ML082270312

Report of Changes to Technical Specifications Bases

ML082270312
Person / Time
Site:	Palisades
Issue date:	08/14/2008
From:	Lahti L Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML082270312 (123)

Text

Ewiergy Nucleai 0~~6m%ii0~1s, lnc.

Palisades Nuclear PlesPe 27780 Blue Siar Memorial !-lighviiay Coveti, MI 49043 Tel269 764 2000 August 14,2008 Technical Specification 5.5. 12.d U. S.Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Palisades Nuclear Plant Docket 50-255 License No. DPR-20

Dear Sir or Madam:

This report is subw8it"sd in accordance with Palisades Technical Specifica"con5.5.12.d, which requires that changes to the Technical Specifications Bases, implemented without prior Nuclear Regulatory Commission (NRC) approval, be provided "r the NRC on a frequency consistent with 10 CFR 50.71(e). Enclosure 1 provides a Pisang of all bases changes since issuance of the previous report, dated August 16,2007, and identifies the affecbd sections and nature of the changes. Enclosure 2 provides page change instructions and a copy of the current Technical Specifications Bases kist of Effective Pages, Title Page, Table of Contenk, and the revised Technical Specifica"son Bases sections iisted in Enclosure I .

This letter contains no new commitments and no revisions to existing commitments.

Laurie A. Lahti Licensing Manager Palisades Nuclear Plant Enclosures (2)

CC Administrator, Region 811, USNRC Project Manager, Palisades, USNRC Resident Inspector, Palisades, USNRC

ENCLOSURE I TECIANlCAb SPECIFICATION BASES CHANGE CHRONOLOGY described in~ngineeringChange (EC) 8350, "Replace Containment Spray Isolation Valves per Generic Safety issue (GSI)-191 Resolution."

10/08/2007 B 3.5.2 Bases changes to reflect Amendment 228 to the Palisades Technical Specifications (TS)

. .

(GSI-191 Passive Strainer).

10/08/2007 B 3.5.4 Bases changes to reflect Amendment 227 to the Palisades TS (Buffering Agent).

1"128/2007 B 3.7.4 Bases changes to align with current design -

basis and Updated Final Safety Evaluation -

I I I Report (UFSAR) Chapter 14 safety analyses I with respect lo Atmospheric ~ u m 'Valves.

p 03/20/2008 a3 3.3.1 Bases change added amplifying information to I I I Table B 3.3.1 -1 for entry concerning Wide 1 Range N1-113 and 214 Flux Level Indication.

0312012008 B 3.4.13 Bases change modified SR 3.4.13.1 discussion to align with-new method for conducting the primary coolant system water inventory balance. New method does not require "re suweillance "r be performed at near operating pressure.

03/20/2008 iB 3.3.3 Bases change to reflect plant modification described i n ~ C 8 3 5 066dep~ace

, Containment Spray Isolation Valves per GSI-191 Resolution."

0611212008 B 3.7.10 Bases change to reflect Amendment 230 to the I I I Palisades TS (Control Room Envelope I 0711612008 B 3.7.4 Bases change to correct UFSAR section I number refeknce.

Page 1 of 1

ENCLOSURE 2 REVISED TECHNlCAL SPECIFICATIONS BASES Page Change Instructions List of Effective Pages Title Page Table 06"Contents B 3.3.1, B 3.3.3,B 3.4.13, B 3.5.2, B 3.5.4, B 3.5.5, B 3.6.6, B 3.7.4, B 3.7.10 120 Pages Follow

Revise your copy of the Palisades Technical Specifications Bases with the attached revised pages. The revised pages are iden"rifed by amendment number or revision date at the bottom of the pages and contain vertical lines in the margin indicating the areas of change.

REMOVE INSERT Listof Effective Pages List of Effective Pages Title Page Title Page Table of Contents Table of Contents Section B 3.3.1 Section B 3.3.1 Section B 3.3.3 Section B 3.3.3 Section B 3.4.1 3 Section B 3.4.13 Section B 3.5.2 Section B 3.5.2 Section B 3.5.4 Section B 3.5.4 Section B 3.5.5 Section B 3.5.5 Section B 3.6.6 Section B 3.6.6 Section B 3.7.4 Section B 3.7.4 Section B 3.7.1 0 Section B 3.7.10

PALISADES TECHNICAL SPEGlFlCATlONS BASES LiiSI OF EFFECTIVE PAGES COVERSHEET Title Page 232 - Revised 0w12/08 TABLE OF CONTENTS Pages i and ii Revised 1 1/28/07 TECHNICAL SPECIFICATIONS BASES Bases 2.0 Pages B 2.1.1-1 - B 2.1.1-4 Revised 09/28/01 Pages B 2.1.2-1 - B 2.1-2-4 189 Bases 3.0 Pages B 3.0 B 3.0-1 6 Revised 02/24/05 Bases 3.1 Pages B 3.1.%-I - 5 3.1.l-5 189 Pages B 3.1-2-1 - B 3.1.2-6 Revised 09/09/03 Pages B 3.1.3-1 - B 3.1.3-4 189 Pages B 3.1.4-1 - B 3.1.4-13 Revised 071%8/07 Pages B 3.1.5-1 - B 3.15-7 Revised 07/02/04 Pages B 3.1.6-1 - 5 3.1-6-9 Revised 07130103 Pages B 3.1.7-1 - i3 3.1-7-6 Revised 051%5/07 Bases 3.2 Pages B 3.2.1 B 3.2.1-1 1 Revised 08/06/04 Pages B 3.2.2-1 - B 3.2.2-3 Revised 09/28/01 Pages B 3.2.3-1 - B 3.2.3-3 Revised 09/28/01 Pages B 3.2.4-1 - B 3.2.4-3 189 - Revised 08/09/00 Bases 3.3 Pages B 3.3.1 B 3.3.1-35 Revised 03120108 Pages 5 3.3.2-1 - B 3.3.2-10 189- Revised 02112/01 Pages B 3.3.3-1 - B 3.3.3-24 Revised 03/20/08 Pages B 3.3.4-1 - B 3.3.4-12 Revised 09/09/03 Pages B 3.3.5-1 - B 3.3.5-6 Revised 01126104 Pages B 3.3.6-1 - B 3.3.6-6 189- Revised 02/112/01 Pages 5 3.3.7-1 - 5 3.3.7-12 Revised 04119/05 Pages B 3.3.8-1 - B 3.3.8-6 Revised 02/24/05 Pages B 3.3.9-1 - B 3.3.9-5 189 - Revised 08/09/00 Pages B 3.3.10-1 - B 3.3.10-4 189 Bases 3.4 Pages B 3.4.1 B 3.4.1-4 Revised 08/24/04 Pages B 3.4.2-1 - B 3.4.2-2 189 Pages B 3.4.3-1 - B 3.4.3-7 Revised 01127105 Pages B 3.4.4-1 - B 3.4.4-4 Revised 09/21106 Pages B 3.4.5-1 - B 3.4.5-5 Revised 09121/06 Pages B 3.4.6-1 - B 3.4.6-6 Revised 07/31107 Pages B 3.4.7-1 - 5 3.4.7-7 Revised 07/31107 Pages B 3.4.8-I- B 3.4.8-5 Revised 07/31107 Pages B 3.4.9-1 - B 3.4.9-6 189 Pages 5 3.4.1 0 B 3.4.1 0-4 189 Pages B 3.4.1 1 B 3.4.11-7 Revised 02/24/05 Pages B 3.4.12-1 - B 3.4.112-13 Revised 02/24/05 Pages 5 3.4.1 3 B 3.4.1 3-7 Revised 03/20/08 Pages 5 3.4.1 4 5 3.4.1 4-8 189- Revised 08/09/00 Pages B 3.4.15 5 3.4.15-6 Revised 02/24/05 Pages B 3.4.1 6 5 3.4.1 6-5 Revised 02/24/05 Pages B 3.4.1 7 B 3.4.1 7-7 223 Revised 0711 612008

PALISADES TECHNICAL SPECIFICATIONS BASES LAST OF EFFECTIVE PAGES Bases 3.5 Pages B 3.5.1 B 3.5.6-5 189 Page B 3.5.1 -6 191 Page 8 3.5.1 -7 189 Page B 3.5.1 -8 191 Pages B 3.5.2 B 3.5.2-12 228 Pages B 3.5.3 B 3.5.3-4 Revised 07/22/02 Pages B 3.5.4 B 3.5.4-7 227 Pages B 3.5.5 B 3.5.5-5 227 Bases 3.6 Pages B 3.6.1 B 3.6.1 -4 Revised 12110/02 Pages B 3.6.2 B 3.6.2-8 Revised 08112/03 Pages B 3.6.3 B 3.6.3-12 Revised 03/02/04 Pages B 3.6.4 B 3.6.4-3 Revised 04/27/01 Pages B 3.6.5 B 3.6.5-3 Revised 09/09/03 Pages B 3.6.6-"1 B 3.6.6-12 227 Bases 3.7 Pages Revised 08/06/04 Pages Revised 12/02/02 Pages Revised 12/02/02 Pages Revised 07116/08 1 Pages Revised 02/24/05 Pages Revised 07/31107 Pages Revised 06/07/05 Pages Revised 08/01/01 Pages Revised 07116/01 Pages 230 Pages 189 Pages Revised 07116/03 Pages 189 - Revised 08/09/00 Pages Revised 09/09/03 Pages 207 Pages 207 Pages Revised 07/22/02 Bases 3.8 Pages Revised 02/24/05 Pages Revised 11/06/01 Pages Revised 07/22/02 Pages Revised 07113/06 Pages Revised 11/06/01 Pages 189 - Revised 08/09/00 Pages 189 Pages Revised 11/06/01 Pages Revised 11106101 Pages Revised 11/06/01 Bases 3.9 Pages B 3.9.1 B 3.9.1 -4 189 - Revised 08/09/00 Pages B 3.9.2 B 3.9.2-3 189 - Revised 02112/01 Pages B 3.9.3 B 3.9.3-6 189 - Revised 08/09/00 Pages B 3.9.4 B 3.9.4-4 Revised 07/31107 Pages B 3.9.5 B 3.9.5-4 Revised 07/31107 Pages B 3.9.6 B 3.9.6-3 189 - Revised 02/27/01 Revised 0711612008

PALlSADES PLANT FACILITY OPERATING LICENSE BPR-20 APPENDIX A TECHNICAL SPEClFlCATlONS As Amended Through Amendment No. 232 Revised 06112/2008

B 2.0 SAFETY LIMITS (SLs)

E3 2.1.1 Reactor Core SLs B 2.4.2 Primary Coolant System (PCS) Pressure SL B 3.0 LIMITING GONDiTlON FOR OPERATION (LGO) APPLIGABILIITY B 3.0 SURVEIILLANCE REQUIREMENT (SR) APPLICABILITY 83 3.1 REACTlVlTY CONTROL SYSTEMS B 3.1.I SHUTDOWN MARGIN (SDM)

B 3.4.2 Reactivity Balance B 3.1.3 Moderator Temperature Coefficient (MTC)

B 3.1.4 Control Rod Alignment B 3.1.5 Shutdown and Part-Length Rod Group Insertion Limits B 3.1.6 Regulating Rod Group Position Limits B 3.1.7 Special Test Exceptions (STE)

B 3.2 POWER DISTRBBUTION LIMITS B 3.2.1 Linear Heat Rate (LHR)

B 3.2.2 TOTAL RADIAL PEAKING FACTOR ( F ~ ~ )

B 3.2.3 QUADRANT POWER TILT (Tq)

B 3.2.4 AXIAL SHAPE INDEX (ASI)

Reactor Protective System (RPS) Instrumentation Reactor Protective System (RPS) Logic and Trip Initiation Engineered Safety Features (ESF) lnstrumentation Engineered Safety Features (ESF) Logic and Manual Initiation Diesel Generator (DG) - Undervoltage Start (UV Start)

Refueling Containment High Radiation (CWR) Instrumentation Post Accident Monitoring (PAM) lnstrumentation Alternate Shutdown System Neutron Flux Monitoring Channels Engineered Safeguards Room Ventilation (ESRV) lnstrumentation B 3.4 PRIMARY COOLANT SYSTEM (PCS)

PCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits PCS Minimum Temperature for Criticality PCS Pressure and Temperature (PIT) Limits PCS Loops - MODES 1 and 2 PCS LOOPS- MODE 3 PCS LOOPS - MODE 4 PCS Loops - MODE 5, Loops Filled PCS Loops - MODE 5, Loops Not Filled Pressurizer Pressurizer Safety Valves Pressurizer Power Operated Relief Valves (PORVs)

Low Temperature Overpressure Protection (LTOP) System PCS Operational LEAKAGE PCS Pressure Isolation Valve (PIV) Leakage PCS Leakage Detection lnstrumentation PCS Specific Activity Steam Generator (SG) Tube Integrity Palisades Nuclear Plant i Revised 11/28/2007

B 3.5 EMERGENCY GORE COOLING SYSTEMS (ECCS)

B 3.5.1 Safety Injection Tanks (SITS)

B 3.5.2 ECCS - Operating B 3.5.3 ECCS - Shutdown B 3.5.4 Safety Injection Refueling Water Tank (SIRWT)

B 3.5.5 Containment Sump Buffering Agent and Weight Requirements B 3.6 CONTAINMENT SYSTEMS B 3.6.1 Containment B 3.6.2 Containment Air Locks B 3.6.3 Containment Isolation Valves B 3.6.4 Containment Pressure B 3.6.5 Containment Air Temperature B 3.6.6 Containment Cooling Systems B 3.7 PLANT SYSTEMS B 3.7.1 Main Steam Safety Valves (MSSVs)

B 3.7.2 Main Steam Isolation Valves (MSIVs)

B 3.7.3 Main Feedwater Regulating Valves (MFRVs) and MFRV Bypass Valves B 3.7.4 Atmospheric Dump Valves (ADVs)

B 3.7.5 Auxiliary Feedwater (AFW) System B 3.7.6 Condensate Storage and Supply B 3.7.7 Componen"rooling Water (CCW) System B 3.7.8 Service Water System (SWS)

B 3.7.9 Ultimate Heat Sink (UHS)

B 3.7.10 Control Room Ventilation (CRV) Filtration B 3.7.1 1 Control Room Ventilation (CRV) Cooling B 3.7.12 Fuel Handling Area Ventilation System B 3.7.13 Engineered Safeguards Room Ventilation (ESRV) Dampers B 3.7.14 Spent Fuel Pool (SFP) Water Level B 3.7.15 Spent Fuel Pool (SFP) Boron Concentration B 3.7.16 Spent Fuel Assembly Storage B 3.7.17 Secondary Specific Activity B 3.8 ELECTRICAL POWER SYSTEMS AC Sources - Operating AC Sources - Shutdown Diesel Fuel, Lube Oil, and Starting Air DC Sources - Operating DC Sources - Shutdown Battery Cell Parameters Inverters - Operating Inverters - Shutdown Distribution Systems - Operating Distribution Systems - Shutdown B 3.9 REFUELING OPERATIONS B 3.9.1 Boron Concentration B 3.9,:2 Nuclear Instrumentation B 3.9.3 Containment Penetrations B 3.9.4 Shutdown Cooling (SDC) and Coolant Circulation - High Water Level B 3.9.5 Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level B 3.9.6 Refueling Cavity Water Level Palisades Nuclear Plant ii Revised 1-l/28/2007

B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective Sys"cm (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor trip to protechgainst violating the acceptable fuel design limits and breaching the reactor coolant pressure boundary during Anticipated Operational Occurrences (AOOs). (As defined in 10 CCFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.") By tripping "re reactor, the RPS also assists the -

-.

Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipmen~elt"ormance.

The LSSS, defined in this Specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During BOOS, which are those events expected to occur one or more times during the plant life, the acceptable limits are:

The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above "te Safety Limit (SL) value 'lo prevent departure from nucleate boiling; Fuel cenkrline melting shall not occur; and The Primary Coolant System (PCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during AOOs.

Palisades Nuclear Plant B 3.3.1-1 Revised 03/20/2008

BASES BACKGROUND Accidents are events thatare analyzed even though they are not (continued) expected to occur during the plant life. The acceptable limit during accidents is "rat the offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS is segmented into four interconnected modules. These modules are:

Measurement channels; RPS trip units; Matrix Logic; and Trip Initiaion Logic.

This L C 0 addresses measurement channels and RPS trip units. It also addresses the automatic bypass removal feature for those trips with Zero Power Mode bypasses. The RPS Logic and Trip Initiation Logic are addressed in L C 0 3.3.2, "Reactor Protective System (RPS) Logic and Trip Initiation." The role of the measurement channels, RPS trip units, and RPS Bypasses is discussed below.

Measurement Channels Measuremen"rhhanels, consisting of pressure switches, field transmiMers, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

With the exception of Hi Starlup Rate, which employs two instrument channels, and Loss of Load, which employs a single pressure sensor, four identical measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated channels A through D.

Some measurement channels provide inputto more than one RPS trip unit within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features (SF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1 -2 Revised 03/20/2008

RPS Inslrcsmentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

In the case of Hi Startup Rate and Loss of Load, where fewer than four sensor channels are employed, the reactor trips provided are not relied upon by the plant safety analyses. The sensor channels do however, provide trip inputsignals to all four RPS channels.

When a channel monitoring a parameter exceeds a predetermined setpoint, indicating an abnormal condition, the bistable monitoring the parameter in that channel will trip. Tripping two or more channels of bistable trip units monitoring the same parameter de-energizes Matrix Logic, (addressed by LC0 3.3.2) which in turn de-energizes the Trip Initiation Logic. This causes all four DC clutch power supplies to de-energize, inkrrupting power to the control rod drive mechanism -

-

clutches, allowing the full length control rods to inseri into the core.

For those trips relied upon in the safety analyses, three of the four measurement and trip unit channels can meetthe redundancy and testability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LC0 requires, however, that four channels be OPERABLE. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip channel bypassed) for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation, this arrangement meets the requirements of IEEE Standard 279-1971 (Ref. 3).

Most of the RPS trips are generated by comparing a single measurement to a fixed bistable setpoint. Two trip Functions, Variable High Power Trip and Thermal Margin Low Pressure Trip, make use of more than one measurement to provide a trip.

The required RPS Trip Functions utilize the following input insbumentation:

Variable H i ~ Power h Trip (VHPT)

The VHPT uses Q Power as its input. Q Power is the higher of NI power from the power range NI drawer and primary calorimetric power (AT power) based on PCS hot leg and cold leg temperatures. The measurement channels associated with the VHPT are the power range excore channels, and the PCS hot and cold leg temperature channels.

Palisades Nuclear Plant B 3.3.1-3 Revised 03/20/2008

WPS li~strurnentatiolr B 3.4.1 BASES BACKGROUND Measurement Channels (con"cnued)

Variable High Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signal processing necessary to calculate the TMILP trip setpoint, VHPT trip setpoint and trip comparison, and Q Power calculation. On power decreases the VHPT setpoint tracks power levels downward so that it is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point it increases to the new setpoint, a fixed increment above Q Power at the time of reset, subject to a -

maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

The High Staflup Rate trip uses the wide range Nuclear Instruments (Nls) to provide an input signal. There are only two wide range Nl channels. The wide range channel signal processing electronics are physically mounted in RPS cabinet channels C (NI-113) and D (NI-214). Separate bistable trip units mounted within the N1-113 wide range channel drawer supply High Startup Rate trip signals to RRPS channels A and C. Separate bistable trip units mounted within the NI-214 wide range channel drawer provide High Startup Rate trip signals to RPS channels B and D.

e LOWPrimarv Coolant Flow Trip The bow Primary Coolant Flow Trip utilizes 16 flow measurement channels which monitor the differential pressure across the primary side of the steam generators. Each RPS channel, A, B, 6 , and D, receives a signal which is the sum of four differential pressure signals. This totalized signal is compared with a setpooint in the RPS Low Flow bistable trip unitfor that RPS channel.

Palisades Nuclear Plant B 3.3.1-4 Revised 03/20/2008

BASES BACKGROUND Measurement Channels (continued)

(continued)

Low Steam Generator Level Trips There are two separate Low Steam Generator Level trips, one for each steam generator. Each Low Steam Generator Level trip monitors four level measurement channels for the associated steam generator, one for each RPS channel.

Low Steam Generator Pressure Trips There are also two separate Low Steam Generator Pressure trips, one for each steam generator. Each Low Steam Generator Pressure trip monitors four pressure measurement channels for -

the associated steam generator, one for each RPS channel.

High Pressurizer Pressure Trip The High Pressurizer Pressure Trip monitors four pressurizer pressure channels, one for each RPS channel.

Thermal Marcrin Low Pressure (TMILP) Trip The TMILP Trip utilizes bistable trip units. Each of these bistable trip units receives a calculated trip setpoint from the Thermal Margin Monitor (TWIM) and compares it to the measured pressurizer pressure signal. The TMILP setpoinl is based on Q power (the higher of NU power from the power range NU drawer, or AT power, based on PCS hot leg and cold leg temperatures) pressurizer pressure, PCS cold leg temperature, and Axial Shape Index. The TMM provide the complex signal processing necessary to calculate the TMILP trip setpoint, TMILP trip comparison signal, and Q Power.

Palisades Nuclear Plant B 3.3.1 -5 Revised 0312012008

RPS lilslrumen'ca.tian B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

Loss of Load Trip The Loss of Load trip uses a single pressure switch, 63lAST-2, in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units. The Loss of Load Trip is actuated by turbine auxiliary relays 305L and 305R. Relay 305L provides input to RPS channels A and C; 305R to channels B and D.

Relays 305L and 305R are energized on a turbine trip. Their inputs are the same as the inputs lo the turbine solenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, auto -.

stop oil pressure switch 63lAST-2 will actuate relays 305L and 305R and generate a reactor trip. If a turbine trip is generated by an input to the solenoid trip valve, relays 305L and 305R, which are wired in parallel, will also be actuated and will generate a reactor trip.

Containment High Pressure Trip The Containment High Pressure Trip is actuated by four pressure switches, one for each RPS channel.

Zero Power Mode Bypass Automatic Removal The Zero Power Bypass allows manually bypassing (i.e., disabling) four reactor trip functions, Low PCS Flow, Low SG A Pressure, Low SG B Pressure, and TMILP (low PCS pressure),

when reactor power (as indicated by the wide range nuclear instrument channels) is below This bypassing is necessary to allow RPS testing and control rod drive mechanism testing when the reactor is shutdown and plant conditions would cause a reactor "rip to be present.

The Zero Power Mode Bypass removal interlock uses the wide range nuclear instruments (Nls) as measurement channels.

There are only two wide range Nl channels. Separate bistables are provided to actuate the bypass removal for each RPS channel. Bistables in the N1-113 channel provide the bypass removal function for RPS channels A and C; bistables in the NI-214 channel for RPS channels B and D.

Palisades Nuclear Plant B 3.3.1 -6 Revised 03/20/2008

BASES BACKGROUND Several measurement instrument channels provide more than one (continued) required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

RPS Trip Units Two types of RPS trip units are used in the RPS cabinets; bistable trip units and auxiliary trip units:

A bistable trip unit receives a measured process signal from its instrumentchannel and compares it to a setpoint; the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the measured signal is less conservative than the setpoint. -

They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open or closed); the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the digital input is received. They also provide local trip indication and remote annunciation.

Each RPS channel has four auxiliary trip units and seven bistable trip units.

The contacts from these trip unit relays are arranged into six coincidence matrices, comprising the Matrix Logic. If bistable trip units monitoring the same parameter in at least two channels trip, the Matrix Logic will generate a reactor trip (two-out-of-four logic).

Four of the RPS measurement channels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpointis not necessary. In these cases, the bistable trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contac"rultiplication so the single input contact opening can provide multiple contact outputs to the coincidence logic as well as trip indication and annunciation.

I Palisades Nuclear Plant B 3.3.1 -7 Revised 03/20/2008

RPS Ins2rmra?ei?taPion B 3.3.1 BASES BACKGROUND (continued)

Trips employing auxiliary trip units include "re VHPT, which receives contact inputs from the Thermal Margin Monitors; the High Startup Rate trip which employs contact inputs from bistables mounted in the two wide range drawers; the Loss of Load Trip which receives contact inputs from one of two auxiliary relays which are operated by a single switch sensing turbine auto stop oil pressure; and the Containment High Pressure (CHP) trip, which employs containment pressure switch contacts.

There are four RPS trip units, designated as channels A through D, each channel having eleven trip units, one for each RPS Function. Trip unit outputrelays de-energize when a trip occurs. -

All RPS Trip Functions, with the exception of the Loss of Load and CHP trips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plantprocedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plan"rocuments. A channel is inoperable if its actual setpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onsetof the AOO or DBA and the equipment functions as designed.

Note that in the accompanying LC0 3.3.1, the Allowable Values of Table 3.3.1 -1 are the LSSS.

Palisades Nuclear Plant .3.1-8 Revised 03/20/2008

BASES BACKGROUND (continued)

Three different types of trip bypass are utilized in the RPS, Operating Bypass, Zero Power Mode Bypass, and Trip Channel Bypass. The Operating Bypass or Zero Power Mode Bypass prevent the actuation of a trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the trip unit output from affecting the Logic Matrix. A channel which is bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must be considered to be inoperable.

Operating Bypasses The Operating Bypasses are initiated and removed automatically during -.

-

startup and shutdown as power level changes. An Operating Bypass prevents the associated RPS auxiliary trip unit from receiving a trip signal from the associated measurement channel. With the bypass in place, neither the pre-trip alarm nor the trip will actuate if the measured parameter exceeds the set point. An annunciator is provided for each Operating Bypass. The RPS trips with Operating Bypasses are:

a. High Startup Rate Trip bypass. The High Startup Rate trip is automatically bypassed when the associated wide range channel indicates below 1E-4% RTP, and when the associated power range excore channel indicates above 13% RTP. These bypasses are automatically removed between 1E-4% RTP and 13% RTP.

b. Loss of Load bypass. The Loss of Load trip is automatically bypassed when the associated power range excore channel indicates below 17% RTP. The bypass is automatically removed when the channel indicates above the setpoint. The same power range excore channel bistable is used to bypass "ce High S"Er"rp Rate trip and the Loss of Load trip for that RPS channel.

Palisades Nuclear Plant B 3.3.1 -9 Revised 03/20/2008

RPS Bns4rumenta"Em B 3.3.1 BASES BACKGROUND (continued)

(continued)

Each wide range channel contains two bistables set at 1 5 4 % RTP, one bistable unitfor each associated RPS channel. Each of the two wide range channels affectthe Operating Bypasses for two RPS channels; wide range channel NI-113 for RPS channels A and C, wide range channel NI-2/4 for RPS channels B and D. Each of the four power range excore channel affects the Operating Bypasses for the associated RPS channel. The power range excore channel bistables associated with the Operating Bypasses are set at a nominal 15%, and are required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass

""

The ZPM Bypass is used when the plant is shutdown and it is desired to raise the control rods for control rod drop testing with PCS flow, pressure or temperature too low for the RPS trips to be reset. ZPM bypasses may be manually initiated and removed when wide range power is below 1E-4% RTP, and are automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. A ZPM bypass prevents the RPS trip unit from actuating if the measured parameter exceeds the set point. Operation of the pretrip alarm is unaffected by the zero power mode bypass. An annunciator indicates the presence of any ZPM bypass. The RPS trips with ZPM bypasses are:

a. Low Primary Coolan"rystem Flow.

b. Low Steam Generator Pressure.

c. Thermal MarginILow Pressure.

The wide range NI channels provide contact closure permissive signals when indicated power is below 1E-4% RTP. The ZPM bypasses may then be manually initiaked or removed by actuation of key-lock switches.

One key-lock switch located on each RPS cabinet controls the ZPM Bypass for the associated RPS trip channels. The bypass is automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. The same wide range NI channel bistables that provide the ZPM Bypass permissive and removal signals also provide the high startup rate trip Operating Bypass actuation and removal.

Palisades Nuclear Plant Revised 03/20/2008

BASES BACKGROUND (continued)

A Trip Channel Bypass is used when it is desired to physically remove an individual trip unit from the system, or when calibration or servicing of a trip channel could cause an inadvertent trip. A trip Channel Bypass may be manually initiated or removed at any time by actuation of a key-lock switch. A Trip Channel Bypass prevents the trip unit output From affecting the RPS logic matrix. A light above the bypass switch indicates thatthe trip channel has been bypassed. Each RPS trip unit has an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.

The key cannot be removed when in the bypass position. Only one key for each trip parameter is provided, therefore the operator can bypass -

only one channel of a given parameter at a time. During the bypass condition, system logic changes from two-out-of-four to two-out-of-three channels required for trip.

APPLICABLE Each of the analyzed accidents and transients can be detected by one SAFETY ANALYSES or more RPS Functions. The accident analysis contained in Reference 4 takes credit for rnos"rPS trip Func"Eons. The High Startup Rate and Loss of Load Functions, which are not specifically credited in the accident analysis are part of the NRC approved licensing basis for the plant. The High Starkup Rate and Loss of Load trips are purely equipment protective, and their use minimizes the potential for equipment damage.

The specific safety analyses applicable to each protective Function are identified below.

1. Variable Miah Power Trip (VHPT)

The VHPT provides reactor core protection against positive reactivity excursions.

The safety analysis assumes that this trip is OPERABLE to terminate excessive positive reactivity insertions during power operation and while shutdown.

Palisades Nuclear Plant B 3.3.1 -11 Revised 03/20/2008

RPS la?strurnentation B 3.3.1 APPLICABLE 2.

SAFETY ANALYSIS (con"Enued) There are no safety analyses which take credit for functioning of the High Startup Rate Trip. The High Starl-up Rate trip is used to trip the reactor when excore wide range power indicates an excessive rate of change. The High Startup Rate trip minimizes transients for events such as a continuous control rod withdrawal or a boron dilution event from low power levels. The trip may be operationally bypassed when TI-IERMAL POWER is

< 1E-4% RTP, when poor counting statistics may lead to erroneous indication. It may also be operationally bypassed at

> 13% RTP, where moderator temperature coefficient and fuel temperature coefficient make high rate of change of power unlikely. -

There are only two wide range drawers, with each supplying contact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolan"cvstem Flow Trip

.. .

The Low PCS Flow trip provides DNB protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a primary coolant pump.

Flow in each of the four PCS loops is determined from pressure drop from inlet to outlet of the SGs. The total PCS flow is determined, for the RPS flow channels, by summing the loop pressure drops across the SGs and correlating this pressure sum with the sum of SG differential pressures which exist at 100% flow (four pump operation at full power Tave). Full PCS flow is that flow which exists at RTP, at full power,,T, with four pumps operating.

4, 5. Low Steam Generator Level Trip The Low Steam Generator Level trips are provided to trip the reactor in the event of excessive steam demand (to prevent overcooling the PCS) and loss of feedwater events (to prevent overpressurization of the PCS).

The Allowable Value assures that there will be sufficient water inventory in the SG at the time of trip to allow a safe and orderly plant shutdown and to prevent SG dryout assuming minimum AF\N capacity.

Palisades Nuclear Plant B 3.3.1 -12 Revised 03/20/2008

APPLICABLE 4, 5. (continued)

SAFETY ANALYSIS (continued) Each SG level is sensed by measuring the differential pressure in the upper portion of the downcomer annulus in the SG. These trips share four level sensing channels on each SG with the AFW actuation signal.

6, 7. Low Steam Generator Pressure Trip The Low Steam Generator Pressure trip provides prokction against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the PCS. This trip provides a mitigation function in the event of an MSLB. -.

-

The Low SG Pressure channels are shared with the Low SG Pressure signals which isolate the steam and feedwater lines.

8. Hiah Pressurizer Pressure Trio The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and Main Steam Safety Valves (MSSVs), provides protection agains"rverpressure conditions in the PCS when at operating temperature. The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (e.g., Loss of Load, Main Steam Isolation Valve (MSIV) closure, etc.) or which suddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety grade instrument channels with the TMILP trip, Anticipated Transient Wi"lout Scram (ATVVS) and PORV circuits, and the Pressurizer Low Pressure Safety Injection Signal.

alisades Nuclear Plant 3.3.1 -13 Revised 03/2012008

RPS instrumentation B 3.3.1 BASES APPLICABLE 9.

SAFETY ANALYSIS (con"cnued) The TMILP trip is provided to prevent reactor operation when the DNBR is insufficient. The TMILP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The "tip is initiated whenever the PCS pressure signal drops below a minimum value (Pmi,) or a computed value (P,) as described below, whichever is higher.

The TMILP trip uses Q Power, ASI, pressurizer pressure, and cold leg temperature (T,) as inputs.

-

Q Power is the higher of core THERMAL POWER (AT Power) or nuclear power. The AT power uses hotleg and cold leg RTDs as inputs. Nuclear power uses the power range excore channels as inputs. Both the AT and excore power signals Iiave provisions lor calibration by calorimetric calculations.

The AS1 is calculated from the upper and lower power range excore detector signals, as explained in Section 1.1, "Definitions."

The signal is corrected for "re difference between the flux at the core periphery and the flux at the detectors.

The T, value is the higher of the "Lo cold leg signals.

The Low Pressurizer Pressure trip limit (Pvar)iscalculated using the equations given in Table 3.3.1 -2.

The calculated limit (PVaJis then compared to a fixed Low Pressurizer Pressure trip limit (Pmi,). The auctioneered highest of these signals becomes the trip limit (Ptrip). Ptripis compared to the measured PCS pressure and a trip signal is generated when the measured pressure for that channel is less than or equal to Ptrip. A pre-trip alarm is also generated when P is less than or equal to the pre-"rip setting, Pwp+ AP.

The TMILP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS pressure for the existing temperature and power conditions. It is compared to actual PCS pressure in the TMILP trip unit.

Palisades Nuclear Plant Revised 03l2012008

RPS Inslrumentatisrr B 3.3.1 BASES APPLICABLE 10.

SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accidentor transient. The Loss of Load trip uses a single pressure switch in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

11. Containment Hiah Pressure Trip -.

-

The Containment High Pressure trip provides a reactor trip in the event of a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The Containment High Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates Wo microswitches. One microswitch on each of four sensors provides an input to the RPS.

12. Zero Power Mode Bypass Removal The only RPS bypass considered in the safety analyses is the Zero Power Mode (ZPM) Bypass. The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow or temperature too low for the RPS bow PCS Flow, Low SG Pressure, or Thermal MarginILow Pressure trips to be reset. ZPM bypasses are automatically removed if the wide range NI indicated power exceeds 1E-4% RTP.

Palisades Nuclear Plant B 3.3.1-15 Revised 0312012008

BASES APPLICABLE 12. (continued)

SAFETY ANALYSIS (continued) The safety analyses take credit for automatic removal of the ZPM Bypass if reactor criticality due to a Continuous Control Rod Bank Wimdrawal should occur with the affected trips bypassed and PCS flow, pressure, or temperature below the values at which the RPS could be reset. The ZPM Bypass would effectively be removed when the first wide range NI channel indication reached 1E-4% RTP. With the ZPM Bypass for two RPS channels removed, the RPS would trip on one of the un-bypassed trips.

This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur when PCS flow, steam generator -

pressure, and PCS pressure (TMILP) were above their trip setpoints, a trip would terminate the event when power increased to the minimum setting (nominally 30%) of the Variable High Power Trip. In this case, the monitored parameters are at or near their normal operational values, and a trip initiated at 30% RTP provides adequate protection.

The RPS design also includes automatic removal of the Operating Bypasses for the High Startup Rate and Loss of Load trips. The safety analyses do not assume functioning of either these trips or the automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of I0 CFR 50.36(~)(2).

The LC0 requires all instrumentation performing an RPS Function to be OPERABLE. Failure of the trip unit (including its output relays), any required portion of the associated instrument channel, or both, renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. Failure of an automatic ZPM bypass removal channel may also impact the associated instrument channel(s) and reduce the reliability of the affected Functions.

Palisades Nuclear Plant Revised 0312012008

RPS BnsE~'umer?fa"con B 3.3.1 BASES LC0 Actions allow Trip Channel Bypass of individual channels, but the (continued) bypassed channel mustbe considered to be inoperable. The bypass key used to bypass a single channel cannot be simultaneously used to bypass that same parameter in other channels. This interlock prevents operation with more than one channel of the same Function trip channel bypassed. The plant is normally restricted to 7 days in a trip channel bypass, or otherwise inoperable condition before either restoring the Function to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value -.-

if the instrument loop is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function.

These uncertainties are addressed as described in plant documents.

Neither Allowable Values nor setpoints are specified for the non-safety related RPS Trip Functions, since no safety analysis assumptions would be violated if they are not set at a particular value.

The following Bases for each trip Function identify the above RPS trip Function criteria items that are applicable to establish the trip Function OPERABILITY.

1. Variable High Power Trip (VHPT)

This LC0 requires all four channels of the VHPT Function to be OPERABLE.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary VHPT trips during normal plant operations. The Allowable Value is low enough for the system to function adequakly during reactivity addition events.

Palisades Nuclear Plant 3.3.1 -17 Revised 03/20/2008

RPS lnslrmr-~len'tatio!?

B 3.3.1 BASES LC0 1. (continued)

(continued)

The VHPT is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During plant startup, the VHPT trip setpoint is initially atits minimum value, S 30%. Below 30% RTP, the VI-IPT setpoint is not required to 'Track" with Q Power, i.e., be adjusted to within 15% RTP. It remains fixed until manually reset, at which point it increases to 4 15% above existing Q Power.

The maximum allowable setting of the VI-IPT is 109.4% RTP.

Adding to this the possible variation in trip setpoint due to calibration and instrument error, the maximum actual steady state power at which a "rip would be actuated is 113.4%, which is the

-

value assumed in the safety analysis.

2. High Startup Rate Trip This L C 0 requires four channels of High Startup Rate Trip Function "c be OPERABLE in MODES 1 and 2.

The High Startup Rate trip serves as a backup to the adminis"catively enforced startup rate limit. The Function is not credited in the accident analyses; therefore, no Allowable Value for the trip or operating bypass Functions is derived from analytical limits and none is specified.

The four channels of the High Startup Rate trip are derived from two wide range NI signal processing drawers. Thus, a failure in one wide range channel could render two RPS channels inoperable. It is acceptable to continue operation in this condition because the High Startup Rate trip is not credited in any safety analyses.

The requirement for this trip Function is modified by a footnote, which allows the High S"Eaup Rate trip to be bypassed when the wide range NI indicates below 10E-4% or when THERMAL POWER is above 13% RTP. If a High Startup Rate trip is bypassed when power is between these limits, it must be considered to be inoperable.

- -

Palisades Nuclear Plant Revised 03/20/2008

RPS Instrumentation B 3.3.1 BASES LC0 3.

(con"rnued)

This LC0 requires four channels of Low PCS Flow Trip Function to be OPERABLE.

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insures thatthe reactor cannot operate when the flow rate is less than 93% of the nominal value considering instrument errors. Full PCS flow is "rat flow which exists at RTP, at full power Tave, with four pumps operating. -

-.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

4, 5. Low Steam Generator Level Trip This LCO requires four channels of Low Steam Generator Level Trip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequate water inventory in the steam generators when the reactor is critical and is based upon narrow range instrumentation. The 25.9%

indicated level corresponds to the location of the feed ring.

6 , 7 . Low Steam Generator Pressure Trip This LCO requires b u r channels of Low Steam Generator Pressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand.

Since excessive steam demand causes the PCS to cool down, resulting in positive reactivity addition to the core, a reactor trip is required to offset that effect.

Palisades Nuclear Plant Revised 03/20/2008

RPS Insirurnentation B 3.3.1 BASES LC0 (con"cnued) 8. High Pressurizer Pressure Trip This LC0 requires four channels of High Pressurizer Pressure Trip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressure increases in the PCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated.

9. Thermal MarninILow Pressure (TMILP) Trip This LC0 requires four channels of TMILP Trip Function to be OPERABLE.

The TMILP trip setpoints are derived from the core thermal limits through application of appropriate allowances for measurement uncertainties and processing errors. The allowances specifically .

account for instrument drift in both power and inlet temperatures, calorimetric power measurement, inlet temperature measurement, and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt, fuel pellet manufacturing tolerances, core flow measurement uncertainty and core bypass flow, inlet temperature measurement time delays, and ASI measurement, are included in the development of the TMILP trip setpoint used in the accident analysis.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

Palisades Nuclear Plant Revised 031201

RPS Instrumentation B 3.3.1 BASES LC0 10. Loss of Load Trip (continued)

The LC0 requires four Loss of Load Trip Function channels to be OPERABLE in MODE 1 with THERMAL POWER 2 17% RTP.

The Loss of Load trip may be bypassed or be inoperable with THERMAL POWER < 17% RTP, since it is no longer needed to prevent lifting of the pressurizer safety valves or steam generator safety valves in the event of a Loss of Load. Loss of Load Trip unitmust be considered inoperable if it is bypassed when THERMAL POWER is above 17% RTP.

This LC0 requires four RPS Loss of Load auxiliary trip units, relays 305L and 305R, and pressure switch 63lAST-2 to be -.

-

OPERABLE. With those components OPERABLE, a turbine trip will generate a reactor trip. The LC0 does not require the various turbine trips, themselves, to be OPERABLE.

The Nuclear Steam Supply System and Steam Dump System are capable of accommodating the Loss of Load without requiring the use of the above equipment.

The Loss of Load Trip Function is not credited in the accident analysis; therefore, an Allowable Value for the trip cannot be derived from analytical limits, and is not specified.

11. Containment Hiah Pressure Trip This LC0 requires four channels of Conbinment High Pressure Trip Function to be OPERABLE.

The Allowable Value is high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) that are not indicative of an abnormal condition.

The setting is low enough to initiate a reactor trip to prevent containment pressure from exceeding design pressure following a BBA and ensures the reactor is shuMown before initiation of safety injection and containment spray.

Palisades Nuclear Plant .I-21 Revised 03120120

RPS Instrumentation B 3.3.)

BASES LC0 (continued) 12.

The LC0 requires that four channels of automatic Zero Power Mode (ZPM) Bypass removal instrumentation be OPERABLE.

Each channel of automatic ZPM Bypass removal includes a shared wide range NI channel, an actuating bistable in the wide range drawer, and a relay in the associated RPS cabinet. Wide Range NI channel 113 is shared between ZPM Bypass removal channels A and C; Wide Range NI channel 2/4., between ZPM Bypass removal channels B and D. An operable bypass removal channel must be capable of automatically removing the capability to bypass the affected RPS trip channels with the ZPM Bypass key switch at the proper setpoint. -

APPLICABILITY This LC0 requires all safety related trip functions to be OPERABLE in accordance with Table 3.3.1 -1.

Those RPS trip Functions which are assumed in the safety analyses (all except High Startup Rate and Loss of Load), are required to be operable in MODES 1 and 2, and in MODES 3,4, and 5 with more than one full-length control rod capable of being withdrawn and PCS boron concentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES 3, 4, or 5, if PCS boron concentration is at REFUELING BORON CONCENTRATION, or when no more than one full-length control rod is capable of being withdrawn, because the RPS Function is already fulfilled. REFUELlNG BORON CONCENTRATION provides sufficient negative reactivity to assure the reactor remains subcritical regardless of control rod position, and the safety analyses assume thawhe highest worth withdrawn full-length control rod will fail to inser! on a trip. Therefore, under these conditions, the safety analyses assumptions will be met without the WPS trip Function.

The High Stafiup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LC0 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LC0 3.9.2, "Nuclear Instrumentation."

Palisades Nuclear Plant B 3.3.1 -22 Revised 03/20/2008

WPS Ins"trumen2atisn B 3.3.1 BASES APPLICABILITY (continued) The High Stafiup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LC0 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LC0 3.9.2, "Nuclear Instrumentation."

The Loss of Load trip is required to be OPERABLE with THERMAL POWER at or above 17% RTP. Below 17% RTP, the ADVs are capable of relieving the pressure due to a Loss of Load event without challenging other overpressure protection. -

-.

The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESF in providing acceptable consequences during accidents.

ACTIONS The most common causes of channel inoperability are outright failure of loop components or driftof those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to the "safe" condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CI4ANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is Found inoperable, all affected Functions provided by that channel mustbe declared inoperable, and the plant must enter the Condition for the particular protection Functions affected.

- --

Palisades Nuclear Plant B 3.3.1 -23 Revised 03/20/2008

BASES ACTIONS (continued) When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LGO 3.0.3 is irnlwediately entered if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

Condition A applies to the failure of a single channel in any required RPS Function, except I-ligh Startup Rate, Loss of Load, or ZPM Bypass Removal. (Condition A is modified by a Note stating that this Condition does not apply to the High Stadup Rate, Loss of Load, or ZPM Bypass Removal Functions. The failure of one channel of those Functions is addressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel is inoperable, operation is allowed to continue. Since the trip unitand associated instrument channel combine "r perform the trip function, this Condition is also appropriate if both the trip unit and the associated instrument channel are inoperable. Though not required, the inoperable channel may be bypassed. The provision of four trip channels allows one channel to be bypassed (removed from service) during operations, placing the RPS in two-out-of-three coincidence logic. The failed channel must be restored to OPERABLE status or placed in trip within 7 days.

Required Action A.lpplces the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent trip.

The Completion Time of 7 days is based on operating experience, which has demonstrated thata random failure of a second channel occurring during the 7 day period is a low probability event.

alisades Nuclear Plant Revised 03/20/20

ACTIONS -A.1 (continued)

(continued)

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during "ce 7 day period is a low probability event.

Condition 13 applies to the failure of a single High Startup Rate trip unit or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to entering MODE 2 from MODE 3. A shutdown provides the appropriate opportunity to repair the trip function -.-

and conductthe necessary testing. The Completion Time is based on the fact that the safety analyses take no credit for the functioning of this trip.

-(2.1 Condition C applies to the failure of a single Loss of Load or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to THERMAL POWER 2 17% RTP following a shutdown. If the plantis shutdown at the time the channel becomes inoperable, then the failed channel must be restored to OPERABLE status prior to THERMAL POWER 2 17% RTP. For this Completion Time, 'Tollowing a shutdown" means this Required Action does not have to be completed until prior to THERMAL POWER 2 17% RTP for the first time after the plant has been in MODE 3 following entry into the Condition. The Completion Time trip assures thatthe plant will not be restarted with an inoperable Loss of Load trip channel.

Palisades Nuclear Plant B 3.3.1 -25 Revised 03/20/2008

RPS ins,!rui?len"ition B 3.3.1 BASES ACTIONS D.l and D.2 (continued)

Condition D applies when one or more automatic ZPM Bypass removal channels are inoperable. If the ZPM Bypass removal channel cannot be restored to OPERABLE status, the affected ZPM Bypasses mustbe immediately removed, or the bypassed RPS trip Function channels must be immediately declared to be inoperable. Unless additional circuit failures exist, the ZPM Bypass may be rernoved by placing the associated "Zero Power Mode Bypass" key operated switch in the normal position.

A trip channel which is actually bypassed, other than as allowed by the Table 3.3.1 -1 footnotes, cannotperform its specified safety function and

,must immediately be declared to be inoperable. -

-.

E.1 and E.2 Condition E applies to the failure of two channels in any RPS Function, except ZPM Bypass Removal Function. (The failure of ZPM Bypass Removal Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does not apply to the ZPM Bypass Removal Function.

Required Action E.lprovides for placing one inoperable channel in trip within the Completion Time 04 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Though notrequired, the other inoperable channel may be (trip channel) bypassed.

Palisades Nuclear Plant B 3.3.1-26 Revised 03/20/2008

RPS Ivasluumenlallon B 3.3.1 BASES ACTIONS E.1 a.nd E.2 (continued)

(con"cnued)

This Comple"ron Time is sufficientto allow the operator to take all appropriate actions for the failed channels while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed or inoperable in an untripped condition, "re RPS is in a two-out-of-three logic for that function; but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, one of the inoperable channels is placed in trip. This places the RPS in a one-out-of-two for that function logic. If any of the other unbypassed channels for that function receives a trip signal, the reactor will trip.

-

Action E.2 is modified by a Note stating that this Action does not apply to (is not required for) the High Star"rup Rate and Loss of Load Functions.

One channel is required to be restored to OPERABLE status within 7 days for reasons similar "r those stated under Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A .

still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action E.2 must be placed in trip if more than 7 days have elapsed since the initial channel failure.

The power range excore channels are used to generate the internal ASI signal used as an input to the TMILP trip. They also provide input to the Thermal Margin Monitors for determination of the Q Power input for the TMILP trip and the VMPT. If two power range excore channels cannot be restored to OPERABLE status, power is restricted or reduced during subsequent operations because of increased uncerlainty associated with inoperable power range excore channels which provide input to those trips.

The Completion Time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is adequate to reduce power in an orderly manner withou"rhallenging plant systems.

Palisades Nuclear Plant B 3.3.1-27 Revised 0312012008

BASES ACTIONS G.1, 6.2.1, and (3.2.2 (continued)

Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, E, or F are not met, or if the control room ambient air temperature exceeds 90°F.

If the control room ambient air temperature exceeds 90°F, all Thermal Margin Monibr channels are rendered inoperable because their operating temperature limit is exceeded. In this condition, or if the Required Actions and associated Completion Times are notmet, the reactor must be placed in a condition in which "re LC0 does not apply.

To accomplish this, the plant must be placed in MODE 3, with no more than one full-length control rod capable of being withdrawn or with the PCS boron concentration at REFUELING BORON CONCENTRATION -

in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The Completion Time is reasonable, based on operating experience, for placing the plant in MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The Completion Time is also reasonable to ensure that no more than one full-length control rod is capable of being withdrawn or that the PCS boron concentration is at REFUELING BORON CONCENTRATION.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column of REQUIREMENTS Table 3.3.1 -1 for 'chat Function. Most Functions are subject to CI-IANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

Pedormance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximateiy the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument driftin one of the channels or of something even more serious. Under most conditions, a CHANNEL CHECK will detect gross channel failure; thus, itis key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION Palisades Nuclear Plant B 3.3.1 -28 Revised 03/20/2008

BASES SURVEILLANCE SR 3.3.1 .I (continued)

REQUIREMENTS (continued) Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

The Containment High Pressure and Loss of Load channels are pressure switch actuated. As such, they have no associated control room indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operating experience thatdeemonstrates the rarity of channel failure. Since the -

probability of "ro random failures in redundant channels in any 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LC0 required channels.

This SR verifies that the control room ambient air temperature is within the environmental qualification temperature limits for the most restrictive RPS components, which are the Thermal Margin Monitors. These monitors provide input to both the VHPT Function and the TIVIILP Trip Function. The 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is reasonable based on engineering judgement and planboprating experience.

A daily calibration (heat balance) is performed when THERMAL PO\NER is 2 15%. The daily calibration consists of adjusting the "nuclear power calibrate" potentiometers to agree with the calorimetric calculation if the absolute difference is r 1.5%. Nuclear power is adjusted via a potentiometer, or THERMAL POWER is adjusted via a Thermal Margin Monitor bias number, as necessary, in accordance with the daily calibration (heat balance) procedure. Performance of the daily calibration ensures that the two inputs to the Q power measurement are indicating accurately with respect to the much more accurate secondary calorimetric calculation.

Palisades Nuclear Plant B 3.3.1 -29 Revised 0312012008

RPS Instr'uine~-ifation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS (continued) The Frequency of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is based on plant operating experience and takes into account indications and alarms located in the control room lo detect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance must be performed within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is 2 15% RTP.

The secondary calorimetric is inaccurate atlower power levels. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows -time requirements for plant stabilization, data taking, and instrument calibration.

-

It is necessary to calibrate the power range excore channel upper and -'

lower subchannel amplifiers such that the measured AS1 reflects the true core power distribution as determined by the incore detectors. AS1 is utilized as an input to the TMILP trip function where itis used to ensure that the measured axial power profiles are bounded by the axial power profiles used in the development of the limitation of LC0 3.4.1. An adjustment of the excore channel is necessary only if reactor power is greater than 25% RTP and individual excore channel AS1 differs from AXIAL OFFSET, as measured by the incores, outside the bounds of the following table:

Allowed Group 4 Group 4 Reactor Rods r 128" withdrawn Rods <128" withdrawn Power r 100% -0.020 S (AO-AS!) 5 0.020 -0.040 5 (AO-ASl) 5 0.040

< 95 -0.033 I (AO-ASI) 5 0.020 -0.053 I (AO-AS!) 5 0.040

< 90 -0.046 5 (AO-AS!) 5 0.020 -0.066 5 (AO-ASl) 5 0.040

< 85 -0.060 I (AO-ASI) 5 0.020 -0.080 5 (AO-ASl) 5 0.040

< 80 -0.120 r (AO-ASl) S 0.080 -0.140 5 (AO-ASI) S 0.100

< 75 -0.120 5 (AO-AS/) 5 0.080 -0.140 5 (AO-AS!) 5 0.100

< 70 -0.120 5 (AO-AS!) r 0.080 -0.140 .S (AO-ASI) S 0.1 00

< 65 -0.120 r (AO-AS!) r 0.080 -O.IL&O r (AO-ASI) r 0.100

< 60 -0.1 60 r (AO-AS\) 5 0.1 20 -0.180 5 (AO-ASl) S 0.140

< 55 -0.1 60 5 (AO-ASI) S 0.120 -0.180 5 (AO-ASI) r 0.140

< 50 -0.1 60 5 (AO-ASl) 5 0.120 -0.180 S (AO-AS!) r 0.140

< 45 -0.160 I(AO-AS/) r 0.120 -0.1 80 S (AO-ASI) S 0.140

< 40 -0.160 5 (AO-AS!) 5 0.120 -0.180 I (AO-ASl) 5 0.140

< 35 -0.1 60 I (AO-ASI) 5 0.120 -0.180 S (AO-AS!) I 0.1 40

< 30 -0.160 5 (AO-ASI) 5 0.120 -0.180 5 (AO-ASI) 5 0.140

-c 25 Below 25% RTP any AOIASI difference is acceptable Table values determined with a conservative Pvar gamma constant of -9505.

Palisades Nuclear Plant B 3.3.1 -30 12012008

BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS (continued) Below 25% RTP any difference between AS1 and AXIAL OFFSET is acceptable. A Note indicates the Surveillance is not required to have been performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after THERMAL POWER is 2 25% RTP.

Uncertainties in the excore and incore measurement process make it impractical to calibrate when THERMAL POWER is < 25% RTP. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allows time for plant stabilization, data "raking, and instrument calibration.

The 31 day Frequency is adequate, based on operating experience of the excore linear amplifiers and the slow burnup of the detectors. The excore readings are a strong function of the power produced in the peripheral fuel bundles and do not represent an integrated reading across the core. Slow changes in neutron flux during the fuel cycle can

-

also be detected at this Frequency.

A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, exceptLoss of Load and High Startup Rate, every .

92 days to ensure the entire channel will perform its intended function when needed. For "re TMILP Function, the constants associated with the Thermal Margin Monitors must be verified to be within tolerances.

A successful test of the required contact@)of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CI-IANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests atleast once per refueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical reporCCEN-327, "RPSIESFAS Extended Test interval Evaluation" (Ref. 5).

Palisades Nuclear Plant B 3.3.1 -31 Revised 03/20/2008

RPS &ns'rrern?sr?la2iun B 3.3.1 BASES SURVEILLANCE SR 3.3.9.6 REQUlREMENTS (continued) A calibration check of the power range excore channels using the internal teskircuitry is required every 92 days. This SR uses an internally generated test signal to check that the 0% and 50% levels read within limits for both the upper and lower detector, both on the analog meter and on the TMM screen. This check verifies thatneither the zero point nor the amplifier gain adjustment have undergone excessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operating experience, and takes into account indications and alarms available to the operator in the control room.

A CHANNEL FUNCTIONAL TEST on "re Loss of Load and High Startup Rate channels is performed prior to a reactor startup to ensure the entire channel will perform its intended Function.

A successful testof the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CI-IANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-"13 sends a trip signal to RPS channels A and 6 ; NI-214 to channels B and D. Since each High Startup Rate channel would cause a trip on two RPS channels, the High Startup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring turbine auto stop oil pressure which is not tested when the reactor is critical. Operating experience has shown that these components usually pass the Surveillance when performed at a Frequency of once per 7 days prior to each reactor startup.

Palisades Nuclear Plant B 3.3.1 -32 Revised 03/20/2008

BASES SURVEILLANCE SR 3.3.1.8 REQUIREMENTS (continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every 18 months.

CI-IANNEL CALIBRATION is a complete check of the instrument channel including the sensor (except neutron detectors). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be consistent with the setpoint analysis.

The bistable setpoints mustbe found to trip within the Allowable Values

-

specified in the L C 0 and left set consistent with the assumptions of the setpoint analysis. The Variable I-ligh Power Trip setpoint shall be verified to reset properly at several indicated power levels during (simulated) power increases and power decreases.

The as-found and as-leftvalues must also be recorded and reviewed for .

consistency with the assumptions of the setpoint analysis.

As park of the CHANNEL CALIBRATION of the wide range Nuclear Instrumentation, automatic removal of the ZPM Bypass for the Low PCS Flow, TM/LP must be verified to assure that these trips are available when required.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

This SR is modified by a Note which states that it is not necessary to calibrate neutron detectors because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in power range excore neutron detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1-3)and the monthly calibration using the incore detectors (SR 3.3.1.4). Sudden changes in detector performance would be noted during the required CHANNEL CHECKS (SR 3.3.1.I).

isades Nuclear Plant B 3.3.1-33 Revised 031201200

REFERENCES 1. 10 CFR 50, Appendix A, GBC 21

2. 10CFR 100 3, lEEE Standard 299-1971, April 5, 1972

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant B 3.3.1 -34 Revised 03/20/2008

WPS Instrumentation B 3.3.1 Table B 3.3.1-1 (page 1 of 1)

Instruments Affec"lng Multiple Specifications 3.3.3 (#1.a & 7a)

PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.l & 3.4.14 PI-0110, Pressure Indication @ C-150 Panel 3.3.8 (#2)

SG Level lnstrbemenls LT-0751 & 0752 A, 5, C, & D, Level Signal (RPS & AFAS) 1 3.3.1 (#4 & 5) &

Note: The information grovided in this table is intended for use as an aid to distinguish those instrument channels which provide more than one required function and to describe which specifications they affect. The information in this table should not be taken as inclusive for all instruments nor affected specifications.

Palisades Nuclear Plant B 3.3.1 -35 Revised 03/20/2008

ESF instrumentalion B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Engineered Safety Features (ESF) lnstrumentation BASES BACKGWOUND The ESF Instrumentation initiates necessary safety systems, based upon the values of selected plantparameters, to protect against violaiing core design limits and the Primary Coolant System (PCS) pressure boundary and to mitigate accidents.

The ESF circuitry generates the signals listed below when the monitored variables reach levels that are indicative of conditions requiring protective action. The inputs to each ESF actuation signal are also listed. -

1. Safety Injection Signal (SIS).

a. Containment High Pressure (CHP)

b. Pressurizer Low Pressure

2. Steam Generator Low Pressure (SGLP);

a. Steam Generator A Low Pressure

b. Steam Generator B Low Pressure

3. Recirculation Actuation Signal (RAS);

a. Safety Injection Refueling Water Tank (SIRWT) Low Level

4. Auxiliary Feedwater Actuation Signal (AFAS);

a. Steam Generator A Low Level

b. Steam Generator B Low Level

5. Containment High Pressure Signal (CHP);

a. Containment High Pressure - Left Train

b. Containment High Pressure - Right Train Palisades Nuclear Plant B 3.3.3-1 Revised 03/20/2008

ESF lnstrtiinenla,tion 8 3.3.3 BASES BACKGROUND 6. ConiainmenWigh Radiation Signal (CHR);

(continued)

a. Containment High Radiation

7. Automatic Bypass Removal

a. Pressurizer Pressure Low Bypass

b. Steam Generator A Low Pressure Bypass

c. Steam Generator B Low Pressure Bypass In the above list of actuation signals, the CHP and RAS are derived from pressure and level switches, respectively. -

-

Equipment actuated by each of the above signals is identified in the FSAR, Chapter 7. (Ref. 1).

The ESF circuiky, with the exception of RAS, employs two-out-of-four logic. Four independent measurementchannels are provided for each function used to generate ESF actuation signals. When any two channels of the same function reach their setpoint, actuating relays are energized which, in turn, initiate the protective actions. Two separate and redundant trains of actuating relays, each powered from separate power supplies, are utilized. These separate relay trains operate redundant trains of ESF equipment.

RAS logic consists of output contacts of the relays actuated by the SIRWT level switches arranged in a "one-out-of-two taken twice" logic.

The contacts are arranged so that at leastone low level signal powered from each station battery is required to initiate RAS. Loss of a single battery, therefore, cannoteither cause or prevent RAS initiation.

The ESF logic circuitry contains the capability to manually block the SIS actuation logic and the SGLP action logic during normal plant shutdowns to avoid undesired actua"ron of the associated equipment.

In each case, when three of the four associated measurement channels are below the block setpoint, pressing a manual pushbuMon will block the actuation signal for that train. If two of the four of the measurement channels increase above the block setpoint, the block will automatically be removed.

Palisades Nuclear Plant B 3.3.3-2 Revised 03/20/2008

ESF Ons,trurnenlation B 3.3.3 BASES BACKGROUND (continued) The sensor subsys"lms, including individual channel actuation bistaables, is addressed in this LCO. The actuation logic subsystems, manual actuation, and downstream components used "c actuate the individual ESF components are addressed in LC0 3.3.4.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

Four identical measurement channels are provided for each parameter -

used in the generation of trip signals. These are designated Channels A through D. Measurement channels provide input to ESF bistables within the same ESF channel. In addition, some measurement channels may also be used as inputs to Reactor Protective System (RPS) bistables, and most provide indication in the control room.

When a channel monitoring a parameter indicates an abnormal condition, the bistable monitoring the parameter in "rat channel will trip.

In the case of RAS and CHP, the sensors are latching auxiliary relays from level and pressure switches, respectively, which do not develop an analog input to separate bistables. Tripping two or more channels monitoring the same parameter will actuate both channels of Actuation Logic of the associated ESF equipment.

Three of the four measurement and bistable channels are necessary to meet the redundancy and testability of GDC 21 in Appendix A to 10 GFR 50 (Ref. 2). The f o u ~ h channel provides additional flexibility by allowing one channel to be removed from service for maintenance or testing while still mainbining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation and no protective channel feeds a control channel, this arrangement meets the requirements of lEEE Standard 279 -1971 (Ref. 3).

Palisades Nuclear Plant B 3.3.3-3 Revised 03/20/2008

ESF Instr~~merata"[ion B 3.3.3 BASES BACKGROUND MeasuremenXhannels (continued)

(continued)

The ESF Actuation Functions are generated by comparing a single measurementto a fixed bistable setpoint. The ESF Actuation Functions utilize the following input instrumentation:

Safetv Iniection Signal (SIS)

The Safety Injection Signal can be generated by any of three inputs: Pressurizer Low Pressure, Containment High Pressure, or Manual Actuation. Manual Actuation is addressed by L C 0 3.3.4; Containment High Pressure is discussed below. Four instruments (channels A through D), monitor Pressurizer Pressure to develop the SIS actuation. Each of these instrument channels has two -

-

individually adjustable ESF bistable trip devices, one for the bypass removal circuit (discussed below) and one for SIS. Each ESF bistable trip device actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LC0 3.3.4. The instrument channels associated with each Pressurizer Low Pressure SIS actuation bistable include the pressure measurement loop, the SIS actuation bistable, and the two auxiliary relays associated with tharnistable. The bistables associated with automatic removal of the Pressurizer Low Pressure Bypass are discussed under Function 7.a, below.

Low Steam Generator Pressure Signal (SGLP)

There are Wo separate Low Steam Generator Pressure signals, one for each steam generator. For each steam generator, four instruments (channels A through B) monitor pressure to develop the SGLP actuation. Each of these instrument channels has two individually adjustable ESF bistable trip devices, one for the bypass removal circuit (discussed below) and one for SGLP.

Each Steam SGLP bistable trip device actuates an auxiliary relay.

The output contacts from these auxiliary relays form the SGLP logic circuits addressed in L C 0 3.3.4. The instrument channels associated with each Steam Generator Low Pressure Signal bistable include the pressure measurement loop, "the SGLP actuation bistable, and the auxiliary relay associated with that bistable. The bishbles associated with automatic removal of the SGLP Bypass are discussed under Function 7.a, below.

Palisades Nuclear Plant B 3.3.3-4 Revised 03/20/2008

ESF Irastrbirnen"l.tion B 3.3.3 BASES BACKGROUND Measurement Channels (continued)

(continued)

Recirculation Actuation Siplnal (RAS)

There are four Safety Injection Refueling Water (SIRW) Tank level instruments used to develop the RAS signal. Each of these instrument channels actuates two auxiliary relays, one for each actuation train. The output contacts from these auxiliary relays form the logic circuits addressed in LC0 3.3.4. The SIRW Tank Low Level instrument channels associaked with each RAS actuation bistable include the level instrument and the two auxiliary relays associated with that instrument.

Auxiliarv Feedwater Actuation Siplnal (AFAS) -

There are two separate AFAS signals (AFAS channels A and B),

each one actuated on low level in either steam generator. For each steam generator, four level instruments (channels A through 6)) monitor level to develop the AFAS actuation signals. The output contacts from the bistables on these level channels form the AFAS logic circuits addressed in L C 0 3.3.4. The instrument channels associated with each Steam Generator Low Level Signal bistable include the level measurement loop and the Low Level AFAS bistable.

Containment Hiah Pressure Actuation (CMP)

The Containment High Pressure signal is actuated by two sets of four pressure switches, one set for each train. The output contacts from these pressure switches form the CHP logic circuits addressed in L C 0 3.3.4.

Palisades Nuclear Plant B 3.3.3-5 Revised 03/20/2008

BASES BACKGROUND Measuremen"rGhannels (continued)

(continued)

Con"cinment Wiplh Radiation Actuation (CHR)

The CWR signal can be generated by either of two inputs: High Radiation or Manual Actuation. Manual Actuation is addressed by LC0 3.3.4. Four radiation monitor instruments (channels A through D), monitor containment area radiation level to develop the CHR signal. Each CHR monitor bistable device actuates one auxiliary relay which has contacts in each CHR logic train addressed in L C 0 3.3.4. The instrument channels associated with each CHR actuation bistable include the radiation monitor itself and the associated auxiliary relay.

0 Automatic Bypass Removal Functions Pressurizer Low Pressure and Steam Generator Low Pressure logic circuits have the capability to be blocked to avoid undesired actuation when pressure is intentionally lowered during plant shutdowns. In each case these bypasses are automatically removed when the measured pressure exceeds "re bypass permissive setpoint. The measurement channels which provide the bypass removal signal are the same channels which provide the actuation signal. Each of these pressure measurement channels has two bistaables, one for actuation and one for the bypass removal Function. The pressurizer pressure channels include an auxiliary relay actuated by the bypass removal bistable.

The logic circuits for Automatic Bypass Removal Functions are addressed by L C 0 3.3.4.

Several measurement instrument channels provide more than one required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

Palisades Nuclear Plant Revised 03/20/2008

ESF Instrumerrtatio~a B 3.3.3 BASES BACKGROUND (continued)

There are four channels of bistables, designated A through D, for each ESF Function, one for each measurement channel. The bistables for all required Functions, except CMP and RAS, receive an analog input from the measurement device, compare the analog input to trip setpoints, and provide contactoutput to the Actuation Logic. CHP and RAS are actuated by pressure switches and level switches respectively.

The Allowable Values are specified for each safety related ESF trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrumentloop is performing as required. The methodology used -

to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is notwithin its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that Safety Limits of Chapter 2.0, "SAFETY LIMITS (SLs)," are not violated during Anticipated Operational Occurrences (AOOs) and that the consequences of Design Basis Accidents (DBAs) will be acceptable, providing the plant is operated from within the LCOs at the onset of the 800 or DBA and the equipmen"runctions as designed. (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurances mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.")

ESF instrument Channel Bvpasses The only ESF instrument channels with built-in bypass capability are the Low SG Level AFAS bistables. Those bypasses are effected by a key operated switch, similar to the RPS Trip Channel Bypasses. A bypassed Low SG Level channel AFAS bistable cannot perform its specified function and must be considered inoperable.

Palisades Nuclear Plant .3.3-7 Revised 03/20/2008

ESF iurstrumer-rl-ation B 3.3.3 BASES BACKGROUND (continued)

(continued)

While there are no other built-in provisions for instrument channel bypasses in the ESF design (bypassing any other channel output requires opening a circuit link, lifting a lead, or using a jumper), this L C 0 includes requirements for OPERABILITY of the instrument channels and bistables which provide input to the Automatic Bypass Removal Logic channels required by L C 0 3.3.4, "ESF Logic and Manual Initiation."

The Actuation Logic channels for Pressurizer Pressure and Steam Generator Low Pressure, however, have the ability to be manually bypassed when the associated pressure is below the range where automatic protection is required. These actuation logic channel -

bypasses may be manually initiated when three-out-of-four bypass permissive bistables indicate below their setpoint. When two-out-of-four of these bistables are above their bypass permissive setpoint, the actuation logic channel bypass is automatically removed. The bypass permissive bistables use the same four measurement channels as the blocked ESF function for their inputs.

APPLICABLE Each of the analyzed accidents can be detected by one or more ESF SAFETY ANALYSES Functions. One of the ESF Functions is the primary actuation signal for that accident. An ESF Function may be the primary actuation signal for more than one type of accident. An ESF Function may also be a secondary, or backup, actuation signal for one or more other accidents.

Functions not specifically credited in the accident analysis, serve as backups and are parl of the NRC approved licensing basis for the plant.

Palisades Nuclear Plant B 3.3.3-8 Revised 03/20/2008

ESF Instrumentation B 3.3.3 BASES APPLICABLE ESF protective Functions are as follows.

SAFETY ANALYSES (continued) 1. Safe@ vniection Signal (SIS)

The SIS ensures acceptable consequences during Loss of Coolant Accicicnt (LOCA) events, including steam generator tube rupture, and Main Steam Line Breaks (MSLBs) or Feedwater Line Breaks (FWLBs) (inside containment). To provide the required protection, SIS is actuated by a CWP signal, or by two-out-of-four Pressurizer Low Pressure channels decreasing below the setpoint. SIS initiates the following actions:

a. Start WPSI & LPSI pumps;

-

b. Start component cooling water and service water pumps;

c. Initiate service water valve operations;

d. Initiate component cooling water valve operations;

e. Start containment cooling fans (when coincident with a loss of offsite power);

f. Enable Containment Spray Pump Start on CHP; and

g. Initiate Safety injection Valve operations.

Each SIS logic train is also actuated by a contact pair on one of the CWP initiation relays for the associated CHP train.

2. Steam Generator Low Pressure S i ~ n a(SGLP) l The SGLP ensures acceptable consequences during an MSLB or FWLB by isolating the steam general-or if it indicates a low steam generator pressure. The SGLP concurrent with or following a reactor trip, minimizes the rate of heateextraction and subsequent cooldown of the PCS during these events.

Palisades Nuclear Plant B 3.3.3-9 Revised 03/20/2008

ESF Instrumentation B 3.3.3 APPLICABLE 2. Steam Generator Low Pressure Signal (SGLP) (continued)

SAFETY ANALYSES (continued) One SGLP circuit is provided for each SG. Each SGLP circuit is actuated by two-out-of-four pressure channels on the associated SG reaching their setpoint. SGLP initiates the Following actions:

a. Close the associated Feedwater Regulating valve and its bypass; and

b. Close both Main Steam Isolation Valves.

3. Recirculation Actuation Siornal At the end of the injection phase of a LOCA, the SIRWT will be nearly empty. Continued cooling must be provided by the ECCS to remove -.

decay heat. The source of water for the ECCS pumps is automatically -

switched to the containment recirculation sump. Switchover from SIRWT to the containment sump mustoccur before the SIRWT empties to prevent damage to the ECCS pumps and a loss of core cooling capability. For similar reasons, switchover must not occur before there is sufficient water in the containment sump to support pump suction.

Furthermore, early switchover must not occur to ensure sufficient borated water is injected from the SIRWT to ensure the reactor remains shut down in "the recirculation mode. An SlRWT Low Level signal initiates the RAS.

RAS initiates the following actions:

a. Trip LPSl pumps (this trip can be manually bypassed);

b. Switch HPSI and containment spray pump suction from SIRWT to Containment Sump by opening sump CVs and closing SIRWT cvs;

c. Adjust cooling water to component cooling heat exchangers;

d. Open HPSl subcooling valve CV-3071 if the associated HPSl pump is operating;

e. After containment sump valve CV-3030 is opened, open WPSI subcooling valve CV-3070 if the associated WPSl pump is operating;

f. Re-positions CV-3001 and CV-3002 to a predetermined throttled position.

g. Close containment spray valve CV-3001 if containment sump valve CV-3030 does not open.

Palisades Nuclear Plant Revised 03/20/2008

ESF Bnstrumentation B 3.3.3 BASES APPLlCABLE 3 (continued)

SAFETY ANALYSES (continued) The RAS signal is actuated by separate sensors from those which provide tank level indication. The allowable range of 21" to 27" above the tank floor corresponds to 1.1 % to 3.3% indicated level.

Typically "ce actual setting is near the midpoint of the allowable range.

Auxiliary Feedwater Actuation Sianal An AFAS initiates feedwater flow to both steam generators if a low level is indicated in either steam generator.

The AFAS maintains a steam generator heat sink during the -..

following events:

FWLB; LOCA; and Loss of feedwater.

Containment High Pressure Signal (CHP)

The CHP signal closes all containment isolation valves not required for ESF operation and statts containment spray (if SIS enabled), ensuring acceptable consequences during LOCAs, control rod ejection events, MSLBs, or FaAILBs (inside containment).

CWP is actuated by "io-out-of-four pressure switches for the associated train reaching their setpoints. CHP iniliates the following actions:

a. Containment Spray;

b. Safety Injection Signal;

c. Main Feedwater Isolation; Palisades Nuclear Plant t r B 3.3.3-1 1 Revised 03/20/2008

ESF Ins"irumentatio12 B 3.3.3 BASES APPLICABLE 5. (continued)

SAFETY ANALYSIS (con"Enued) d. Main Steam Line Isolation;

e. Control Room HVAC Emergency Mode; and

f. Containment Isolation Valve Closure.

6. ContainmenWigh Radiation Signal (CHR)

CHR is actuated by two-out-of-four radiation monitors exceeding their setpoints. CCHR initiates the following actions to ensure acceptable consequences following a LOCA or control rod ejection event: -

7

a. Control Room MVAC Emergency Mode;

b. Containment Isolation Valve Closure; and

c. Block automatic starting of ECCS pump room sump pumps.

During refueling operations, separate switch-selectable radiation monitors initiate CCHR, as addressed by L C 0 3.3.6.

7. Automatic Bvpass Removal Functions The logic circuitry provides automatic removal of the Pressurizer Pressure Low and Steam Generator Pressure Low actuation signal bypasses. There are no assumptions in the safety analyses which assume operation of these automatic bypass removal circuits, and no analyzed events result in conditions where the automatic removal would be required to mitigate the event. The automatic removal circuits are required to assure that logic circuit bypasses will not be overlooked during a plant startup.

The ESF instrumentation satisfies Criterion 3 of "ICCFW 50.36(c)(2).

Palisades Nuclear Plant B 3.3.3-1 2 Revised 03/20/2008

ESF instrumentation B 3.3.3 BASES The LC0 requires all channel components necessary to provide an ESF actuation to be OPERABLE.

The Bases for the L C 0 on ESF Functions are addressed below.

1. Safetv lniection Signal (SIS)

This LC0 requires four channels of SIS Pressurizer Low Pressure to be OPERABLE in MODES 1,2, and 3.

The setpoint was chosen so as to be low enough to avoid actuation during plant operating transients, but to be high enough to be quickly actuated by a LOCA or WISLB. The settings include an uncertainty allowance which is consistent with the settings assumed in the MSLB analysis (which bounds "re settings assumed in the LOCA analysis).

2. Steam Generator Low Pressure S i ~ n a(SGLP) l This LC0 requires four channels of Steam Generalor Low Pressure Instrumentation for each SG to be OPERABLE in MODES 1, 2, and 3. However, as indicated in Table 3.3.3-1, Note (a), the SGLP Function is not required to be OPERABLE in MODES 2 or 3 if all Main Steam Isolation Valves (MSIVs) are closed and deactivated and all Main Feedwater Regulating Valves (MFRVs) and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves.

The setpoint was chosen to be low enough to avoid actuation during plant operation, but be close enough to full power operating pressure to be actuated quickly in the event of a WISLB. The setting includes an uncertainty allowance which is consistent with the setting used in the Reference 4 analysis.

Each SGbP logic is made up of outpu"rontacts from four pressure bistables from the associated SG. When the logic circuitis satisfied, two relays are energized to actuate steam and feedwater line isolation.

Palisades Nuclear Plant B 3.3.3-1 3 Revised 03/20/2008

ESF Ir?sir'etmenla.iior~

B 3.3.3 BASES LC0 2. Steam Generator Low Pressure Signal (SGLP) (continued)

(continued)

This L C 0 applies to failures in the four sensor subsystems, including sensors, bistables, and associated equipment. Failures in the actuation subsystems are considered Actuation Logic failures and are addressed in LC0 3.3.4.

Recirculation Actuation Signal (RAS)

This LC0 requires four channels of SIRWT Low Level to be OPERABLE in MODES 1,2, and 3.

The setpoint was chosen to provide adequate water in the containment sump for I-IPSI pump net positive suction head -

-.

following an accident, but prevent the pumps from running dry during the switchover.

The upper limit on the Allowable Value for this trip is setlow enough to ensure RAS does not initiate before sufficient water is transferred to the containment sump. Premature recirculation could impair the reactivity control Function of safety injection by limiting the amount of boron injection. Premature recirculation could also damage or disable the recirculation system if recirculation begins before the sump has enough water.

The lower limit on the SIRWT Low Level trip Allowable Value is high enough to transfer suction to the containment sump prior to emptying the SIWWT.

Auxiliary Feedwater Actuation Sicrnal (AFAS)

The AFAS logic actuates AFW to each SG on a SG Low Level in either SG.

The Allowable Value was chosen to assure that AFW flow would be initiated while the SG could still act as a heat sink and steam source, and to assure that a reactor trip would not occur on low level without "re actuation of AFW.

Palisades Nuclear Plant & 3.3.3-1 4 Revised 0312012008

ESF Instrumen"c.ir'r3n B 3.3.3 BASES LC0 (continued)

This LC0 requires four channels for each steam generator of Steam Generator Low Level to be OPERABLE in MODES 1,2, and 3.

5. Containment High Pressure Signal (CHP)

This LC0 requires four channels of CHP to be OPERABLE for each of the associated ESF trains (left and right) in MODES 1, 2, 3 and 4.

The setpoint was chosen so as to be high enough to avoid actuation by containment temperature or atmospheric pressure changes, but low enough to be quickly actuated by a LOCA or a

-

MSLB in the containment.

6. Containment I-ligh Radiation Signal (CHR)

This LC0 requires four channels of CHR to be OPERABLE in MODES 1,2,3, and 4.

The setpoint is based on the maximum primary coolant leakage to the containment atmosphere allowed by LC0 3.4.1 3 and the maximum activity allowed by LC0 3.4.1 6. N16concentration reaches equilibrium in containmentatmospheredue to its short half-life, but other activity was assumed to build up. At the end of a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> leakage period the dose rate is approximately 20 R/h as seen by the area monitors. A large leak could cause the area dose rate to quickly exceed the 20 R/h setting and initiate CHR.

7. Automatic Bvpass Removal The automatic bypass removal logic removes the bypasses which are used during plant shu"rown periods, for Pressurizer Low Pressure and Steam Generator Low Pressure actuation signals.

The setpoints were chosen to be above the setpoint for the associated actuation signal, but well below the normal operating pressures.

Palisades Nuclear Plant 3.3-15 Revised 03/20/2008

BASES LC0 7. (continued)

(continued)

This LC0 requires four channels of Pressurizer Low Pressure bypass removal and four channels for each steam generator of Steam Generator Low Pressure bypass removal, to be OPERABLE in MODES I , 2, and 3.

APPLICABILITY All ESF Functions are required to be OPERABLE in MODES 1, 2, and 3. In addition, Containment High Pressure and Containmenwigh Radiation are required to be operable in MODE 4.

In MODES 1, 2, and 3 there is sufficient energy in the primary and secondary systems to warrant automatic ESF System responses to: -

-.

Close the main steam isolation valves to preclude a positive reactivity addition and containment overpressure; Actuate AFW to preclude the loss of the steam generators as a heat sink (in the event the normal feedwater system is not available);

o Actuate ESF systems to prevent or limit the release of fission product radioactivity "r the environment by isolating containment and limiting the containment pressure from exceeding the containment design pressure during a design basis LOCA or MSLB; and s Actuate ESF systems to ensure sufficient borated inventory to permit adequate core cooling and reactivity control during a design basis LOCA or MSLB accident.

The CHP and CMR Functions are required to be OPERABLE in MODE 4 to limit leakage of radioactive material from containment and limit operator exposure during and following a DBA.

The SGLP Function is not required to be OPERABLE in MODES 2 and 3, if all MSlVs are closed and deactivated and all MFRVs and MFRV bypass valves are either closed and deactivated or isolated by closed manual valves, since the SGLP Function is not required to perform any safety functions under these conditions.

Palisades Nuclear Plant B 3.3.3-1 6 Revised 03/20/2008

APPLlCABILlTV In lower MODES, automatic actuation of ESF Functions is not required, (continued) because adequate time is available for plant operators to evaluate plant conditions and respond by manually operating the ESF components.

LC0 3.3.6 addresses automa"cc Refueling CWR isolation during CORE ALTERATIONS or during movementof irradiated fuel.

In MODES 5 and 6, ESFAS initiated systems are either reconfigured or disabled for shutdown cooling operation. Accidents in these MODES are slow to develop and would be mitigated by manual operation of individual components.

ACTIONS The most common causes of channel inoperability are outright failure of =

loop components or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to "ce "safe" condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

Typically, the drift is small and results in a delay of actuation rather than a total loss of function. Determination of setpoint drift is generally made during "re performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the actual trip setpoint is not within the Allowable Value in Table 3.3.3-1, the channel is inoperable and the appropriate Conditionts) are entered.

In "Ie event a channel's trip setpoint is found nonconservative with respect to the Allowable Value in Table 3.3.3-1, or the sensor, instrument loop, signal processing electronics, or ESF bistable is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the plant must enter the Condition statement for the particular protection Function affected.

Palisades Nuclear Plant B 3.3.3-1 7 ised 03/20/2008

BASES ACTIONS When the number of inoperable channels in a trip Function exceeds (continued) those specified in any related Condition associated with the salme trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 should be immediately entered if applicable in the current MODE of operation.

A Note has been added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function in Table 3.3.3-1. Completion Times for the inoperable channel of a Function will be tracked separately.

Condition A applies to the failure of a single bistable or associated -

-

instrumenta"r0n channel of one or more input parameters in each ESF Function except the RRA Function. Since the bistable and associated instrumenWhannel combine to perform the actuation function, the Condition is also appropriate if both the bistable and associated instrument channel are inoperable.

ESF coincidence logic is normally two-out-of-four. If one ESF channel .

is inoperable, startup or power operation is allowed to continue as long as action is "cabten to restore the design level of redundancy.

If one ESF channel is inoperable, startup or power operation is allowed to continue, providing the inoperable channel actuation bistable is placed in trip within 7 days. The provision of four trip channels allows one channel to be inoperable in a non-trip condition up to the 7 day Completion Time allotted to place the channel in "rip. Operating with one failed channel in a non-trip condition during operations, places the ESF Actuation Logic in a two-out-of-three coincidence logic.

If the failed channel cannotbe restored to OPERABLE status in 7 days, the associated bistable is placed in a tripped condition. This places the function in a one-oubof-three configuration.

alisades Nuclear Plant Revised 03/20/2008

ESF Instt'urraenktion B 3.3.3 BASES ACTIONS A.1 (continued)

(continued)

In this configuration, common cause failure of the dependent channel cannowrevent SF actuation. The 9 day Completion Time is based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Condition A is modified by a Note which indicates it is not applicable to the SlRWT Low Level Function.

B.1 and B.2 Condition B applies to the failure of two channels in any of the SF -

-.

Functions except the RAS Function.

With two inoperable channels, one channel actuation device must be placed in trip within the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Completion Time. Eight hours is allowed for this action since it must be accomplished by a circuit modification, or by removing power from a circuit component. With one channel of protective instrumentation inoperable, the ESF Actuation Logic Function is in two-out-of-three logic, bumwith another channel inoperable the ESF may be operating with a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in "rip. This places the ESF in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, ESF actuation will occur.

One of "Ee failed channels must be restored to OPERABLE status within 7 days, and the provisions of Condition A still applied to the remaining inoperable channel. Therefore, the channel that is still inoperable after comple"ron of Required Action 8.2 must be placed in trip if more than 7 days has elapsed since the channel's initial failure.

Palisades Nuclear Plant 3.3.3-1 9 Revised 03/20/2008

ESF Ins'irumeniation B 3.3.3 BASES ACTIONS B.1 and B.2 (continued)

(con"cnued)

Condition B is modified by a Note which indicates that it is not applicable to the SlRWT Low Level Function.

6.1 and 6.2 Condition C applies to one RAS SlRWT Low Level channel inoperable.

The SIRWT low level circuitry is arranged in a "I -out-of-2 taken twice" logic rather than the more frequently used 2-out-of-4 logic. Therefore, Required Action 6.1 differs from other ESF functions. With a bypassed SlRWT low level channel, an additional failure might disable automatic RAS, but would not initiate a premature RAS. With a tripped channel, an additional failure could cause a premature RAS, but would not -

-.

disable the automatic RAS.

Since considerable time is available after initiation of SIS until RAS must be initiated, and since a premature RAS could damage the ESF pumps, it is preferable to bypass an inoperable channel and risk loss of au"romtic RAS than to trip a channel and risk a premature RAS.

The Completion Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> allowed is reasonable because the Required Action involves a circuit modification.

Required Action C.2 requires that the inoperable channel be restored to OPERABLE status within 7 days. The Completion Time is reasonable based upon operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.3-20 Revised 03/20/2008

ESF Ins"ir~lmen"laiic.nio~~

8 3.3.3 BASES ACTIONS 0.1 and 0.2 (continued)

If h e Required Actions and associated Completion Times of Condition A, B, or C are not met for Functions 1, 2, 3, 4, or 7, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant syskms.

E.1 and E.2 If the Required Actions and associated Completion Times of -

-.

Condition A, B, or C are not met for Functions 5 or 6, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions From full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any parlicular ESF Function are found in the SRs column REQUIREMENTS of Table 3.3.3-1 for "rat Function. Most functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

A CHANNEL CHECK is performed once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> on each ESF inpuwhannel which is provided with an indicator to provide a qualitative assurance that the channel is working properly and that its readings are within limits. A CHANNEL CHECK is notperformed on the CHP and SIRWT Low Level channels because they have no associated control room indicator.

Palisades Nuclear Plant B 3.3.3-21 evised 03/20/2008

ESF Inslrumen"catiun B 3.3.3 BASES SURVEILLANCE SR 3.3.3.1 (continued)

REQUIREMENTS (continued) PeirEormance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures

" c a b gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreementcriteria are determined by the plant staff based on a

-

combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, itmay be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE. If the channels are normally off scale during times when Surveillance is required, the CI4ANNEL CHECK will only verify that they are off scale in the same direction.

Offscale low currentloop channels are verified to be reading at the bottom of the range and not failed downscale.

The Frequency of about once every shift is based on operating experience that demonstrates channel failure is rare. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of CHANNEL OPERABILITY during normal operational use of displays associated with the LC0 required channels.

isades Nuclear Plant B 3.3.3-22 Revised 03/20/2008

ESF Instrumenlaiion B 3.3.3 BASES SURVEILLANCE SR 3.3.3.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed every 92 days to ensure the entire channel will perform its intended function when needed. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests atleast once per refueling interval with applicable extensions.

This test is required to be performed each 92 days on ESF input channels provided with on-line testing capability. It is not required for -

the SIRWT Low Level channels since they have no built in test capability. The CHANNEL FUNCTIONAL TEST for SIRWT Low Level channels is performed each 18 months as part of the required CHANNEL CALIBRATION.

The CHANNEL FUNCTIONAL TEST tests the individual channels using an analog test input to each bistable.

Any setpoint adjustment shall be consistent with "re assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Reference 5).

CHANNEL CALIBRATION is a complete check of the instrument channel, including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive surveillances. CHANNEL CALIBRATIONS must be performed consistent with the setpoint analysis.

Palisades Nuclear Plant B 3.3.3-23 Revised 03/20/2008

ESF &ns"irumentalion B 3.3.3 BASES SURVEILLANCE SR 3.3.3.3 (continued)

REQUiREMENTS (continued) The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the extension analysis. The requirements for this review are outlined in Reference 5.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpointanalysis.

REFERENCES 1. FSAR, Chapter 7

2. 10 CFR 50, Appendix A -

3. IEEE Standard 279-1971

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant I B 3.3.3-24 Revised 03/20/2008

PCS Operationai LEAKAGE B 3.4.13 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.1 3 PCS 0pera"ronal LEAKAGE BASES BACKGROUND Components that contain or transport primary coolant to or from the reactor core make up the PCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the PCS.

During plant life, the joint and valve interfaces can produce varying amounts of PCS LEAKAGE, through either normal operational wear or mechanical deterioration. The purpose of the PCS Operational LEAKAGE L C 0 is to limit system operation in the presence of LEAKAGE from these sources to amounts that do notcompromise safety. This L C 0 specifies the types and amounts of LEAKAGE. -

-.

The Palisades Nuclear Plant design criteria (Ref. 1) require means for detecting and, to the extent practical, identifying the source of PCS LEAMAGE.

The safety significance of PCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring primary coolant LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur detrimental to the safety or"the facility and the public.

A limited amount of leakage inside containment is expected from auxiliary systems thakannot be made 100% leaktight. Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with PCS LEAKAGE detection.

This LC0 deals with protection of the Primary Coolant Pressure Boundary (PCPB) from degradation and the core from inadequate cooling, in addition lo preventing the accident analysis radiation release assumptions from being exceeded. The consequences of violating this L C 0 include the possibility of a Loss Of Coolant Accident (LOCA).

Palisades Nuclear Plant B 3.4.1 3-11 Revised 03/20/2008

PCS Operational LEAKAGE B 3.4.13 BASES BACKGROUND As defined in 10 GFW 50.2, the PCPB includes all those pressure-(continued) containing components, such as the reactor pressure vessel, piping, pumps, and valves, which are:

(4) Part of the primary coolant system, or (2) Connected to the primary coolant system, up to and including any and all of the following:

(i) The outermost containment isolation valve in system piping which penetrates the containment, (ii) The second of two valves normally closed during normal reactor operation in system piping which does not penetrate the containment,

-.

(iii) The pressurizer safety valves and PORVs.

APPLICABLE Exceptfor primary to secondary LEAKAGE, the safety analyses do not SAFETY AIIALYSES address operational LEAKAGE. However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for all events resulting in a discharge of steam from the steam generators to the atmosphere assumes that primary to secondary LEAKAGE from all steam generators (SGs) is 0.3 gpm or increases to 0.3 gpm as a result of accident induced conditions. The LC0 requirement to limit primary to secondary LEAKAGE through any one SG to less than or equal to I 5 0 gallons per day is significantly less than the conditions assumed in the safety analysis.

Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a Main Steam Line Break (MSLB), Skam Generator Tube Rupture (SGTR) and the Control Rod Ejection (CRE) accident analyses.

The leakage contaminates the secondary fluid.

The FSAR (Ref. 2 and 5) analysis for SGTR assumes the contaminated secondary fluid is released via the Main Steam Safety Valves and Atmospheric Dump Valves. The 0.3 gpm primary to secondary LEAKAGE safety analysis assumption is inconsequential, relative to the dose contribution from the affected SG.

The MSLB (Ref 3 and 5) is more limiting than SGTR for site radiation releases.

The safety analysis for the MSLB accident assumes the entire 0.3 gpm primary to secondary LEAKAGE is through the affected steam generator as an initial condition.

The CRE (Ref 4 and 5) accident with primary fluid release through the Atmospheric Dump Valves is the most limiting event for site radiation releases.

The safety analysis for the CRE accident assumes 0.3 gpm primary to secondary LEAKAGE in one steam generator as an initial condition.

Palisades Nuclear Plant B 3.4.1 3-2 Revised 03/20/2008

PCS Operalior?ai LEAKAGE B 3.4.13 BASES APPLICABLE The dose consequences resulting from the SGTR, MSLB and CRE accidents are SAFETY ANALYSES well within the guidelines defined in 10 CFR 100 and meets the requirements of Appendix A of 4 0 CFR 50 (GDC 19).

PCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(~)(2).

LC0 PCS operational LEAKAGE shall be limited to:

a. Pressure Boundarv LEAKAGE No pressure boundary LEAKAGE from within the PCPB is allowed, being indicative of material deterioration. LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in increased LEAKAGE. Violation of h i s LC0 could result in continued degradation of the PCPB. LEAKAGE past seals and -

-,

gaskets is not pressure boundary LEAKAGE.

As defined in Section 1.O, pressure boundary LEAKAGE is "LEAKAGE (except SG LEAKAGE) through a nonisolable fault in an PCS component body, pipe wall, or vessel wall."

b. Unidentified LEAKAGE One gallon per minute (gpm) of unidentified LEAKAGE from within the PCPB is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period.

Violation of this LC0 could result in continued degradation of the PCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE from within the PCPB is allowed because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the PC§ makeup system. ldentified LEAKAGE includes LEAKAGE to the containment from specifically located sources which is known not to adversely affect the OPERABILITY of required leakage detection systems, but: does not include pressure boundary LEAKAGE or controlled Primary Coolant Pump (PCP) seal leakoff to the Volume Control Tank (a normal function not considered LEAKAGE). Violation of this LC0 could result in continued degradation of a component or system.

LC0 3.4.14, "PCS Pressure Isolation Valve (PIV) Leakage,"

measures leakage through each individual PIV and can impact this LCO. Of the two PlVs in series in each isolated line, leakage measured through one PIV does not result in PC§ LEAKAGE when Palisades Nuclear Plant Bi3.4.1 3-3 Revised 03/20/2008

PC%0pera"cisnad LEAKAGE B 3.4.13 BASES LC0 C. Iden"cfiedLEAKAGE (coniinued)

"re other is leaktight. If both valves leak and result in a loss of mass from the PC§, the loss must be included in the allowable identified LEAKAGE.

d. Primarv to Secondary LEAKAGE Throuqh Anv One SG The limit of 150 gallons per day per SG is based on the operational LEAKAGE performance criterion in NEI 97-06, Steam Generator Program Guidelines (Ref. 6). The Steam Generator Program operational LEAKAGE performance criterion in NEl 97-06 states, "The RCS operational primary to secondary leakage through any one SG shall be limited to 150 gallons per day." The limit is based on operating experience with SG tube degradation mechanisms that result in tube leakage. The operational leakage rate criterion in conjunction with the implementation of the Steam -

Generator Program is an effective measure for minimizing the frequency of steam generator tube ruptures.

APPLICABILITY In MODES -1, 2, 3, and 4, the potential for PCPB LEAKAGE is greatest when the PC§ is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the primary coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

ACTIONS Unidentified LEAMGE or identified LEAKAGE in excess of the L C 0 limits must be reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor mustbe shut down. This action is necessary to prevent further dekrioration of the PCPB.

Palisades Nuclear Plant B 3.4.1 3-4 Revised 03/20/2008

PCS Operational LEAKAGE B 3.4.13 BASES ACTIONS B.1 and B.2 (continued)

If any pressure boundary LEAKAGE from within "ce PCPB exists or primary lo secondary LEAKAGE is not within limit, or if unidentified or identified LEAKAGE cannome reduced to within limits within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This action reduces the LEAKAGE and also reduces the factors "cat tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required conditions from full power conditions in an orderly manner and without challenging plant systems. In MODE 5, the pressure stresses acting on the PCPB are much lower, and further deterioration is much less likely. -.

-

SURVEILLANCE SR 3.4.13.1 REQUIREMENTS Verifying PCS LEAKAGE to be within the L C 0 limits ensures the integrity of the PCPB is mainbined. Pressure boundary LEAKAGE would at first .

appear as unidentified LEAKAGE and can only be positively identified by inspection. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an PCS water inventory balance.

The PCS water inventory balance must be performed with the reactor at steady stale operating conditions. The Surveillance is modified by two Notes. Note 1 states thatthe SR is not required to be performed in I

MODES 3 and 4, until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> of steady state operation have elapsed.

Steady state operation is required to perform a proper water inventory balance; calculations during maneuvering are not useful and a Note requires the Surveillance to be met only when steady state is established. For PCS operational LEAKAGE determination by water inventory balance, steady slate is defined as stable PC§ pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and PCP seal leakoff.

An early warning of pressure boundary LEAKAGE or uniden"cifed LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level.

These leakage detection systems are specified in L C 0 3.4.15, "PCS Leakage Detection Instrumentation."

Palisades Nuclear Plant B 3.4.1 3-5 Revised 03/20/2008

PCS 0pera"liana.I LEAKAGE B 3.4.1 3 BASES SURVElLkANCE SR 3.4.13.1 (continued)

REQUIREMENTS Note 2 states that this SR is not applicable to primary to secondary LEAKAGE because LEAWGE of 150 gallons per day cannot be measured accurately by an RCS water inventory balance.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. A Note under the Frequency column states that this SR is required to be performed during steady state operation.

This SR verifies that primary to secondary LEAKAGE is less or equal to 150 gallons per day through any one SG. Satisfying the primary to -.

-

secondary LEAKAGE limitensures that the operational LEAKAGE performance criterion in the Steam Generator Program is met. If this SR is not met, compliance with L C 0 3.4.17, "Steam Generator Tube Integrity," should be evaluated. The 150 gallons per day limit is measured at room temperature as described in Reference 7. The operational LEAKAGE rate limit applies to LEAKAGE through any one SG. If itis not practical to assign the LEAKAGE to an individual SG, all the primary to secondary LEAKAGE should be conservatively assumed to be from one SG.

The Surveillance is modified by a Note which states that the Surveillance is not required "t be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after establishment of steady state operation. For RCS primary ta secondary LEAKAGE determination, steady state is defined as stable RCS pressure, k ~ e r a t u r epower

, level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

The Surveillance Frequency of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is a reasonable interval to trend primary to secondary LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents. The primary to secondary LEAKAGE is determined using continuous process radiation monitors or radiochemical grab sampling in accordance with the EPRl guidelines (Ref. 7).

Palisades Nuclear Plant 13 3.4.1 3-6 Revised 03/20/2008

PCS Operational LEAKAGE B 3.4.13 BASES (csn2inued)

REFERENCES 1. FSAR, Section 5.1.5

2. FSAR, Section 14.15

3. FSAR, Section 14.14

4. FSAR, Section 14.16

5. FSAR, Section "1.24

6. NEI 97-06, "Steam Generator Program Guidelines"

7. EPRI, "Pressurized Water Reactor Primary-"r-Secondary Leak Guidelines" Palisades Nuclear Plant B 3.4.1 3-7 Revised 03/20/2008

ECCS - Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure thatthe reactor core is protected after any of the following a.cciden"r:

a. Loss of Coolant Accident (LOCA);

b. Control Rod Ejection accident;

c. Loss of secondary coolantaccident, including a Main Steam -

-.

Line Break (MSLB) or Loss of Normal Feedwater; and

d. Steam Generator Tube Rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are two phases of ECCS operation: injection and recirculation.

In the injection phase, all injection is initially added to the Primary CoolantSystem (PCS) via the cold legs. After the Safety lnjection Refueling Water Tank (SIRWT) has been depleted, the recirculation phase is entered as the ECCS suction is automatically transferred to the containment sump.

Two suitably redundant, 100% capacity trains are provided. Each train consists of a High Pressure Safety Injection (HPSI) and Low Pressure Safety Injection (LPSI) subsystem. In MODES 1 and 2, and in MODE 3 with PCS temperature 2 325"F, both trains must be OPERABLE. This ensures that 100% of the core cooling requirements can be provided in the event of a single active failure.

Palisades Nuclear Plant .5.2-1 Amendment 228

ECCS - Operzting B 3.5.2 BASES BACKGROUND Each train of a Safe'cy Injection Signal (SIS) actuates LPSl flow by (continued) starting one LPSl pump and opening two LPSl loop injection valves.

Each train of an SIS actuates HPSI flow by starting one HPSI pump, opening the four associated WPSI loop injection valves, and closing the pressure control valves associated with each Safety Injection Tank. In addition, each train of a SIS will provide a confirmatory open signal to the normally open Component Cooling Water valves which supply seal and bearing cooling to the LPSI, WPSI, and Containment Spray pumps.

The safety analyses assume that one only train of safety injection is available to mitigate an accident. While operating under the provisions of an ACTION, an additional single failure need not be assumed in assuring thata loss of funclion has notoccurred. Therefore, the LPSl flow assumed in the safety analyses can be met if there is an OPERABLE LPSI flow path from the SlRWT to any two PCS loops. -

The WPSl flow assumed in the safety analyses can be met if there is an OPERABLE HPSI flow path from the SlRWT lo each cold leg. In each case, an OPERABLE flow path must include an OPERABLE pump and an OPERABLE injection valve.

A suction header supplies water from the SlRWT or the containment sump to the ECCS pumps. Separate piping supplies each train. The discharge headers from each HPSl pump divide into four supply lines after entering the containment, one feeding each PCS cold leg. The discharge headers from each LPSl pump combine to supply a common header which divides into four supply lines after entering containment, one feeding each PCS cold leg.

The hot-leg injection piping connects the I-IPS1 Train 1 header and the HPSI Train 2 header to the PGS hot-leg. For long term core cooling after a large LOCA, Hobleg injection is used to assure that for a large cold-leg PCS break, net core flushing flow can be maintained and excessive boric acid concentration in the core which could result in eventual precipitaaon and core flow blockage will be prevented. Within a few hours after a LOCA, if shutdown cooling is not in operation, the operator initiates simultaneous hot-leg and cold-leg injection. Hot-leg injection motor-operated valve throttle position and installed flow orifices cause HPSI flows to be split approximately equally between hot- and cold-leg injection paths.

Palisades Nuclear Plant Amendment 228

APPLICABLE The L C 0 heips to ensure that the following acceptance criteria, SAFETY ANALYSES established by I 0 CFR 50.46 for ECCSs, will be metfollowing a LOCA:

a. Maximum fuel e1emen"cladding temperature is r 2200°F;

b. Maximum cladding oxidation is r 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is r 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

-

-.

e. Adequate long term core cooling capability is maintained.

The LC0 also limits the potential for a posttrip return to power following an MSLB event.

Both a HPSl and a LPSI subsystem are assumed to be OPERABLE in the large break LOCA analysis at Cull power (Ref. 2). This analysis establishes a minimum required runout flow for the HPSI and LPSl pumps, as well as the maximum required response time for their actuation. The WPSl pump is also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the I-IPSI pump. The SGTR and MSLB accident analyses also credit the MPSI pumps, but are not limiting in their design.

The large break LOCA eventwith a loss of offsite power and a single failure (disabling one ECCS train) establishes the OPERABILITY requiremenb for the ECCS. During the blowdown stage of a LOCA, the PCS depressurizes as primary coolan"rs ejected through the break into the con"rinment. The nuclear reaction is terminabd either by moderator voiding (during large breaks) or control rod inserlion (during small breaks).

Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

On smaller breaks, PCS pressure will stabilize at a value dependent upon break size, heat load, and injection flow. The smaller the break, the higher this equilibrium pressure. In all LOCA analyses, injection flow is not credited until PCS pressure drops below the shutoff head of the HPSI pumps.

Palisades Nuclear Plant 3.5.2-4 Arne

ECCS - Operating B 3.5.2 APPLICABLE The LC0 ensures that an E@CStrain will deliver sufficient water to SAFETY ANALYSES match decay heat boiloff rates soon enough to minimize core damage (continued) for a large LOCA. It also ensures that the HPSI pump will deliver sufficient water during a small break LOCA and provide sufficient boron to limit the return to power following an MSLB event. For smaller LOCAs, PCS inventory decreases until the PCS can be depressurized below the HPSI pumps' shutoff head. During this period of a small break LOCA, the SGs continue to serve as the heatsink providing core cooling.

ECCS - Operating satisfies Criterion 3 of 10 CFR 50.36(~)(2).

In MODES I and 2, and in MODE 3 with PCS temperature 2 325OF, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming there is a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

An ECCS train consists of an HPSl subsystem and a LPSl subsystem.

ln addition, each train includes the piping, instruments, and controls to ensure the availability of an OPERABLE flow path capable of taking suction from the SIRWT on an SIS and automatically transferring suction to the containment sump upon a Recirculation Actuation Signal (RAS).

During an event requiring ECCS actuation, a flow path is provided to ensure an abundant supply of water from the SIRWT to the PCS, via the HPSl and LPSl pumps and their respective supply headers, to each of the four cold leg injection nozzles is available. During the recirculation phase, a flow path is provided from the conbinment sump to the PCS via the HPSl pumps. For worst case conditions, the containment building water level alone is not sufficient to assure adequate Net Positive Suction Head (NPSH) for the HPSl pumps.

Therefore, to obtain adequate NPSM, a portion of the Containment Spray (CS) pump discharge flow is diverted from downstream of the shutdown cooling heat exchangers to the suction of the HPSl pumps at recirculation during a large break LOCA. In this configuration, the CS pumps and shutdown cooling heat exchangers provide a support function for HPSl flow path OPERABILITY. The OPERABILITY requirements for the CS pumps and shutdown cooling heat exchangers are addressed in L C 0 3.6.6, "Containment Cooling Systems." Support system OPERABILITY is addressed by LC0 3.0.6.

The flow path for each train must maintain its designed independence to ensure that no single active failure can disable both ECCS trains.

Palisades Nuclear Plant B 3.5.2-5 Amendment 228

ECCS - Operating 8 3.5.2 BASES APPLICABILBTY in MODES l a n d 2, and in MODE 3 with PCS temperature 2 32S0F, the ECCS OPERABILITY requirements for the limiting Design Basis Accident (DBA) large break LOCA are based on full power operation.

Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The HPSl pump performance is based on the small break LOCA, which establishes the pump performance curve and has less dependence on power. The requirements of MODE 2 and MODE 3 with PCS temperature 2 32S°F, are bounded by the MODE I analysis.

The ECCS functional requirements of MODE 3, with PCS temperature

< 32S°F, and MODE 4 are described in LC0 3.5.3, "ECCS - Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an -.

event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LC0 3.4.7, "PCS Loops -

MODE 5, Loops Filled," and LC0 3.4.8, "PCS Loops - MODE 5, Loops Not killed." MODE 6 core cooling requirements are addressed by LC0 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level," and LC0 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS Condition A is applicable whenever one LPSl subsystem is inoperable.

With one LPSl subsystem inoperable, action must be taken to restore OPERABLE status within 7 days. In this condition, the remaining OPERABLE ECCS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure to the remaining LPSI subsystem could result in loss of ECCS function. The 7 day Completion Time is reasonable to perform corrective maintenance on the inoperable LPSi subsystem. While mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time, this 7 day Completion Time is based on the findings of the deterministic and probabilistic analysis in Reference 5. Reference 5 concluded that extending the Completion Time to 7 days for an inoperable LPSl subsystem provides plantoperational flexibility while simultaneously reducing overall plant risk. This is because the risks incurred by having the LPSI subsystem unavailable for a longer time at power will be substantially offset by the benefits associated with avoiding unnecessary plant transitions and by reducing risk during plant shutdown operations.

Palisades Nuclear Plant B 3.5.2-6 Amendment 228

ECCS - Operating B 3.5.2 BASES AGVlONS -

B.1 (continued)

Condition B is applicable whenever one or more ECCS trains is inoperable for reasons other than one inoperable LPSl subsystem.

Action B.1 requires restoration of both ECCS trains, (WPSI and LPSl) to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on an NRC study (Ref. 3), assuming that at least 100% of the required ECCS flow (that assumed in the safety analyses) is available.

If less than 100% of the required ECCS flow is available, Condition D must also be entered.

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time under conditions when a required system can perform its required safety function, but may not be able to do so assuming an additional failure. When operating in accordance with the Required Actions of an -

-

LC0 Condition, it is not necessary to be able to cope with an additional single failure.

The ECCS can provide one hundred percent of the required ECCS flow following the occurrence of any single active failure. Therefore, the ECCS function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under "rat condition, however, the ability to provide the function after the occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

6.1 and C.2 Condition C is applicable when the Required Actions of Condition A or B cannot be completed within the required Completion Time. Either Condition A or B is applicable whenever one or more ECCS trains is inoperable. Therefore, when Condi"con C is applicable, either Condition A or B is also applicable. Being in Conditions A or B, and Condition C concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition C while the plant is still within the applicable conditions of the LCO.

If the inoperable ECCS trains cannot be restored to OPERABLE status within the required Completion Times of Condition A and B, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and PCS temperature reduce to < 325°F within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.5.2-7 Amendment 228

BASES AGT18F\BS -D.1 (continued)

Condi"con D is applicable with one or more trains inoperable when "rere is less than 100% of "re required ECCS flow available. Either Condition A or B is applicable whenever one or more ECCS trains is inoperable.

Therefore, when this Gondi"con is applicable, either Condition A or B is also applicable. Being in Conditions A or B, and Condition D concurrently maintains both Completion Time clocks for instances where equipment repair allows exitfrom Condition D (and L C 0 3.0.3) while the plant is still within the applicable conditions of the LCO.

One hundred percent of the required ECCS flow can be provided by one OPERABLE HPSl subsystem and one OPERABLE LPSI subsystem. The required LPSI flow (that assumed in the safety analyses) is available if there is an OPERABLE LPSl flow path from the SIRWT to any two PCS loops. Shutdown cooling flow control valve,

-

-.

CV-3006 must be full open. The required I-lPSI flow (that assumed in the safety analyses) is available if there is an OPERABLE WPSl flow path from the SIRWT to each PCS loop (having less than all four PCS loop flowpaths may be acceptable if verified against current safety analyses). A Containment Spray Pump and a sub-cooled suction valve must be available to support each OPERABLE HPSI pump. In each case, an OPERABLE flow path must include an OPERABLE pump and OPERABLE loop injection valves.

Reference 4 describes situations in which one component, such as "re shutdown cooling flow control valve, CV-3006, can disable both ECCS trains. With one or more components inoperable, such that 100% of the required ECCS flow (that assumed in the safety analyses) is not available, the facility is in a condition outside the accident safety analyses.

With less than 100% of the required ECCS flow available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, LC0 3.0.3 must be entered immediately.

Palisades Nuclear Plant A

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the PCS is maintained. CV-3027 and CV-3056 are stoop valves in the minimum recirculation flow path for the ECCS pumps.

If either of these valves were closed when "re PCS pressure was above the shutoff head of the EGGS pumps, h e pumps could be damaged by running with insufficient flow and thus render both ECCS trains inoperable.

Placing 1-15-3027A and HS-30275 for CV-3027, and HS-3056A and HS-3056B for CV-3056, in the open position ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure. These valves are of the type described in Reference 4, which can disable the function of both ECCS trains and invalidate the accident analysis. CV-3027 and CV-3056 are capable of -

-.

being closed from the control room since the SlRWT must be isolated from the containment during the recirculation phase of a LOCA. A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered reasonable in view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that "re proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time. This Surveillance does not require any 'resting or valve manipulation. Rather, it involves verification "rat those valves capable of being mispositioned are in "re correct position.

The 31 day Frequency is appropriate because the valves are operated under procedural control and an improper valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

Palisades Nuclear Plant .5.2-9 Amendment 228

ECCS - Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 REQUIREMENTS (Continued) SR 3.5.2.3 verifies CV-3006 is in the open position and "rat its air supply is isolated. CV-3006 is "re shutdown cooling flow control valve located in the common LPSl flow path. The valve must be verified in the full open position to support the low pressure injection flow assumptions used in the accident analyses. The inadvertent misposition of this valve could result in a loss of low pressure injection flow and thus invalidate these flow assumptions. CV-3006 is designed to be held open by spring force and closed by air pressure. To ensure the valve cannot be inadvertently misaligned or change position as the result of a hotshort in the control circuit, the air supply to CV-3006 is isolated. Isolation of the air supply to CV-3006 is acceptable since the valve does not require automatic repositioning during an accident.

-

-

The 31 day Frequency has been shown to be acceptable through operating practice and the unlikely occurrence of the air supply to CV-3006 being unisolated coincident with a inadvertent valve misalignment event or a hot short in the control circuit.

Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller damage or other hydraulic component problems is required by Section XI of the ASME Code. This type of testing may be accomplished by measuring the pump developed head at only one pointof the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance atthe test flow is greater than or equal "c the performance assumed in the plant safety analysis. SRs are specified in the lnservice Testing Program, which encompassesSection XI of the ASME Code.

Section XI of the ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SW 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7 These SRs demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated actuation signal, i.e., on an SIS or RAS, thateach ECCS pump starts on receiptof an actual or simulated actuation signal, i.e., on an SIS, and that the LPSi pumps stop on receipt of an actual or simulated actuation signal, i.e., on an RAS. RAS opens the HPSI subcooling valve CV-3071, if the associated HPSl pump is operating. After the containment sump valve CV-3030 opens from RAS, HPSl subcooling valve CV-3070 will open, if the associated HPSl pump is operating. RAS will re-position CV-3001 and CV-3002 to a predetermined throttled position. RAS will close Palisades Nuclear Plant B 3.5.2-10 Amendment 228

BASES SURVEl LLANGE SR 3.5.2.5, SW 3.5.2.6, and S R 3.5.2.7 REQUIREMENTS (continued) containment spray valve CV-3001, if containment sump valve CV-3030 does not open. This Surveillance is notrequired For valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plantoutage and the potential for unplanned transients if the Surveillances were performed with the reactor at power. The 18 month Frequency is also acceptable based on consideration of the design reliability of the equipment and operating experience. The actuation logic is tested as part of "re Engineered Safety Feature (ESF) testing, and equipment performance is monitored as part of the inservice Testing Program. -

-.

The MPSl HotLeg Injection motor operated valves and the LPSl loop injection valves have position switches which are setat other than the full open position. This surveillance verifies that these position switches are setproperly.

The HPSl Hot leg injection valves are manually opened during the post-LOCA long term cooling phase to admit HPSl injection flow to the PCS hot leg. The open position limit switch on each HPSI hot leg isolation valves is set to establish a predetermined flow split between the I-IPSI injection entering the PCS hot leg and cold legs.

The LPSl loop injection MOVs open automatically on a SIS signal. The open position limit switch on each LPSl loop injection valve is set to establish the maximum possible flow through that valve. The design of these valves is such that excessive turbulence is developed in the valve body when the valve disk is at the full open position. Stopping the valve travel at slightly less "ran full open reduces the turbulence and results in increased flow. Verifying that the position stops are properly set ensures that a single low pressure safety injection subsystem is capable of delivering the flow rate required in the safety analysis.

The 18 month Frequency is based on the same factors as those stated above for SR 3.5.2.5, SR 3.5.2.6, and SR 3.5.2.7.

Palisades Nuclear Plant B 3.5.2-4 "1 Amendment 228

Periodic inspection of the ECCS containment sump passive strainer assemblies ensures that the post-LOCA recirculation flowpath to "re ECCS train containment sump suction inlets is unrestricted. Periodic inspection of the containment sump entrance pathways, which include containment sump passive strainer assemblies, containment sump downcomer debris screens, containment floor drain debris screens, containment sump vent debris screens, and reactor cavity coriurn plug bottom cup support assemblies, ensures that the containment sump stays in proper operating condition. The migration of LOCA-generated debris larger than the strainer perforation diameter through the two one-inch reactor cavity drain line coriurn plugs is not considered to be credible. The 18-month Frequency is based on the need to perform this Surveillance under outage conditions. This Frequency is sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.17

3. NRC Memorandum to V. Stello, Jr., from 13. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975

4. IE Information Notice No. 87-01, January 6, 1987

5. CE-NPSD-994, "CEOG Joint Applications Report for Safety Injection Tank AOTJSTI Ex"cnsion," May 1995 Palisades Nuclear Plant Amendment 2228

SIRWT B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Safety Injection Refueling Water Tank (SIRWT)

BACKGROUND The SIRWT supports "re ECCS and the Containment Spray System by providing a source of borated water for Engineered Safely Feature (ESF) pump operation.

The SIRWT supplies two ECCS trains by separate, redundant supply headers. Each header also supplies one train of "ce Containment Spray System. An air operated isolation valve is provided in each header which isolates the SIRWT from the ECCS after the ESF pump suction has been transferred "i the containment sump following -

-.

depletion of the SIRWT during a Loss of Coolant Accident (LOCA).

A separate header is used to supply the Chemical and Volume Control System (CVCS) from the SIRWT. Use of a single SlRWT to supply both trains of the ECCS and Containment Spray System is acceptable since the SIRWT is a passive component, and passive failures are not assumed to occur concurrently with any Design Basis Eventduring the injection phase of an accident. Not all the water stored in the S I W T is available for injection following a LOCA; the location of the SF pump suction piping in the SIRWT will result in some portion of the stored volume being unavailable.

The High Pressure Safely Injection (HPSI) and Low Pressure Safety Injection (LPSI) pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at shutoff head conditions. These lines discharge back to the SIRWT, which vents to the atmosphere. When the suction for the ESF pumps is transferred to the containment sump, the recirculation path must be isolated to prevent is a release of the conbinment sump contents to the SIRWT. If not isolated, this flow path could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ESF pumps.

Palisades Nuclear Plant B 3.5.4-1 Amendment 227

SERWT B 3.5.4 BASES BACKGROUND This LC0 ensures that:

(continued)

a. The SIRWT contains sufficient borated water to support SF pump operation during the injection phase;

b. SufficienWater volume exists in the containment sump to support continued operation of the ESF pumps at the time of transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a LOCA.

insufficient water inventory in the SIRWT could resultin insufficient cooling capacity of the ECCS when the transfer to the recirculation mode occurs. Improper boron concentrations could resultin a reduction - -.

of shutdown margin or excessive boric acid precipitation in the core following a LOCA, as well as excessive stress corrosion of tnechanical components and systems inside containment.

APPLICABLE During accident conditions, the SIRWT provides a source of borated SAFETY ANALYSES water "c the MPSI, LPSI, and Containment Spray pumps. As such, it provides containment cooling and depressurization, core cooling, replacemen"cnven"rry, and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of Bases B 3.5.2, "ECCS -

Operating," and B 3.6.6, "Containment Cooling Systems." These analyses are used to assess changes to the SIRWT in order "r evaluate their effects in relation to the acceptance limits.

In MODES 1,2, and 3 "re minimum volume limit of 250,000 gallons is based on two factors:

a. Sufficient deliverable volume must be available to provide at least 20 minutes of full flow from one train of ESF pumps prior to reaching a low level switch over to "re containment sump for recirculation; and

b. The containment sump water volume must be sufficient to support continued ESF pump operation after the switch over to recirculation occurs. This sump volume water inventory is supplied by the SIRWT borated water inventory.

Palisades Nuclear Plant B 3.5.4-2 Amendment227

BASES APPLICABLE Twenty minutes is the point at which approximately 75% of the design SAFEW YANLVSES flow of one HPSl pump is capable of meeting or exceeding the decay (con"cnued) heat boiloff rate.

The SlRWT capacity, alone, is not sufficient to provide adequate Net Positive Suction Head (NPSH) for the HPSl pumps after switch over to the containment sump for the worst case conditions. To assure adequate NPSH for the HPSI pumps, their suction headers are automatically aligned to the discharge of the Containment Spray Pumps (Ref. 2). Restrictions are placed on Containment Spray Pump operation with this alignment to ensure the Containment Spray Pumps have adequate NPSI-I (Ref. 3).

In MODE 4, the minimum volume limit of 200,000 gallons is based on -

engineering judgment and considers factors such as:

-

a. The volume of water transferred from the SIRWT to the PCS to account for the change in PCS water volume during a cooldown from 532°F to 200°F (approximately 17,000 gallons assuming an initial PCS volume of 80,000 gallons); and

b. The minimum SIRWT water volume capable of providing a sufficient level in the containment sump to support LPSI pump operation following a LOCA.

Due to the reduced PCS temperature and pressure requirements in MODE 4, and in recognition that water from the SIRWT used for PCS makeup is available for recirculation following a LOCA, the minimum water volume limit for the SIRWT in MODE 4 is lower than in MODES 1, 2, or 3.

The 1720 ppm limit for minimum boron concentration was established to ensure that, following a LOCA with a minimum level in the SIRWT, the reactor will remain subcritical in the cold condition following mixing of the SIRWT, Safety Injection Tanks, and PCS water volumes. Small break LOCAs assume that all full-length control rods are inseded, except for the control rod of highest worth, which is withdrawn from the core. Large break LOCA analyses assume that all full-length control rods remain withdrawn until the blowdown phase is over. For large break LOCAs, the initial reactor shutdown is accomplished by void formation. The most limiting case occurs at beginning of core life.

Palisades Nuclear Plant B 3.5.4-3 Amendment 227

BASES APPLICABLE The maximum boron limitof 2500 ppm in the SlRWT is based on boron SAFETY ANALYSES precipita"conin the core following a LOCA. With the reactor vessel at (continued) saturated conditions, the core dissipates heat by pool nucleate boiling.

Because of "cis boiling phenomenon in the core, the boric acid concentration will increase in "cis region. If allowed to proceed in this manner, a point will be reached where boron precipitation will occur in the core. Post LOCA emergency procedures direct the operator to establish simultaneous hot and cold leg injection to prevent this condition by establishing a forced flow path through the core regardless of break location. These procedures are based on the minimum time in which precipitation could occur, assuming that maximum boron concentrations exist in the borated water sources used for injection following a LOCA. Boron concentrations in the SIRWT in excess of the limit could resultin precipitation earlier than assumed in the analysis. -

-

SlRWT boron concentration and volume also determine the post-LOCA pump pH. Sodium Tetraborate (SPB), stored in the lower region of containment, mixes with the SIRWT water following a LOCA to control I pH. Maintaining pH in the proper range is necessary "r retain iodine in solution, preventexcessive hydrogen generation, and to prevent potential long term stress corrosion cracking in ESF piping. STB requirements are addressed in L C 0 3.5.5, "Containment Sump Buffering Agent and Weight Requirements."

The upper limit of 100°F and the lower limit of 40°F on SIRWT temperature are the limits assumed in the accident analysis. SIRWT "ct-npera"ire affects the outcome of several analyses. Although the minimum temperature limit of 40°F was selected to maintain a small margin above freezing (32"F), violation of the minimum temperature could result in unacceptable conclusions I-or some analyses. The upper temperature limit of 100°F is used in "re ContainmenWressure and Temperature Analysis. Exceeding this temperabre will result in higher containmen~ressuredue to reduced containment spray cooling capacity.

The SIWWT satisfies Criterion 3 of 10 CFR 50.36(~)(2).

Palisades Nuclear Plant B 3.5.4-4 Amendment 227

SIRWT B 3.5.4 BASES The SIRWT ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, that the reactor remains subcri"eca1following a DBA, and that an adequate level exists in the containment sump to support ESF pump operation in the recirculation mode.

To be considered OPERABLE, the SIRWT must meet the limits established in the SRs for water volume, boron concentration, and temperature.

APPLlCABILIPQ In MODES 1,2, and 3, the SIRWT OPERABILITY requirements are dictated by the ECCS and Containment Spray System -

OPERABILITY requirements. In MODE 4 the SIRWT OPERABILITY requirements are dictated by ECCS requirements only. As such, the SIRWT must be OPERABLE in MODES 1,2,3, and 4.

Core cooling requirements in MODE 5 are addressed by LC0 3.4.7, "PCS Loops - MODE 5, Loops Filled," and LC0 3.4.8, "PCS Loops -

MODE 5, Loops NoWilled." MODE 6 core cooling requirements are addressed by LC0 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level," and LC0 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

ACTIONS With SIRWT boron concentration or borated water temperature not within limits, it must be returned to within limits within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. In this condition neither the ECCS nor the Containment Spray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE condition. The allowed Comple"ron Time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to restore the SIRWT to within limits was developed considering the time required to change boron concentration or temperature, and that the contents of the lank are still available for injection.

Palisades Nuclear Plant Amendment 227

SIRWT B 3.5.4 BASES ACTIONS -

13.1 (con"rnued)

With SIRWT borated water volume not within limits, it must be returned to within limits within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In this condition, neither the EGCS nor Containmen"rpray System can perform their design functions; therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which these systems are not required. The allowed Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to restore the SIRWT to OPERABLE status is based on this condition simultaneously affecting multiple redundant trains.

6.1 and C.2 If the SlRWT cannot be restored to OPERABLE status within the

-

associated Completion Time, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to a"Eeas"c0DE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and withou"rhallenging plant systems.

SURVEILLANCE SR 3.5.4.1 REQUIREMENTS SIRWT borated water temperature shall be verified every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be within the limits assumed in the accident analysis. This Frequency has been shown to be sufficient to identify kmerature changes "rat approach either acceptable limit.

SR 3.5.4.2 and SR 3.5.4.3 The minimum SIRWT water volume shall be verified every 7 days. This Frequency ensures thata sufficient initial water supply is available for injection and to support continued ESF pump operation on recirculation.

Since the SIRWT volume is normally stable and is provided with a Low Level Alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.4.2 is modified by a Note which states that it is only required to be met in MODES 1,2, and 3.

alisades Nuclear Plant B 3.5.4-6 Amendment 227

BASES SUWVElLLANCE SR 3.5.4.2 and SR 3.5.4.3 (continued)

REQUIREMENTS SR 3.5.4.3 is modified by a Note which states that it is only required to be met in MODE 4. The required minimum SIRWT water volume is less in MODE 4 since the PCS temperature and pressure are reduced and a significant volume of water is transferred from the SIRWT to the PCS during MODE 4 to account For primary coolant shrinkage.

Boron concentration of the SlRWT shall be verified every 31 days "r be within the required range. This Frequency ensures that the reactor will remain subcritical following a LOCA. Further, it ensures that the -

resulting sump pH will be maintained in an acceptable range such that -

boron precipitation in the core will not occur earlier than predicted and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.

Since the SlRWT volume is normally stable, a 31 day sampling Frequency is appropriate and has been shown through operating experience to be acceptable.

REFERENCES I. FSAR, Chapter 6 and Chapter 14

2. Design Basis Document (DBD) 2.02, "High-Pressure Safely injection System," Section 3.3.1

3. EOP 4.0, Loss of Coolant Accident Palisades Nuclear Plant Amendment 227

STB B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (EGGS)

E3 3.5.5 Con"iinmen"cump Buffering Agent and Weight Requirements BACKGROUND Sodium Tetraborate (STB) baskets are placed on the base slab (590 ft elevation) in the containment building to ensure that iodine, which may I

be dissolved in the recirculated primary cooling water following a Loss of Coolant Accident (LOCA), remains in solution (Ref. 1). Recirculation of the water for core cooling and containment spray provides mixing to achieve a uniform neutral pH. STB also helps inhibit Stress Corrosion Cracking (SCC) of austenitic stainless steel components in containment I

during the recirculation phase following an accident.

-.

-

Fuel that is damaged during a LOCA will release iodine in several chemical forms to the reactor coolant and to the containment atmosphere. A porkion of the iodine in the containment atmosphere is washed to the sump by containment sprays. The Safety injection Refueling Water Tank water is borated for reactivity control. This borated water, if left untreated, would cause the sump solution to be acidic. In a low pH (acidic) solution, dissolved iodine will be converted to a volatile form. The volatile iodine will evolve outof solution into the containment atmosphere, significantly increasing the levels of airborne iodine. The increased levels of airborne iodine in containment contribute to the radiological releases and increase the consequences from the accident due to containment atmosphere leakage.

After a LOCA, the components of the safety injection and containment spray systems will be exposed to high "rmperature borated water.

Prolonged exposure to hot untreated sump water combined with stresses imposed on the components can cause SCC. The rate of SCC is a function of stress, oxygen and chloride concentrations, pH, kerneralure, and alloy composition of the components. High

" c ~ e r a t u r e sand low pH, which would be presentafter a LOCA, tend to promote SCC. This can lead to the failure of necessary safety systems or components.

Palisades Nuclear Plant B 3.5.5-1 Amendment No. 227

SIB B 3.5.5 BASES BACKGROUND Adjusting the pH of the recirculation solu"ron to levels above 7.0 (continued) prevents a significan"crac"con of "re dissolved iodine from convefiing to a volatile form. The higher pH thus decreases the level of airborne iodine in containment and reduces the radiological consequences from containment atmosphere leakage following a LOCA. Maintaining the solution pH above 7.0 also reduces the occurrence of SCC of austenitic stainless steel components in containment. Reducing SCC reduces the probability of failure of components.

The highest hydrated form of STB (decahydrate sodium tetraborate) is used to inhibitthe absorption of large amounts of water from the humid atmosphere. Thus, it will undergo less physical and chemical change than the anhydrous form of STB.

APPLICABLE The LOCA radiological consequences analysis takes credit for iodine SAFETY ANALYSES retention in the sump solution based on the recirculation water pH being 2 7.0. The radionuclide releases from the containment atmosphere and the consequences of a LOCA would be increased if the pH of the recirculation water were not adjusted to 7.0 or above.

The containment hydrogen concentration analysis used in the evaluation of the Maximum Hypothetical Accident (MHA) assumes the pH of the containment sump water is between 7.0 and 8.0. The acceptance criteria of the MWA includes a containment lower flammability limit of 4 volume percent for hydrogen. Containment sump water with a pH greater than 8.0 could result in excess hydrogen generation in containment and invalidate the conclusions of the MHA.

ST8 satisfies Criterion 3 of 10 CFR 50.36(~)(2).

I The quantity of STB placed in containment is designed to adjust the pH of the sump water to be between 7.0 and 8.0 after a LOCA. A pH > 9.0 I

is necessary to prevent significant amounts of iodine released from fuel failures and dissolved in the recirculation water from converting to a volatile form and evolving into the containment atmosphere. Higher levels of airborne iodine in containment may increase the release of radionuclides and the consequences of the accident. A pH > 7.0 is also necessary to prevent SCC of austenitic stainless steel components in containment. SCC increases the probability of failure of components.

Palisades Nuclear Plant B 3.5.5-2 Amendment No. 227

STB B 3.5.5 BASES LC0 The pH needs to remain < 8.0 to remain within the assumptions of the (continued) analysis for post-LOCA Hydrogen concentration in the containment.

The minimum acceptable amount of STB is that weight which will ensure a sump solution pH 2 7.0 after a LOCA, with the maximum I

amount of water atthe minimum initial pH possible in the containment sump; a maximum acceptable amount of STB is that weightwhich will I ensure a sump solution pH of 5 8.0 with a minimum amount of water at a maximum initial pH.

The STB is stored in wire mesh baskets placed inside the containment at the 590 ft elevation. Any quantity of STB between 8,186 and 10,553 Ib. will result in a pl-l in the desired range.

APPLICABILITY In MODES 1, 2, and 3, the PCS is at elevated temperature and pressure, providing an energy potential for a LOCA. The potential for a LOCA results in a need for the ability to control the pH of the recirculated coolant.

In MODES 4, 5, and 6, the potential for a LOCA is reduced or nonexistent, and STB is not required.

I ACTIONS -A. 1 If it is discovered that the STB in the containment building is not within limits, action must be taken to restore the STB to within limits.

The Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed for restoring the STB within limits, where possible, because 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is the same time allowed for I

restoration of other ECCS components.

B.1 and 83.2 If the STB cannot be restored within limits within the Completion Time of Required Action A.1, the plant must be brought "c a MODE in which the I LC0 does not apply. The specified Completion Times for reaching MODES 3 and 4 are those used throughout the Technical Specifications; they were chosen to allow reaching the specified conditions from full power in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.5.5-3 Amendment No. 227

SIB B 3.5.5 BASES SURVEILLANCE SR 3.5.5.1 REQUIREMENTS Periodic determination of the mass of ST5 in containment: must be performed due to the possibility of leaking valves and components in "re containment building "rat could cause dissolution of the STB during normal operation. A Frequency of 18 months is required to determine I

that 2 8,186 Ibs and 5 10,553 Ibs of equivalent weight of decahydrate STB are contained in the ST5 baskets. In the event that the total STB weight is less than the minimum weight, a chemical test is performed to confirm that the weight change is due "c the dehydration of the decahydrate form of the STB. It is not necessary to replenish STB if the minimum weight is not met solely due to dehydration of the material.

This requirement ensures that there is an adequate mass of STB to adjust the pH of the pos"rOCA sump solution "f a value 2 7.0 and -

-.

18.0.

The periodic verification is required every 18 months, since determining the mass of the STB baskets is only feasible during outages, and I normal fuel cycles are scheduled for 18 months. Operating experience has shown this Surveillance Frequency acceptable due to the margin in the mass of STB placed in the containment building.

I Periodic testing is performed to ensure the solubility and buffering ability of the ST5 after exposure to the containment environment. Satisfactory completion of this testassures thatthe STB in the baskets is "active."

Adequate buffering capability is verified by a measured pH of the sample STB in boric acid solution. The quantity of the STB sample and quantity and boron concentration of "re water are chosen to be representative of post-LOGA conditions. The pH is measured at 25°C and is verified to be between 7.0 and 8.0.

alisades Nuclear Plant 5 3.5.5-4 Amendment No. 227

BASES SURVEILLANCE SR 3.5.5.2 (continued)

REQUIREMENTS A sampling Frequency of every 18 months is specified. Operating experience has shown this Surveillance Frequency to be acceptable.

REFERENCES 1. FSAR, Section 6.4 Palisades Nuclear Plant Amendment No. 227

Containl-nent Cooling Systems B 3.6.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.6 Gon"cainmn"cooling Systems BASES BACKGROUND The Containment Spray and Containment Air Cooler systems provide containmentatmosphere cooling to limitpost accident pressure and temperature in containment to less than the design values. Reduction of containment pressure reduces the release of fission product radioactivity from containment to the environment, in the event of a Main Steam Line Break (MSLB) or a large break Loss of Coolant Accident (LOCA). The Containment Spray and Containment Air Cooler systems are designed to the requirements of the Palisades Nuclear Plant design criteria (Ref. 1).

The Containment Air Cooler System and Containment Spray System are 1 Engineered Safety Feature (ESF) systems. They are designed to ensure that the heat removal capability required during the post accident period can be attained. The systems are arranged with two spray pumps powered from one diesel generator, and with one spray pump and three air cooler fans powered from the other diesel generator. The Containment Spray System was originally designed to be redundant to the Containment Air Coolers (CACs) and fans. These systems were originally designed such that either two containment spray pumps or three CACs could limit containment pressure to less than design. However, the current safety analyses take credit for one containment spray pump when evaluating cases with three CACs, and no air cooler fans in cases with two spray pumps and both Main Steam Isolation Valve (MSIV) bypass valves closed. If an MSlV bypass valve is open, 2 service water pumps and 2 CACs are also required to be OPERABLE in addition to the 2 spray pumps for containment heat removal.

To address this dependency between the Containment Spray System and the Containment Air Cooler System the title of this Specification is "Containment Cooling Systems," and includes both systems. The LCO is written in terms of trains of containment cooling. One train of containment cooling is associated with Diesel Generator 1-1 and includes Conbinment Spray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 and the associated spray header. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containment Spray Pump P-544 Containment Spray Valve 6\1-3002 and the associated spray header, and CACs VWX-1, VWX-2, and VHX-3 and their associated safety related fans, V-1A, V-28, and V-3A.

Palisades Nuclear Plant B 3.6.6-1 Amendment 227

Csn"lainmeni Coaling Systems B 3.6.6 BASES BACKGROUND 8.i reliance is placed solely on one spray pump and three CACs, at least (con"tnued) Wo service water pumps must be OPERABLE to provide the necessary service water flow "c assure OPERABILITY of the CACs. Additional details of the required equipment and its operation is discussed with the containment cooling system with which it is associated.

Containment Sprav Svstem The Containment Spray System consists of three half-capacity (50%)

motor driven pumps, two shutdown cooling heat exchangers, two spray headers, two full sets of full capacity ((1 00%) nozzles, valves, and piping, two full capacity ((100%) pump suction lines from the Safety Injection and Refueling Water Tank (SIRWT) and the containment sump with the associated piping, valves, power sources, instruments, and controls. The heat exchangers are shared with the Shutdown Cooling System. SIRWT supplies borated water to the containment spray during the injection -

phase of operation. In the recirculation mode of operation, containment spray pump suction is transferred from the SIRWT to the containment sump.

Normally, both Shutdown Cooling Heat Exchangers mus"re available to provide cooling of "te containment spray flow in the event of a Loss of Coolant Accident. If the Containment Spray side (tube side) of one SDC WeaExchanger is out of service, 100% of the required post accident cooling capability can be provided, if other equipmenbutages are limited (refer to Bases for Required Action 6.1).

The Containment Spray System provides a spray of cold borated water into the upper regions of containment to reduce the containment pressure and temperature during a MSLB or large break LOCA event. In addition, the Containment Spray System in conjunction with the use of sodium Tetraborate (LC0 3.5.5, "Containment Sump Buffering Agent and Weight requirement^,^^) serve to remove iodine which may be released following an accident. The SIRWT solution temperature is an impoeant factor in de"rermining the heat removal capability of the Containment Spray System during the injection phase.

Palisades Nuclear Plant B 3.6.6-2 Amendment 227

Coiatainment Cooling Syskerns B 3.6.6 BASES BACKGROUND (continued)

In the recirculation mode of operation, heat is removed from the conhinment sump water by the shutdown cooling heatexchangers.

The Containment Spray System is actuated either automatically by a Containmenwigh Pressure (CI-IP) signal or manually. An automatic actuation opens the containmentspray header isolation valves, starts the three containment spray pumps, and begins the injection phase.

Individual component controls may be used to manually initiate Conbinment Spray. The injection phase continues until an SIRWT Level Low signal is received. The Low Level signal for the SlRWT generates a Recirculation Actuation Signal (RAS) that aligns valves from the containmen"rpray pump suction to the containment sump. RAS re-positions CV-3001 and CV-3002 to a predetermined throttled position to -

-

ensure adequate containment spray pump NPSH. RAS opens the HPSl subcooling valve CV-3071, if the associated HPSl pump is operating.

ARer the containment sump valve CV-3030 opens from RAS, HPSl subcooling valve CV-3070 will open, if the associated HPSl pump is operating. RAS will close containment spray valve CV-3001, if containment sump valve CV-3030 does not open. The Containment Spray System in recirculation mode maintains an equilibrium temperature between the containment atmosphere and the recirculated sump water.

Operation of the Conbinment Spray System in the recirculation mode is con"rolled by the operator in accordance with the emergency operating procedures.

The containment spray pumps also provide a required support function for the High Pressure Safety Injection pumps as described in the Bases for specification 3.5.2. The High Pressure Safety Injection pumps alone may not have adequate NPSH after a postulated accident and the realignment of their suctions from the SlRWT to the containment sump.

Flow is automatically provided from the discharge of the containment spray pumps to the suction of the High Pressure Safety Injection (HPSI) pumps after the change to recirculation mode has occurred, if the MPSI pump is operating. The additional suction pressure ensures that adequate NPSH is available for the High Pressure Safety Injection pumps.

--

Palisades Nuclear Plant B 3.6.6-3 Amendment 227

Containme~ltCooling Syslerms B 3.

6.6 BACKGROUND

Containment Air Cooler Svskem (continued)

The Containment Air Cooler System includes four air handling and cooling units, referred to as the Containment Air Coolers (CACs), which are located entirely within "re containment building. Three of the CACs (VHX-1, VHX-2, and VHX-3) are safety related coolers and are cooled by the critical service w a k e The fourth CAC (VHX-4) is not taken credit for in maintaining containment temperature within limit (the service water inlet valve for VHX-4 is closed by an SIS signal to conserve service water flow), but is used during normal operation along with the three CACs to maintain containment temperature below the design limits.

The DG which powers the fans associated with VHX-1, VHX-2, and VHX-3 (V-1A, V-2A and V-3A) also powers two service water pumps.

This is necessary because if reliance is placed solely on the train with one spray pump and three CACs, at least two service water pumps must -

be OPERABLE to provide the necessary service water flow to assure OPERABlLITY of the CACs.

Each CAC has two vaneaxial fans with direct connected motors which draw air through the cooling coils. Both of these fans are normally in operation, butonly one fan and motor for each CAC is rated for post accidentconditions. The post accident rated "safety related" fan units, V-1A, V-2A, and V-3A, serve to provide forced flow for the associated cooler. A single operating safety related spray header will provide enough air flow to assure that there is adequate mixing of unsprayed conbinment areas to assure the assumed iodine removal by the containment spray. In post accident operation following a SIS, all four Containment air coolers are designed to change automatically to the emergency mode.

The CACs are automatically changed to the emergency mode by a Safety injection Signal (SIS). This signal will trip the normal rated fan motor in each unit, open the high-capacity service water discharge valve from VHX-1, VMX-2, and VHX-3, and close the high-capacity service water supply valve to VHX-4. The test to verify the service water valves actuate to their correct position upon receipt of an SIS signal is included in the suweillance test pedormed as part of Specification 3.7.8,"Service Water System." The safety related fans and the V-48 non-safety related fan are normally in operation and only receive an actuation signal through the DBA sequencers following an SIS in conjunction with a loss of offsite power. This actuation is tested by the surveillance which verifies the energizing of loads from the DBA sequencers in Specification 3.8.1, "AC Sources-Operating."

Palisades Nuclear Plant B 3.6.6-4 Amendment 227

Containmenl Cooling Systems B 3.6.6 APPLICABLE The Containment Spray System and Containmenl Air Cooler SAFETY ANALYSES System limit the temperature and pressure that could be experienced following either a Loss of Coolant Accident (LOCA) or a Main Steam Line Break (MSLB). The large break LOCA and MSLB are analyzed using computer codes designed to predictthe resultant conlainment pressure and temperature transients.

The ContainmenXooIing Systems have been analyzed for three accident cases (Ref. 2). A11 accidents analyses account for the most limiting single active failure.

2. An MSLB occurring at various power levels with both MSlV bypass valves closed, and -.

-

3. An MSLB occurring at 0% RTP with both MSlV bypass valves open.

The postulated large break LOCA is analyzed, in regard to containment ESF systems, assuming the loss of offsite power and the loss of one ESF bus, which is "re worst case single active failure, resulting in one train of Containment Cooling being rendered inoperable (Ref. 6).

The postulated MSLB is analyzed, in regard to containment ESF systems, assuming the worst case single active failure.

The MSLB event is analyzed at various power levels with both MSlV bypass valves closed, and at 0% RTP with both MSlV bypass valves open. I-laving any MSlV bypass valve open allows additional blowdown from the intact steam generator.

The analysis and evaluation show that under the worst-case scenario, the highest peak containment pressure and the peak containment vapor "c~erabre are within the intent of the design basis. (See the Bases for Specifications 3.6.4, "ContainmenWressure,"and 3.6.5, "Containment Air Temperature," for a detailed discussion.) The analyses and evaluations considered a range of power levels and equipmen"r0nfigurations as described in Reference 2. The peak containment pressure case is the 0% power MSLB with initial (pre-accident) conditions of: 140°F and 16.2 psia. The peak temperature case is the 102% power MSLB with initial (pre-accident) conditions of 140°F and 15.7 psia. The analyses also assume a response time delayed initiation in order to provide conservative peak calculated containment pressure and temperature responses.

Palisades Nuclear Plant B 3.6.6-5 Amendment 227

Containment Cooling Systems B 3.6.6 BASES APPLICABLE The external design pressure of the containment shell is 3 psig. This SAFETY ANALYSES value is approximately 0.5 psig greater than the maximum external (continued) pressure that could be developed if the containment were sealed during a period of low barometric pressure and high temperature and, subsequently, the containment atmosphere was cooled with a concurrent major rise in barometric pressure.

The modeled Containment Cooling System actuation from the containment analysis is based on a response time associated with exceeding the Containment High Pressure setpoint to achieve full flow through the CACs and containment spray nozzles. The spray lines within containment are maintained filled to the 735 ft elevation to provide for rapid spray initiation. The ContainmenXooling System total response time of < 60 seconds includes diesel generator startup (for loss of offsite power), loading of equipment, CCA and containment spray pump startup, and spray line filling. -

The performance of the Containment Spray System for post accident conditions is given in Reference 3. The performance of the Containment Air Coolers is given in Reference 4.

The Containment Spray System and the Containment Cooling System satisfy Criterion 3 of 10 CFR 50.36(~)(2).

During an MSLB or large break LOCA event, a minimum of one containment cooling train is required to maintain the containment peak pressure and temperature below the design limits (Ref. 2). One train of containment cooling is associated with Diesel Generator 1-1 and includes Containment Spray Pumps P-54B and P-54C, Containmen"rpray Valve CV-3001 and the associated spray header. This train must be supplemenkd with 2 service water pumps and 2 containment air coolers if an MSlV bypass valve is open. The other train of containment cooling is associated with Diesel Generator 1-2 and includes Containnmn"rpray Pump P-54A, Containment Spray Valve 6\/-3002 and the associated spray header, and CACs VHX-1, VHX-2, and VHX-3 and their associated safety related fans, V-"I, V-2A, and V-38. To ensure that these requirements are met, two trains of containment cooling must be OPERABLE. Therefore, in the event of an accident, the minimum requirements are met, assuming the worst-case single active failure occurs.

Palisades Nuclear Plant

Containn?en"r~oo!ingSystems B 3.6.6 BASES LC0 The Containment Spray System poi4ion of the containmenkooling trains (continued) includes three spray pumps, two spray headers, nozzles, valves, piping, instruments, and controls to ensure an OPERABLE flow path capable of "raking suction from the SIRWT upon an ESF actuation signal and au"rmalica.lly transferring suction to the containment sump.

The ContainmenMir Cooler System portion of the containment cooling train which must be OPERABLE includes the three safety related air coolers which each consist of four cooling coil banks, the safety related fan which mus"ce in operation to be OPERABLE, gravity-operatedfan discharge dampers, instruments, and controls to ensure an OPERABLE flow path.

CAC fans V-IA, V-2A, and V-3A, must be in operation to be considered OPERABLE. These fans only receive a start signal from the DBA -.

sequencer; they are assumed to be in operation, and are not started by either a CHP or an SIS signal.

APPLICABILITY In MODES 1,2, and 3, a large break LOCA event could cause a release of radioactive material to containment and an increase in containment pressure and "remeeralure requiring the operation of the containment spray trains and containment cooling trains.

In MODES 4,5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Thus, the Containment Spray and Containment Cooling systems are not required to be OPERABLE in MODES 4, 5 and 6.

ACTIONS Condition A is applicable whenever one or more con"linmenl cooling trains is inoperable. Action A.1 requires restoration of both trains to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72-hour Comple"con Time for Condition A is based on the assumption that atleast 100% of the required postaccident containment cooling capability (that assumed in the safety analyses) is available. If less than "10% of the required post containment accident cooling is available, Condition C must also be entered.

Mechanical system LCOs typically provide a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time under conditions when a required system can perform its required safety function, but may not be able to do so assuming an additional failure.

When operating in accordance with the Required Actions of an LC0 Condition, it is not necessary to be able to cope with an additional single failure.

Palisades Nuclear Plant [3 3.6.6-7 Amendment 227

ContainmenCooling Systems B 3.6.6 ACTIONS The Conhinment Cooling systems can provide one hundred percent of the required post accident cooling capability following the occurrence of any single active failure. Therefore, the containment cooling function can be met during conditions when those components which could be deactivated by a single active failure are known to be inoperable. Under that condition, however, the ability to provide the function after "re occurrence of an additional failure cannot be guaranteed. Therefore, continued operation with one or more trains inoperable is allowed only for a limited time.

B.1 and B.2 Condition B is applicable when the Required Actions of Condition A cannot be completed within the required Completion Time. Condition A is -

applicable whenever one or more trains is inoperable. Therefore, when Condition B is applicable, Condition A is also applicable. (If less "Ian 100% of the post accident containment cooling capability is available, Condition C must be entered as well.) Being in Conditions A and B concurrently maintains both Completion Time clocks for instances where equipment repair allows exit from Condition B while the plant is still within the applicable conditions of the LCO.

If the inoperable containment cooling trains cannot be restored to OPERABLE status within the required Completion Time of Condition A, the p l a n " c m be brought to a MODE in which the L C 0 does not apply.

To achieve this status, the plant must be brought "c at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Condition C is applicable with one or more trains inoperable when there is less than 100% of the required post accident con"rinmen"rooling capability available. Condition A is applicable whenever one or more trains is inoperable. Therefore, when this Condition is applicable, Condition A is also applicable. Being in Conditions A and C concurrently maintains both Completion Time clocks for instances where equipment repair restores 100% of the required post accident containment cooling capability while the LC0 is still applicable, allowing exit from Condition C (and LC0 3.0.3).

Palisades Nuclear Plant .6.6-8

Cenlainment Cooling Systems B 3.6.6 ACTIONS C.1

- (continued)

Several specific cases have been analyzed in the safety analysis to provide operating flexibility for equipment outages and testing. These analyses show that action A.1 can be entered under certain circumsta.nces, because 100% of the post accident cooling capability is maintained. These specific cases are discussed below.

One hundred percent of the required post accident cooling capability can be provided with both MSlV bypass valves closed if either;

1. Two containment spray pumps, and two spray headers are OPERABLE, or

2. One containment spray pump, two spray headers, and three safety -

related CACs, are OPERABLE (at least two service water pumps -

must be OPERABLE if CACs are to be relied upon).

One hundred percentof the required postaccident cooling capability can be provided for operation with a MSlV bypass valve open or closed if either;

1. Two containment spray pumps, two spray headers, and two safety related CACs, are OPERABLE (at least two service water pumps must be OPERABLE if CACs are to be relied upon), or

2. One containment spray pump, one spray header, and three safety related CACs are OPERABLE (at least three service water pumps must be OPERABLE "l provide the necessary service water flow to assure OPERABILITY of the CACs).

If the Containment Spray side (tube side) of SDC Meat Exchanger E-60B is out of service, "10% of the required post accident cooling capability can be provided, if other equipment outages are limited. One hundred percent of the poshccident cooling can be provided with the Containment Spray side of SDC Heat Exchanger E-60B out of service if the following equipment is OPERABLE: three safety related Containment Air Coolers, two Containmenflpray Pumps, two spray headers, CCW pumps P-52A and P-52B, two SWS pumps, and both CCW Heal Exchangers, and if

1. One CCW Containment Isolation Valve, CV-0910, CV-091I , or 6\1-0940, is OPERABLE, m gJ

2. Two CCW isolation valves for the non-safety related loads outside the containment, CV-0944A and CV-0944 (or CV-0977B), are OPERABLE.

Palisades Nuclear Plant B 3.6.6-9 Amendment 227

Gonlaiilmeni Coaling Systems B 3.6.6 With less than 100% of the required post accident containmen"rooiing capability available, the plant is in a condition outside the assumptions of the safety analyses. Therefore, L C 0 3.0.3 mustbe entered immediately.

SURVEILLANCE SR 3.6.6.1 REQUIREMENTS Verifying the correct. alignment for manual, power operated, and automatic valves, excluding check valves, in the Containment Spray System provides assurance that the proper flow path exists for Containment Spray System operation. This SR also does not apply to valves that are locked, sealed, or otherwise secured in position since -

these were verified to be in the correct positions prior to being secured.

This SR also does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation. Rather, it involves verification that those valves outside containment and capable of potentially being mispositioned, are in the correct position.

Operating each safety related Containment Air Cooler fan unit for 2 15 minugs ensures that all trains are OPERABLE and are functioning properly. The 31-day Frequency was developed considering the known reliability of the fan units, the two train redundancy available, and the low probability of a significant degradation of the containment cooling train occurring between surveillances.

Verifying the containment spray header is full of water to the 735 ft elevation minimizes the time required to fill the header. This ensures that spray flow will be admitted to "re conbinment atmosphere within the time frame assumed in the containment analysis. The 31-day Frequency is based on the static nature of the fill header and the low probability of a significant degradation of the water level in the piping occurring between surveillances.

Verifying a total service water flow rate of 2 4800 gpm to CACs VHX-I ,

VHX-2, and VHX3, when aligned for accident conditions, provides assurance the design flow rate assumed in the safety analyses will be achieved (Ref. 8). Also considered in selecting this Frequency were the Palisades Nuclear Plant B 3.6.6-1 0 Amendment 227

Con.tainment Cooling Systems B 3.6.6 BASES SURVEiiLANGE SR 3.6.6.4 (continued)

REQUIREMENTS known reliability of the cooling water system, the two train redundancy, and the low probability of a significant degradation of flow occurring between surveillances.

Verifying that each containment spray pump's developed head at the flow test point is greater than or equal to the required developed head ensures that spray pump performance has not degraded during the cycle. Flow and differential pressure are normal tests of centrifugal pump performance required by Section XI of the ASME Code (Ref. 5).

Since the containment spray pumps cannot be tested with flow through -

-.

the spray headers, they are tested on recirculation flow. This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.6 and SR 3.6.6.7 SR 3.6.6.6 verifies each automatic containment spray valve actuates to its correct position upon receipt of an actual or simulated actuation signal.

This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls.

SR 3.6.6.7 verifies each containment spray pump starts automatically on an actual or simulated actuation signal. The 18-month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillances were performed with the reactor at power.

Opera"rng experience has shown that these components usually pass the Suweiliances when performed at the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

Where the surveillance of containment sump isolation valves is also required by SR 3.5.2.5, a single surveillance may be used to satisfy both requirements.

This SR verifies each safety related containment cooling fan actuates upon receipt of an actual or simulated actuation signal. The 18-month Frequency is Palisades Nuclear Plant Amendment 227

Con,kainmeni:Cooling Sys"Een-is B 3.6.6 BASES SURVEILLANCE SW 3.6.6.8 (con"cnued)

REQUIREMENTS based on engineering judgement and has been shown to be acceptable through operating experience. See SR 3.6.6.6 and SR 3.6.6.7, above, for furlher discussion of the basis for the 18 month Frequency.

With the containment spray inletvalves closed and the spray header drained of any solution, an inspection of' spray nozzles, or a test that blows low-pressure air or smoke through test connections can be completed. Performance of this SR demonstrates that each spray nozzle is unobstructed and provides assurance that spray coverage of the containment during an accident is not degraded. Verification following maintenance which could result in nozzle blockage is appropriate because this is the only activity that could lead to nozzle blockage.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Section 14.18 FSAR, Sections 6.2 FSAR, Section 6.3 ASME, Boiler and Pressure Vessel Code,Section XI FSAR, Table 14.18.1 -3 FSAR, Table 14.18.2-1 FSAR, Table 9-1 EA-MSLB-2001-01 Rev. 1, Containment Response to a MSLB Using CONTEMPT-LTl28, January 2002.

EA-LOCA-2001-01 Rev. 1, Containment Response to a LOCA Using CONTEMPT-LTl28, January 2002.

Palisades Nuclear Plant B 3.6.6-1 2 Amendment 227

ADVs B 3.7.4.

B 3.7.4 Ammospheric Dump Valves (ADVs)

BASES BACKGROUND The ADVs provide a method for removing decay heal, should the preferred heat sink via the turbine bypass valve to the condenser not be available, as discussed in the FSAR, Section 10.2 (Ref. 1). This is done in conjunction with the Auxiliary Feedwater System providing cooling water from the Condensate Storage Tank (CST). The ADVs may also be used during a normal cooldown when steam pressure drops too low for maintenance of a vacuum in the condenser to permit use of the turbine bypass valve.

-

Four ADVs are provided, two per steam generator. One ADV per steam generator is required to lower steam generator pressure to 885 psig in the event Auxiliary Feedwater Pump P-$6 is needed to supply the steam generators for decay heatremoval.

The ADVs are provided with upstream manual isolation valves to provide a means of isolation in the event an ADV spuriously opens, or fails to close during use. The ADVs are equipped with pneumatic controllers to permit control of the cooldown rate.

The ADVs are provided with a pressurized gas supply from the Bulk Nibogen System that, on a loss of pressure in the normal instrument air supply, automatically supplies nitrogen to operate the ADVs. The nitrogen backup is not required for ADV OPERABILITY. A description of the nitrogen backup is Found in the FSAR, Section 9.5.3 (Ref. 2). I APPLICABLE The design basis of the ADVs is to prevent lifting of the Main Steam SAFETY ANALYSES Safety Valves (MSSVs) following a turbine and reactor "rip and to provide the capability "c cool the plant to SDC System entry conditions when condenser vacuum is lost, making the "Erbine bypass valve unavailable.

Palisades Nuclear Plant B 3.7.4-1 Revised 07716/2008

BASES APPLICABLE In certain accident analyses presented in the FSAR, the ADVs are SAFETY ANALYSES assumed to be used by the operator for decay heat removal.

(continued) The ADVs are credited in the loss of normal feed flow analysis when AFW pump P-8C is used and offsite power is available. Operator action may be required to either trip the four Primary Coolant Pumps (PCPs), start an additional AFW pump, or reduce steam generator pressure. This will allow the required AFW flowrate to the steam generators assumed by the loss of normal feed flow analysis.

The ADVs are equipped with manual isolation valves in the event an ADV spuriously opens, or fails to close during use.

The ADVs satisfy Criterion 3 of 10 CFR 50.36(~)(2).

One ADV is required to be OPERABLE on each steam generator to ensure that at least one ADV is OPERABLE to lower steam generator pressure to 885 psig following an event in which only AFW pump P-8C is available to supply the steam generators. A closed manual isolation valve renders its ADV inoperable, since operator action time to open the manual isolation valve is not supported in the accident analysis.

Failure to meet the LC0 can result in the inability to supply the required AFW flow rate to the steam generators assumed by the loss of normal feed flow analysis.

An ADV is considered OPERABLE when it is capable of providing a controlled relief of the main steam flow, and is capable of fully opening and closing on demand from either the control room or Hot Shutdown Panel (6-33).

AQPLlGABIL19-Y In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the ADVs are required to be OPERABLE.

ln MODES 5 and 6, there are no credible transients requiring ADVs Palisades Nuclear Plant B 3.7.4-2 Revised 0711 612008

ADVs B 3.7.4.

BASES With one required ADV inoperable, action must be taken to restore the ADV to OPERABLE status within 7 days. The 7 day Completion Time takes into account the redundant capability afforded by the remaining OPERABLE ADV, and a nonsafety grade backup in the turbine bypass valve and MSSVs.

With two required ADVs inoperable, action must be taken to restore one of the ADVs to OPERABLE status. As the manual isolation valve can be closed to isolate an ADV, some repairs may be possible with the plant at -

-.

power. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable to repair inoperable ADVs, based on the availability of the turbine bypass valve and MSSVs, and the low probability of an event occurring during this period that requires the ADVs.

6.1 and C.2 If the ADVs cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the L C 0 does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 4, without reliance upon the steam generator for heat removal, within 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.7.4-3 Revised 0711 612008

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cooldown of the PCS, the ADVs must be able to be cycled through their full range. This SR ensures "re ADVs are tested through a full control cycle at least once per 18 months. Performance of inservice testing or use of an ADV during a plant cooldown may satisfy this requirement. Operating experience has shown that these components usually pass "ce SR when performed at the 18 month Frequency. Therefore, the Frequency is acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 10.2

2. FSAR, Section 9.5.3 l-Palisades Nuclear Plant .7.4-4 Revised 0711612008

CRV Filtration B 3.7.90 B 3.7 PLANT SYSTEMS B 3.7.10 Control Room Ventilation (CWV) Filtration BASES BACKGROUND The CRV Filtration provides a protected environment from which occupants I can control the plant following an uncontrolled release of radioactivity.

The CRV Filtration consists of a common emergency intake which splits into two independent, redundant trains that recirculate and filter the air in the control room envelope (CRE) and a CRE boundary "rat limits the inleakage of unfiltered air. The exhaust of each train exhausts into a common supply plenum. Each trairi consists of a prefilter, a heater, a High Efficiency Particulate Air (HEPA) filter, two banks of activated charcoal adsorbers for removal of gaseous activity (principally iodines), a second HEPA filter, and a fan. Ductwork, valves or dampers, doors, barriers, and instrumentation also form part of the system. A second bank of HEPA filters follows the adsorber section to collect carbon fines, and provides back up in case of failure of the main HEPA filter bank.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabitto control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident.

The CRE is protected during normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE.

The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the analyses of design basis accident (DBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

The CRV Filtration is an emergency system, part of which may also operate during normal plant operations in the standby mode of operation. Upon manual initiation or receipt of a containment high pressure or containment high radiation signal, normal air supply to the CRE is isolated, and the stream of ventilation air is recirculated through the filler trains of the system. The I

prefilters remove any large particles in the air. Continuous operation of each train for at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> per month, with the heaters on, reduces moisture buildup on the HEPA filters and adsorbers. The heater is important to the I

effectiveness of the charcoal adsorbers.

Palisades Nuclear Plant B 3.7.10-1 Amendment 230

BASES BACKGROUND Actuation of the system to the emergency mode of operation closes the (continued) normal unfiltered outside air intake and unfiltered exhaust dampers, opens the emergency air intake, and aligns the system for recirculation of the air within the CRE through the redundant trains of HEPA and charcoal filters.

The emergency mode also initiates pressurization and filtered ventilation of the air supply to the CRE.

Outside air is filtered, and then added to the air being recirculated from the CRE. Pressurization of the CRE minimizes infiltration of unfiltered air through the CRE boundary from all the surrounding areas adjacent to the CRE boundary.

A single train will pressurize the CRE to at nominally 0.125 inches water gauge relative to external areas adjacent to the CRE boundary, and provides an air exchange rate in excess of 25% per hour. The CRV Filtration -.

operation in maintaining the CRE habitable is discussed in the FSAR, Section 9.8 (Ref. 1).

I Redundant supply and recirculation trains provide the required filtration should an excessive pressure drop develop across one filter train. Normally open isolation dampers are arranged in series pairs so that the failure of one damper to shut will not result in a breach of isolation. The CRV Filtration is designed in accordance with Seismic Category I requirements.

The CRV Filtration is designed to maintain a habitable environment in the CRE for 30 days of continuous occupancy after a Design Basis Accident (DBA) without exceeding a 5 rem Total Effective Dose Equivalent (TEDE),

which is consistent with 5 rem whole body dose or its equivalent to any part of the body.

APPLICABLE The CRV Filtration components are arranged in redundant, safety I SAFETY ANALYSES related ventilation trains. The location of components and ducting within the CRE ensures an adequate supply of filtered air to all a.reas requiring access.

The CRV Filtration provides airborne radiological protection for the CRE occupants, as demonstrated by "re CRE occupant dose analyses for the most limiting design basis events discussed in the FSAR, Chapter 14 (Ref. 2).

The CRV system provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release. The evaluation of a smoke challenge demonstrates that it will not result in the inability of the CRE occupants to control the reactor either from the control room or from the remote shutdown anels. No CRV Filtration actuation is required for hazardous chemical releases or smoke.

Palisades Nuclear Plant Amendment 230

CRV Filtratioil B 3.7.1 0 BASES APPLICABLE The worst case single active failure of a component of the CRV Filtration, SAFETY ANALYSES assuming a loss of offsite power, does not impair the ability of the system to (continued) perform its design function.

The CRV Filtration satisfies Criterion 3 of 10 CFR 50.36(~)(2).

Two independent and redundant trains of the CRV Filtration are required to be OPERABLE to ensure that at least one is available if a single active failure disables the other train. Total system failure, such as from a loss of both ventilation trains or from an inoperable CRE boundary, could result in exceeding a dose of 5 rem TEDE in the event of a large radioactive release.

Each CRV Filtration train is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE. A CRV Filtration train is considered OPERABLE when the associated:

a. Main recirculation fan and emergency filter fan are OPERABLE;

b. HEPA filters and charcoal adsorber are not excessively restricting flow, and are capable of performing their filtra"ron functions; and

c. Required healer, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CRV Filtration trains to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke This LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative control. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. Since this Note modifies the LCO, no Condition entry is required when the control room boundary is opened under its provisions. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated individual at the opening who is in continuous communication with the operators in the CRE. This individual will have a method to rapidly close the opening and restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

Palisades Nuclear Plant B 3.7.1 0-3 Amendment 230

AISPLICABILiTV In MODES 1, 2, 3, and 4, the CRV Filtration must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA.

In MODES 5 and 6, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining CRV Filtration OPERABLE is not required in MODE 5 or 6, except for the following situations under which significant radioactive releases can be postulated:

a. During CORE ALTERATIONS;

b. During movement of irradiated fuel assemblies; and

c. During movement of a fuel cask in or over the SFP.

ACTIONS With one CRV Filtration train inoperable, for reasons other than an inoperable CRE boundary, action must be taken to restore OPERABLE status within 7 days. In this Condition, the remaining OPERABLE CRV Filtration train is adequate to perform the CRE occupantprotection function. However, the overall reliability is reduced because a single I

failure in "re OPERABLE CRV Filtration train could result in loss of CRV Filtration function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and the ability of the remaining train to provide the required capability.

B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than "re calculated dose of the analyses of DBA consequences (allowed to be up to 5 rem TEDE, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological event. Actions mustbe taken within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to verify that in the event of a DBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the analyses of DBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke.

These mitigating actions (i.e., actions that are taken to offset the consequences of "re inoperable CRE boundary) should be Palisades Nuclear Plant B 3.7.1 0-4

BASES ACTIONS 13.1, B.2, and B.3 (continued)

I preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is reasonable based on the low probability of a DBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the eventof a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

6.1 and 6.2 In MODE 1, 2, 3, or 4, if the inoperable CRV Filtration train or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time of Condition A or B, the plant must be placed in a MODE that minimizes the accident risk. To achieve this status, "ce plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.l, B.2.1, 0.2.2, and D.2.3 During CORE ALTERATIONS, during movement of irradiated fuel assemblies, during movement of a fuel cask in or over the SFP, if Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE CRV Filtration train must be immediately placed in "re emergency mode of operation. This action ensures that the remaining train is OPERABLE, that no failures preventing autoomtic actuation will occur, and thatany active failure will be readily detected.

An alternative "l Required Action D.l is to immediately suspend activities that could result in a release of radioactivity that might require isolation of the CRE, This places the plant in a condition that minimizes the accident risk. This does not preclude the movement of fuel assemblies or a fuel I cask to a safe position.

Palisades Nuclear Plant B 3.7.1 0-5 Amendment 230

CRV Filtration B 3.7.10 ACTIONS E.1, E.2, and E.3 During CORE ALTERATIONS, during movement of irradiated fuel assemblies, or during movement of a fuel cask in or over the SFP, with two CRV Filtration trains inoperable or with one or more CRV Filtration trains inoperable due to an inoperable CRE boundary, action must be laken immediately to suspend activities that could resultin a release of radioactivity that might enter the CRE. This places the plant in a I condition that minimizes the accident risk. This does not preclude the movement of fuel assemblies or a fuel cask to a safe position.

If both CRV Filtration trains are inoperable in MODE 1, 2, 3, or 4 for reasons other than an inoperable CRE boundary (i.e., Condition B), the f CRV Filtration may nome capable of performing "re intended function and the plant is in a condition outside the accident analyses. Therefore, LC0 3.0.3 must be entered immediately.

SURVElLLANCE SR 3.7.1 0.1 REQUIREMENTS Standby systems should be checked periodically to ensure that they function properly. Since the environment and normal operating conditions on this system are not severe, testing each train once every month provides an adequate check on this system.

Monthly heater operations dry out any moisture accumulated in the charcoal from humidity in the ambientair. Each train must be operated for 2 10 continuous hours with the associated heater, VHX-26A or VHX-26B, energized. The 31 day Frequency is based on the known reliability of the equipment, and the two train redundancy available.

This SR verifies that the required CRV Filtration testing is performed in accordance with the \/entilation Filter Testing Program (VFTP). The CRV Filtration filter Zests are in accordance with the VF7-P. The VFTP includes I testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations). Specific test Frequencies I and additional information are discussed in detail in the VFTP.

Palisades Nuclear Plant B 3.7.1 0-6 Amendment 230

CRV Filtration B 3.7.18 BASES SURVEILLANCE REQUIREMENTS SF? 3.7.1 0.3 (continued)

This SR verifies that each CRV Filtration train starts and operates on an I actual or simulated actuation signal. Specific signals (e.g., containment high pressure, containment high radiation) are tested under Section 3.3, "lnstrumentation." This SR is modified by a Note which states this SR is only required to be met in MODES 1, 2, 3 and 4 and during movement of irradiated fuel assemblies in containment. The instrumentation providing the input signal is notrequired in other plant conditions, therefore, to keep consistency with Section 3.3, "Instrumentation," the SR is not required to be met. The Frequency of 18 months is based on industry operating experience and is consistent with the typical refueling cycle. I This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

The CRE is considered habitable when the radiological dose to CRE occupants calculated in the analyses of DBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air inleakage into the CRE is no greater than the flow rate assumed in the analyses of DBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows lime to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident.

Compensatory measures are discussed in Regulatory Guide I .196, Section (3.2.7.3, (Ref. 3) which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 4). These compensatory measures may also be used as mi"egating actions as required by Required Action B.2.

Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 5). Options for restoring the CRE boundary to OPERABLE status include changing the DBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

Palisades Nuclear Plant B 3.7.10-9 Amendment 230

CRV Fil'cralion B 3.7.18 REFERENCES I. FSAR, Section 9.8

2. FSAR, Chapter 14

3. Regulatory Guide 1.I 96, "Control Room Habitability a"right-Water Nuclear Power Reactors"

4. MEI 99-03, "Control Room Habitability Assessment," June 2001.

5. Leiter from Eric J. Leeds (NRC) io James W. Davis (NEl) dated January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No.

ML040300694).

Palisades Nuclear Plant B 3.7.1 0-8 Amendment 230