced failure. In order to quantitatively capture the impact of screened out equipment, generic fragility parameters for the building that housed the
screened out equipment were used. The screened equipment are modeled through a surrogate basic event at a system level. Using a surrogate event for a number of components that have been screened out introduces a conservative failure mode. The uncertainty introduced by the use of surrogate equipment for the seismic class I system is judged to have a limited impact on the model. Therefore, the current Seismic PRA model used for the
RICT Program is acceptable.
Operators tripping the reactor above operating basis earthquake (OBE)
It is assumed that the operators will always trip the reactor in case of a seismic event above OBE if even the option for a controlled shutdown is allowed. This is considered a conservative assumption. Therefore, the current Seismic PRA model used for the RICT Program is acceptable. Train N Auxiliary Feedwater (AFN) Pump (AFN) is assumed to remain functional following a design basis earthquake The AFN Pump is assumed to remain functional with small breaks or leaks at instrument tubing. The fragility analysis associated with the AFN Pump only addresses the pump and not the entire piping network. A sensitivity case was developed to assess the uncertainty in crediting the AFN pump and not the associated piping network. The capacity of the AFN pump was reduced to the same system level fragility parameters associated with the instrument air system. CDF and LERF increased by 0.08% and 0.03% and
indicates little significance of uncertainty in this simplification of the analysis.
Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-11 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Main steam line relief valves not explicitly included in the SEL. Main steam line relief valves are screened out of the analysis on the basis that the steam generator and related piping & valves are considered very rugged. For this reason, the seismic failure of the main steam line relief valves is not modeled. A sensitivity case is developed to assess the impact of this assumption. A fully dependent seismic failure across all 20 relief valves is modeled. CDF and LERF values did not change when compared to the base case results. This indicates that no significant uncertainty. Therefore, the current Seismic PRA model used for the
RICT Program is acceptable. Structural failures of buildings Structural failures of building are assumed to result in major collapse and failure of all equipment hosted inside the building. This is a conservative assumption since the fragility parameters provided are addressing the beginning of the structural failure, and a failure of limited areas of the building may result in failure of only a limited number of equipment inside the building. The most significant example of this assumption is the structural failure of the Turbine Building assumed to be also impacting and failing the CST tunnel.
Therefore, the current Seismic PRA model
used for the RICT Program is acceptable.
The Anticipated Transient Without Scram (ATWS) logic
for seismic PRA The ATWS logic for seismic PRA assumes that the RCS pressure will be above the HPSI shutoff
head for only a short period of time.
Moderator Temperature Coefficient (MTC) and ATWS pressure transient are not influenced by the fact that the event is initiated by a seismic event rather than a spurious failure. Therefore, the success criteria developed for the internal events ATWS are considered valid for the seismic PRA. Therefore, the current Seismic PRA model used for the RICT Program is acceptable.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-12 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT All flood scenarios on the 40ft and 51ft elevations of the Auxiliary Building assumes that a pipe failure drains the Refueling Water Tank (RWT). A cutset review showed that the contribution of Fire Protection (FP) initiators is very low and that the Internal Flood results are not being skewed by this conservatism. This is a conservative approach and should not have a significant impact on the baseline Internal Flood model. This would not have a significant impact on the RICT Program.
A single internal events PRA
model was developed to quantify the plant flood risk for multiple units.
Since there are no significant differences between the units, the Unit 1 System, Structure, or Component (SSC) designators were used. It was therefore assumed th at the quantification results are applicable to all units.
It is a realistic assumption that the Unit 1 SSC designators are used, since there are no major differences between the three units in terms of internal flood. This would not have a significant impact on the RICT Program. All components within a flood area where the flood originates were assumed susceptible and failed as a result of the flood, spray, steam, jet impingement, pipe whip, humidity, condensation and temperature concerns except when component design (e.g., waterproofing) spatial effects, low pressure source potential or other reasonable judgment could be used for limiting the effect. This is a conservative a ssumption that simplifies the impacted component list. Uncertainty exists where exactly the flood would occur, the impact due to the geometry of the room and equipment, and the direction of the spray or splash for a given scenario. This assumption raises CDF. This is a conservative approach that simplifies the impacted component list.
This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-13 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Block walls are not credited in the analysis and are treated as typical plant walls. Unless a treatment is non-conservative, the block walls are analyzed on an individual basis.
The amount of water that could flow through the gaps is unknown. This has no impact as there were no scenarios where the failure of block walls would lead to a non-conservative treatment. This has no impact and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Breaks in pipes less than or equal to two inches in equivalent diameter were only considered if the break would directly result in a plant trip or result in a flood induced equipment failure that would result in a plant trip or immediate shutdown. The basis for this assumption is as follows:
- 1. Provides a practical limit to bound the scope of the analysis to potentially large flow rate and significant consequence events.
- 2. Pipe sizes of less than or equal to two inch diameter do not accurately reflect plant fluid system flood impacts (i.e. two inch diameter pipes produce significantly smaller flood rates).
- 3. At low flow rates, typical of pressure boundary failure in pipes less than or equal to two inches, the operator response time is longer and less stressful. Such conditions enhance operator actions signif icantly to successfully mitigate the breaks in small bore pipes.
However, piping less than two inches in diameter is considered on an individual basis when necessary for spray and flooding events. Specifically these events are considered in rooms without drains. Piping le ss than two inches was also considered for spatially specific spray events, however none were modeled and a detailed discussion of the possible events are documented. This is a conservative approach and is of low consequence to RICT.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-14 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Closed-loop systems and tanks were assumed to instantaneously release the entire system inventory This is a conservative approach that allows for the consideration of all consequences and does not require time based calculations. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Control Room staff would be unable to respond effectively to multiple events immediately following the flooding event Human Error Probability (HEP) and Performance Shaping Factors (PSF) adjustments were made during the early stages of a flooding event to account for the additional stress influencing factors. The CDF is higher with this assumption. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. No addition to the Control Room crew is credited early into a flood event when assessing human actions.
Operator actions to isolate the flood source are required shortly after detecting that a Pressure Boundary Failure (PBF) has occurred. Often when responding to flood events operators are responding to multiple alarms.
It is a realistic assumption that there would be no addition to the Control Room crew early into th e flood event when assessing human actions. This would not have a significant impact on the RICT Program. It is assumed that pipes that are larger than 3" were capable of producing major floods unless it was determined that the piping was not capable of producing a major flood. The assumption is conservative as it includes additional piping that may not be conducive to
major flooding. Since, major floods are not a major contributor to the Pressure Boundary Failure frequency, its contribution to risk would be considered minimal. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. External tanks were not
considered as a flood source unless there is a normally available pathway into the plant whereby the tank contents could empty into a room within the main plant
structures. External tanks that are ruptured would not normally propagate into th e plant. There were no tanks identified in this Internal Flood PRA that did not propagate into the plant. It was assumed that the impact of an external tank rupture was bounded by the evaluation performed for internal events. Breach of an external tank was assumed to discharge to the yard area and there would be no flood-induced failures of PRA related components. There is no significant impact on the model. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-15 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floods are assumed to fail all equipment in the initiating room and then propagate out of the room to surrounding flood areas.
Cases in which equipment is deemed as sufficiently high or flood barriers are not expected to retain water to sufficient flood levels are treated on an individual basis. Additionally, splitting the flood areas would generate an unreasonable number of scenarios with no added insight. The Top cutsets are not impacted, however if very specific isolation actions were taken this assumption could be significant. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Floods are assumed to propagate down pipe chases prior than down stairwells in situations where pipe chases are not surrounded by a curb and/or a door must be opened to enter into the stairwell. Water will flow down the path of least resistance therefore a pipe chase is the preferred path over a stairwell with a door in front. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Floods are assumed to propagate through doorways which open out, away from the initiating flood area more readily rather than doorways which open in, towards the initiating flood area. The hydrostatic load that a door can handle is based on whether the door closes against the frame or away (with relation to the room that the flood initiates). A door that is against the frame can withstand a greater load as opposed to away from the door frame. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-16 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Floor drains were assumed to be capable of controlling water levels for spray events. This assumption is based on the expectation that a spray event will not result in a significant accumulation of standing water. During plant walkdowns it was observed that drain entrances were maintained in proper working condition and free of debris. Drains were not credited for any flood or major flood events. It was assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank. Such events were screened out as potential flood sources. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. Grouping boundary condition sets for the LERF analysis results in conservative modeling of the containment isolation valves. Grouping boundary condition sets for the LERF analysis is a conservative approach. The LERF contribution of sequences that have been grouped for the LERF analysis and involve failure of containment isolation valves are considered very low. This is a conservative approach and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The piping layout for flood sources included in the Internal Flood PRA was shown and estimated to be similar for all three units. To the extent possible, the similarities were confirmed during the plant walkdowns.
Therefore, Units 2 and 3 pipe lengths were assumed to be identical to Unit 1 piping lengths. There are no major differences between the three units. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. It is assumed that if a PBF were to occur in the Safety Injection (SI) or Chemical &
Volume Control (CH) system piping, that the operator would isolate the flood at one of the two pipe headers connecting the Refueling Water Tank (RWT) to the CH and SI systems.
There are no operator procedures for isolating a flood event, therefore the most conservative and bounding location to isolate a flood of the SI or
CH is one of the two pipe headers. By isolating at this point it results in the loss of at least one train of the ECCS. This does cause a trip. Therefore the overall impact on the model is small. This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-17 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that spurious actuation of system relief valves would discharge a limited amount of inventory to a discharge tank and such events were screened out as potential flood sources. Spurious actuation of a system relief valve was not determined to be a credible flood source because the inventory that was released would be retained within the flood area and would not lead to an applicable initiating event. The risk is considered negligible as this is not considered to be a significant source of inventory. This is of low consequence to RICT. This would not have a significant impact on the RICT Program. Limited or no access to an area where flood initiation occurs was assumed. There was no credit taken for mitigation when the equipment relied on for mitigation was located in the flood initiation area. Operators cannot get into flooded areas. This is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Only one internal flood initiating event is assumed to occur at a time. The occurrence of simultaneous multiple independent internal flood events were considered to be very unlikely and were not considered in this evaluation. This is consistent with PRA modeling. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
The breach of isolation barrier(s) that may result in a maintenance-induced flood event was assumed to have no impact on altering the propagation paths related to other flooding mechanisms (i.e., pipe failure) for the flood source. This is a simplifying assumption that has negligible impact on the model. Propagation pathways were made to be conservative for all scenarios This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-18 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The indirect effects of a PBF on the operability of a closed looped system were considered to be immediate. Closed looped systems were considered to be normally operating and provides cooling to equipment that is relied on to maintain the plant in a power production state. It was therefore assumed that operator actions cannot be performed in a timely manner to preclude a plant trip. Most closed loop systems have a limited system capacity. A PBF would drain the system and in most cases an operator action to isolate the PBF would not be feasible. This assumption is conservative and raises CDF. This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The spill rate resulting from a PBF of a potential unlimited flood source that causes a spray event is low enough (i.e., <100 gpm) to have no significant impact on the operation of the affected system.
For a potentially unlimited source, a PBF that resulted in a spray event (<100 gpm) would take an extraordinary amount of time to cause a loss of that system. Additionally, given that for most of the large nearly unlimited sources the makeup capabilities of the system would generally exceed the flow rate generated by a spray event. It was therefore assumed that such systems have sufficient design margin to maintain the operability of the system and a plant trip would not occur. Note that for systems with a low system capacity (i.e. the CH system) this assumption was not valid. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-19 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The flow rate from a PBF is assumed static at the maximum possible rate and the scenario is only ended when the source was exhausted or isolated.
The spill rate resulting from a PBF of piping is considered to be the highest flow rate possible from the system or piping, and for tank is was assumed to be constant at an assumed flow rate, and for systems requiring pumps is considered the realistic pump flow rate, for the particular break in the originating flood area until the flood source was isolated or its water supply was limited or exhausted.
The accumulation of flood water in a flood area was considered halted when the flood source was terminated, or when outflow from the flood area matches or exceeds the inflow of flood water to the flood area. A constant maximum spill rate minimizes the time to reach the critical heights for SSCs that are susceptible to flooding. Spill rates were assumed to fall within the following categories:
- Spray events: 100 gpm
- Flood events: greater than 100 gpm but less than 2000 gpm (or maximum capacity of the system, whichever is lower)
- Major flood events: greater than 2000 gpm (or the maximum capacity of the system, whichever is lower) This is a conservative assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-20 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT The treatment of main steamline break and main feedwater line break internal events analysis was assumed to address the impact of these events in assessing whether main feedwater can be recovered following a reactor trip.
Recovery of feedwater is important for secondary side heat removal. The internal events analysis was believed to provide sufficient analysis to be used in the internal flooding model. This is of low consequence to RICT. This would not have a significant impact on the RICT Program.
It was assumed that minimal or no dependency existed between flood-specific and large early release specific Human Failure Events (HFEs). The flood HRA dependency analysis did not include large early release specific HFEs. HFEs specific to large early releases (i.e., post-core damage operator actions) are generally performed several hours after the initiating event occurs. No dependency between early and late operator actions. There is no impact on the model. This is of low consequence to RICT. This would not have a significant impact on the
RICT Program. The fire areas defined by the
Fire Hazards Analysis (which is contained in the UFSAR, Sections 9B.2.1 through 9B.2.22) will substantially contain the adverse effects of fires originating from any currently installed fixed ignition source or reasonably expected transient ignition source. Fire zone boundaries are similarly assumed adequate or combined. Fire areas are required by regulation to be "sufficiently bounded to withstand the hazards associated with the area" as defined in Generic Letter 86-10 (Enclosure 1 Section 4). Fire zone boundaries are similarly assumed adequate; however, because fire zones have a lesser pedigree than fire areas, their boundaries are verified adequately in this notebook by a FHA review and plant walkdowns. Fire zone boundaries that appear unable to withstand the fire hazards within the zone are combined. The fire PRA utilizes fire compartments which generally align with fire zones, but may be a combination of several fire zones. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-21 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Systems and equipment not credited in the fire-induced risk model (e.g., systems for which cable routing will not be performed) are assumed to be failed in the fire-induced risk model. These systems and equipment are failed in the worst possible failure mode, including spurious operation It is assumed that any fire will minimally result in a loss of Main Feedwater and subsequent reactor trip. This is a simplifying and
conservative assumption and is typical of Fire PRAs. However, it may not be true for all fires.
The assumption that any fire fails all equipment lacking cable routing information has the potential to affect the assessed fire risk. The assumption that any fire will minimally result in a loss of Main Feedwater and subsequent reactor trip likely adds conservatism to the Fire PRA results. However, the degree of conservatism is relatively small compared with other modeling uncertainties, since Main Feedwater will trip for most transient events.
The impact of these assumptions was evaluated by a sensitivity analysis case which concluded that the risk reduction due to crediting all components assumed always failed was small.
It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. There are no systems/components that are assumed failed in the fire PRA model that are within the RICT Program.
It is assumed that the Reactor Protection System (RPS) design is sufficiently fail-safe and redundant to preclude fire-induce failure to scram, or random failure to scram during a fire event, as a risk significant
contributor. RPS design is sufficiently fail-safe and redundant to preclude fire-induce failure to scram: Consistent with the guidance in NUREG/CR-6850 (Reference 11 of this Attachment) Section 2.5.1, type of sequences that can be generally eliminated from consideration in Fire PRA include sequences for which a low frequency argument can be made, and uses ATWS as a specific example, because fire-induced failures will almost certainly remove power from the control rods, resulting a trip, rather than cause a "failure to scram" condition. It is a realistic assumption and is of low consequence to RICT. This would not have a significant impact on the RICT Program. The low frequency of a fire occurring coincident with the low probability of independent failure to scram results in a negligible contribution to fire risk.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-22 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Properly sized and coordinated electrical protective devices are assumed to function within their design tripping characteristics, thus preventing initiation of secondary fires through circuit faults created by the initiating fire.
Electrical protection design calculations provide the documentation of the electrical coordination between overcurrent protective devices. An evaluation was performed to assess the Fire PRA power supply coordination requirements in accordance with NUREG/CR 6850, and provides a link to relevant PVNGS electrical coordination calculations that demonstrate selective tripping capability for each credited Fire PRA power supply (Reference 11 of this Attachment). When selective tripping cannot be demonstrated, the current fire PRA model credits plant modifications planned to correct the coordination. It is a realistic assumption and is of low consequence to RICT. Electrical coordination will either be established or the fire-induced impact will be modeled.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-23 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT It is assumed that Fire PRA targets were assigned the appropriate radiant heat flux damage and temperature damage criteria depending on the cable insulation information available. In other words, all raceways containing cables with thermoplastic or unknown cable insulation were assigned a radiant heat flux damage threshold of 6kW/m2 and 205 °C. All raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thresholds.
All raceways containing cables were assigned a radiant heat flux damage threshold of 6kW/m2 and 205 °C. Raceways containing cables with thermoset insulation only may be assigned a radiant heat flux damage threshold of 11 kW/m2 and 330 °C but have been initially assigned the thermoplastic damage thre sholds. A brief review of the dominant scenarios identified the existence of thermoplastic insulated cables within the target raceways. It is a realistic assumption and is of low consequence to RICT. It was concluded that minimal benefit could be obtained by further analysis to identify and model raceways containing only thermoset insulation.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-24 Table A13-1 Disposition of Key Assumptions/Sources of Uncertainty Impacting Configuration Risk Calculations Assumption / Uncertainty Discussion Disposition for RICT Planned plant modifications and recovery actions are assumed in the base case model. These modeled modifications are assumed to correct the fire vulnerability and not introduce any new failure modes. This approach introduces uncertainty in the results, because the actual modifications may vary for those assumed or they may not function as modeled. The assumed modifications are documented in the Fire PRA studies. Plant and model configuration and control mechanisms are in place to ensure that the fire model will be updated to correct the as-installed modifications.
One specific planned plant modification is the installation of an additional Steam Generator Makeup Pump to address Fire PRA risk. A sensitivity was performed that removes this modification from the model This assumption that the planned plant modifications will be installed and tested/operated as assumed in the fire PRA model has significant impact on the RICT Program. The assumption is realistic since the PRA analysis will provide details to the design modifications group in developing the plant modifications and procedures. The PRA model will be revised to reflect the as-built/as-operated plant configuration prior to implementation of the RICT Program.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 13 13-25 References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009 3. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009
- 4. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009
- 5. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, December 2008
- 6. WCAP-15749, Guidance for the Implementation of the CEOG Model for Failure of RCP Seals Given Loss of Seal Cooling, Revision 0, December 2008
- 7. NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, January 2007
- 8. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies through the Elicitation Process, Draft 9. NUREG/CR-INEEL/EXT 04-0236, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003 (Draft), October 2004
- 10. Westinghouse Calculation Note CN-RAM-12-022, Revision 1, Palo Verde Seismic Probabilistic Risk Assessment - Quantification, dated December 2, 2013
- 11. NUREG/CR-6850, Fire PRA Methodology for Nuclear Power Facilities, September 2005 Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times
ATTACHMENT 14 Program Implementation Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14 14-1 Program Implementation Introduction Section 4.0, Item 11 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license am endment request (LAR) provide a description of the implementing programs and procedures regarding the plant staff responsibilities for the RMTS implementation, and specifically discuss the de cision process for risk management action (RMA) implementation during a risk-informed completion time (RICT). This attachment provides the required description.
RICT Program Procedures Procedures will be developed to outline the re quirements and responsibilities for the RICT Program. The procedures will provide guidance on departmental responsibilities and management authority for RICT Program application, and for required training, implementation, and monitoring of the RICT Program, including development and maintenance of the configuration risk management program (CRMP) tool and models reflecting the as-built, as-operated plant.
The RICT Program will be implemented by site procedures, which will fully address all aspects of the guidance of NEI 06-09-A. Operations, specifically the control room staff, is responsible for compliance with technical specifications (TS) requirements, and will be responsible for implementation of a RICT and any risk management actions (RMA) determined to be appropriate for the plant configuration. Use of a RICT and associated RMA will be approved by the General Plant Manager prior to entering an extended completion time (CT) for pre-planned activities. For emergent conditions requiring an extended CT, the use of the RICT program will be approved by the applicable Operations Shift Manager or General Plant Manager.
These procedures will be supplemented as necessary to address the additional guidance of NEI 06-09-A for detailed implementation of the RICT Program, including guidance on the following topics:
- Performing a Tier 2 assessment for a RICT prior to entry into the TS limiting condition of operation (LCO)
- Plant conditions for which the RICT Program is applicable
- Conditions under which a RICT may not be used, or may not be voluntarily entered for the calculation of RICTs and RMA Times (RMAT)
- Implementation of RICT Program front stops, 30-day backstop and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> backstop limits
- Plant configuration changes [i.e., recalculating the RICT and RMAT within the lesser of the affected required action (RA) completion time or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of any change.]
- Conditions for exiting a RICT
- Requirements to identify and implement RMA when the RMAT is exceeded or is anticipated to be exceeded in accordance with PVNGS Protected Equipment procedure, and NEI 06-09-A
- The use of RMAs, including the conditions under which they may be credited in RICT calculations Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 14 14-2
- Crediting probabilistic risk assessment (PRA) functionality
- Approval processes for use of a RICT
- Determining PRA availability from detailed PRA functionality characteristics for each Technical Specification LCO
- Analyzing conditions for Common Cause Failures (CCFs), planned and emergent configurations, in accordance with NEI 06-09-A and the guidance of Regulatory Guide 1.177 (Reference 2 of this Attachment).
RICT Program Training
The scope of the training for the RICT Program will include training on rules and processes for the new RICT program, CRMP tool, TS Actions included in the program, and procedures. Training will be carried out in accordance with PVNGS training procedures and processes. Those organizations with functional responsibilities for performing or administering the CRMP shall have required training (e.g., licensed operators, work control personnel, PRA personnel, and station management).
Training will be provided to personnel responsible for performance of risk-managed technical specification (RMTS) actions. This training will be commensurate with the respective responsibilities of the personnel in the following areas:
- Programmatic requirements of RMTS program.
- Fundamentals of PRA including analytical methods employed and the interpretation of quantitative results. This training should include training on the potential impact of common cause failures, model assumptions and limitations, and uncertainties. The training also should address the implications of these factors in the use of PRA results in decision-making applicable to RMTS.
- Plant specific quantitative and qualitative insights obtained from the PRA.
- Operation of the plant configuration risk management tool and interpretation of results derived from its application.
References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 15 Monitoring Program Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 15-1 Monitoring Program Section 4.0, Item 12 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A requires that the license am endment request (LAR) provide a description of the implementation and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, (Reference 2 of this Attachment) and NEI 06-09-A. (Note that RG 1.174, Revision 2 (Reference 3 of this Attachment), issued by the NRC in May 2011, made editorial changes to the applicable section referenced in the NRC safety evaluation for Section 4.0, Item 12.)
This attachment provides a description of the process applied to monitor the cumulative risk impact of implementation of the risk-informed completion time (RICT) Program, specifically the calculation of cumulative risk of extended completion times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in RG 1.174, Element 3.
The calculation of cumulative risk impact is required by the RICT Program at least every refueling cycle, not to exceed 24 months, consistent with the guidance in NEI 06-09, Revision 0 - A. For the assessment period evaluated, data is collected for the risk increases associated with each application of the RICT Program for both core damage frequency (CDF) and large early release frequency (LERF), and the total risk calculated by summing the contributors to risk associated with each RICT application. This is the change in CDF or LERF above the zero maintenance baseline levels while a RICT was in effect (i.e., beyond the front-stop CT). The change in risk is converted to an average annual value.
The total average annual change in risk for extended CTs is compared to the guidance of RG 1.174, Figures 4 and 5 for CDF and LERF ch anges, respectively. If the actual annual risk increase is acceptable (i.e., not in Region I of the figures), then RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the RG 1.174 guidance and implementation of any necessary corrective actions to ensure future plant operation is within the guidance is conducted under the site Corrective Action Program.
The assessment will identify areas for consideration during the evaluation, including, as examples:
- Contributions from planned vs. emergent RICT applications
- Risk management actions (RMA) implemented but not credited in the risk calculations
- Offset risk due to RICT application by avoiding multiple shorter outages
- Reductions in risk levels through improvements in SSC availability and reliability due to different maintenance strategies and the operational flexibility made possible through the RICT Program Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 15 15-2 Based on the evaluation, any necessary corrective actions determined to be appropriate are developed and approved by the General Plant Manager or Operations Shift Manager. These may include:
- Administrative restrictions on the use of RICTs for specific high-risk configurations based on instantaneous risk levels
- Additional RMA for specific high-risk configurations
- Rescheduling planned maintenance activities
- Deferring planned maintenance to shutdown conditions
- Use of temporary equipment to replace ou t-of-service system s, structures or components (SSCs)
- Plant modifications to redu ce risk impact of expected future maintenance configurations In addition to the cumulative impact of RICT Program implementation, the unavailability of SSCs is also potentially impacted. The existing Maintenance Rule (MR) monitoring programs under 10 CFR 50.65(a)(1) and (a)(2) provide for evaluation and disposition of unavailability impacts that may be incurred by implementation of the RICT Program. The use of the MR Program is acceptable since the SSCs in the scope of the RICT Program are also in the scope of the MR. Using the existing MR monitoring for this program is explicitly discussed in RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, (Reference 4 of this Attachment), Section 3.2, "Maintenance Rule Control." The monitoring program for the MR, along with the specific assessment of cumulative risk impact described above, serves as the "Implementation and Monitoring Program," defined as Element 3 of RG 1.174 for the RICT Program.
References
- 1. NRC letter, Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), ML071200238, dated May 17, 2007
- 2. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002
- 3. Regulatory Guide 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011 4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications, Revision 1, May 2011
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times ATTACHMENT 16 Risk Management Action Examples Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-1 Risk Management Action Examples Introduction Section 4.0, Item 13 of the NRC Final Safety Evaluation (Reference 1 of this Attachment) for NEI 06-09-A, requires that the license amendment request (LAR) provide a description of the process to identify and provide compensatory measures and risk management actions (RMAs) during extended Completion Times (CTs), including specific examples.
This attachment describes the process for identification of risk management actions (RMA) applicable during extended CTs and provides examples of RMA. RMA will be governed by plant procedures for planning and scheduling maintenance activities. This procedure will provide guidance for the determination and implementation of RMA when entering the Risk-Informed Completion Time (RICT) Program and is consistent with the guidance provided in NEI 06-09-A (Reference 2 of this Attachment).
Responsibilities Work Planning / Work Management is responsible for identifying the need for RMA for planned work and Operations is responsible for identifying the need for RMA for emergent work. Operations, PRA and Fire Protection are responsible for developing the RMA.
Operations is responsible for implementation of RMA.
Procedural Guidance For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded. The RMA are implemented at the earliest possible time, without waiting for the actual RMAT to be exceeded as appropriate for the situation. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent ev ent occurs, requiring recalculation of a RMAT alread y in place, the procedure requires a re-evaluation of the existing RMA for the new plant configuration to see if new RMA ar e appropriate. These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A.
RMAs are put in place no later than the point at which the incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the point at which an incremental large early release probability (ILERP) of 1E-7 is reached. If as the result of an emergent event, the instantaneous core damage frequency (CDF) or the instantaneous large early release frequency (LERF) exceeds 1E-3 or 1E-4 per year, respectively, RMA are also required to be implemented. These requirements are consistent with the guidelines of NEI 06-09-A. By determining which structures, systems, or components (SSC) are most important from a CDF and/or LERF perspective for a specific plant configuration, RMA may be created to protect these SSCs. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF and/or LERF allows development of RMA that enhance the plant's capability to mitigate such events.
System-specific configuration risk management system guidelines (CRMSG) will be developed that will define the risk role of plant systems within the scope of the RICT Program, identify SSC explicitly modeled in the system, and Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-2 identify the key SSC failure modes for equipment explicitly modeled. Approved system-specific RMAs will be contained in the CRMSG and be available in each unit Control Room.
It is possible to credit RMAs in the RICT calculations, but such quantification of RMA is not required by NEI 06-09-A. Crediting RMA in the RICT calculations is only done consistent with the guidance of NEI 06-09-A.
NEI 06-09-A classifies RMA into thr ee categories, as described below:
- 1) Actions to increase awareness and control
- Shift brief
- Pre-job brief
- Training (formal or informal)
- Presence of system engineer or other expertise related to maintenance activity
- Special purpose procedure to identify risk sources and contingency plans
- 2) Actions to reduce the duration of maintenance activities
- Pre-staging materials
- Conducting training on mock-ups
- Performing the activity around the clock
- Performing walk-downs on the actual system(s) to be worked on prior to beginning work 3) Actions to minimize the ma gnitude of the risk increase
- Suspend/minimize activities on redundant systems
- Suspend/minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate
- Use temporary equipment for backup power
- Use temporary equipment for backup ventilation
- Reschedule other maintenance activities
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-3 Examples of specific RMAs that may be considered during a RICT Program entry are found in Table A16-1. These specific limiting condition of operations (LCOs) have been chosen in response to the requests addressed by Southern Nuclear in NL-17-0447 (Reference 3 of this Attachment).
Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition A - One required offsite circuit inoperable
- 1. Suspend/minimize discretionary activities on the Station Blackout Generators (SBOGs), the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power availability to the unit.
- 4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.
- 5. Suspend/minimize discretionary activities on Diesel Generators (DGs) and 4160 VAC bus(es) which could challenge the Availability of DGs and/or 4160 VAC safety bus(es).
- 6. Consider staging and connecting portable generators to the 4160 VAC safety bus(es).
- 7. Consider establishing the Outage Control Center (OCC) for oversight and monitoring of the compensatory measures and the actions described in this section.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-4 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition B - One Diesel Generator (DG) inoperable
- 1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.
- 4. Maintain Availability of 4160 VAC safety buses.
- 5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are
expected during the Risk-I nformed Completion Time.
- 8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.
- 9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-5 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition C - Two required offsite circuits inoperable
- 1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 4. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.
- 5. Maintain Availability of both DGs, and maintain Availability of 4160 VAC safety bus(es).
- 6. Consider staging and connecting portable generators per procedure to the 4160 VAC safety bus(es).
- 7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-6 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition D - One required offsite circuit inoperable AND one DG inoperable
- 1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. The redundant train DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the redundant Available DG.
- 4. Maintain Availability of 4160 VAC safety buses.
- 5. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 6. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 7. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are
expected during the Risk-I nformed Completion Time.
- 8. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.
- 9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-7 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition E - Two DGs inoperable
- 1. Weather conditions will be assessed prior to removing a DG from service during planned maintenance activities.
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. Maintain Availability of 4160 VAC safety buses.
- 4. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 5. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 6. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.
- 7. The Availability of the steam driven auxiliary feedwater pump will be verified before entering the DG Risk-Informed Completion Time.
- 8. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-8 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.1 AC Sources -
Operating Condition F - One automatic load sequencer inoperable
- 1. Weather conditions will be assessed prior to removing an automatic load sequencer from service during planned maintenance activities.
- 2. Should a severe weather warning be issued for the local area that could affect the switchyard or the offsite power supply during the Risk-Informed Completion Time, an operator will be available locally at the SBOGs should local operation of the SBOGs be required as a result of on-site weather related damage.
- 3. Perform a beginning of shift brief that focuses on actions operators will take in response to a loss of offsite power or safety injection. Include review of local emergency start of the DG, manual tie to the bus, and manual Class 1E 4160 VAC bus loading for the affected bus.
- 4. The DGs (along with all of its required systems, subsystems, trains, components, and devices) will be verified Available and no discretionary maintenance activities will be scheduled on the DGs.
- 5. Maintain Availability of 4160 VAC safety buses.
- 6. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 7. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 8. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the Risk-I nformed Completion Time.
- 9. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section..
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-9 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.4 DC Sources -
Operating Condition A - One battery charger on one subsystem inoperable
- 1. Limit the immediate discharge of the affected battery, if possible.
- 2. Recharge the affected battery to float voltage conditions using a spare battery charger, if possible.
- 3. Evaluate the remaining battery capacity and protect its ability to perform its safety function.
- 4. Periodically verify battery float voltage is equal to or greater than the minimum required float voltage for remaining batteries. 3.8.4 DC Sources -
Operating Condition B - One DC electrical power subsystem inoperable for reasons other than Condition A
- 1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 2. Suspend/minimize discretionary activities in the Salt River Project (SRP) switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 3. Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or Loss of Offsite Power (LOOP).
- 4. Work to establish alternate power to the 125 VDC bus by temporary modification or by implementation of FLEX procedures.
- 5. Maintain Availability of redundant and diverse electrical systems.
- 6. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.
- 7. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
3.8.7 Inverters
- Operating Condition A - One required inverter inoperable
- 1. Suspend/minimize discretionary activities on the SBOGs, the main and unit auxiliary transformers associated with the unit, and on the startup transformers. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).
- 2. Suspend/minimize discretionary activities in the SRP switchyard and on the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge off site power Availability to the unit.
- 3. Maintain Availability of DC electrical systems within the same train and the redundant train, associated 480 V bus, and associated regulating transformer.
- 4. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.
- 5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
Enclosure Description and Assessment of Proposed Amendment for Risk-Informed Completion Times Attachment 16 16-10 Table A16-1: Risk Management Actions During a RICT Program Entry TS LCO / Condition Risk Management Action(s) 3.8.9 Distribution Systems - Operating Condition A - One AC electrical powe r distribution subsystem inoperable
- 1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of a Class 1E 4160 VAC bus. Also, avoid unnecessary switching (i.e., breaker manipulations) in affected unit AC electrical systems.
- 2. Maintain Availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.
- 3. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
3.8.9 Distribution
Systems
- Operating Condition B - One AC vital instrument bus electrical power distribution subsystem inoperable
- 1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of an AC vital instrument bus.
- 2. Maintain Availability of inoperable subsystem's remaining electrical SSCs, as well as the other subsystems' electrical SSCs.
- 3. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.
- 4. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
3.8.9 Distribution
Systems - Operating Condition C - One DC electrical powe r distribution subsystems inoperable
- 1. Terminate in-progress maintenance/testing activities and defer scheduled maintenance/testing activities with the potential to cause loss of a DC electrical power distribution subsystem.
- 2. Suspend/minimize discretionary activities on the safety systems and important nonsafety equipment in the off-site power systems that can increase the likelihood of a plant transient (unit trip) or LOOP.
- 3. Maintain Availability of redundant and diverse electrical systems.
- 4. Evaluate weather predictions and take appropriate actions to mitigate potential impact s of severe weather.
- 5. Consider establishing the OCC for oversight and monitoring of the compensatory measures and the actions described in this section.
References:
- 1. Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI D6-09, "Risk-Informed Technical Specifications Initiative 48, Risk- Managed Technical Specifications (RMTS) Guidelines (TAG No. MD4995)," Letter from Jennifer M. Golder (NRR) to Biff Bradley (NEI), (ADAMS Accession Number dated ML071200238), dated May 17, 2007.
- 2. Nuclear Energy Institute (NEI) 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Industry Guidance Document, Nuclear Energy Institute, Revision 0-A, November 2006.
- 3. Vogtle Electric Generating Plant Units 1 and 2 Response to Request for Additional Information on Technical Specifications Change to Adopt Risk Informed Completion Times (ADAMS Accession Number ML17108A253), dated April 14, 2017.