Text

Technical Specifications Bases Revision 15 Update
	ML021070372
Person / Time
Site:	Palo Verde
Issue date:	03/19/2002
From:	Bauer S; Arizona Public Service Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	102-04671-SAB/TNW/DWG
	Download: ML021070372 (61)
	v • d • e

Scott A. Bauer Department Leader Regulatory Affairs Tel: 623/393-5978 Mail Station 7636 Palo Verde Nuclear Fax: 623/393-5442 P.O. Box 52034 Generating Station e-mail: sbauer@apsc.com Phoenix, AZ 85072-2034 102-04671 -SAB/TNW/DWG March 19, 2002 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Station P1-37 Washington, DC 20555-0001

Dear Sirs:

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2, and 3 Docket Nos. STN 50-528/529/530 Technical Specifications Bases Revision 15 Update Pursuant to PVNGS Technical Specification (TS) 5.5.14, "Technical Specifications Bases Control Program," Arizona Public Service Company (APS) is submitting changes to the TS Bases incorporated into Revision 15, implemented on March 13, 2002. The Revision 15 insertion instructions and replacement pages are provided in the Enclosure.

No commitments are being made to the NRC by this letter.

Should you have any questions, please contact Thomas N. Weber at (623) 393-5764.

Sincerely, SABNW/DWG/Eg -L

Enclosure:

PVNGS Technical Specification Bases Revision 15 Insertion Instructions and Replacement Pages cc: E. W. Merschoff J. N. Donohew J. H. Moorman A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway 0 Comanche Peak 0 Diablo Canyon

Palo Verde 0 South Texas Project 0 Wolf Creek

/ NDI

ENCLOSURE PVNGS Technical Specification Bases Revision 15 Insertion Instructions and Replacement Pages

Remove Page: Insert New Page:

Cover page Cover page List of Effective Pages, List of Effective Pages, Pages 1/2 through Pages 1/2 through List of Effective Pages, List of Effective Pages, Page 7/blank Page 7/blank B 3.3.1-9/B 3.3.1-10 B 3.3.1-9/B 3.3.1-10 B 3.3.1-19/B 3.3.1-20 B 3.3.1-19/B 3.3.1-20 B 3.3.1-21/B 3.3.1-22 B 3.3.1-21/B 3.3.1-22 B 3.3.1-23/B 3.3.1-24 B 3.3.1-23/B 3.3.1-24 B 3.3.1-25/B 3.3.1-26 B 3.3.1-25/B 3.3.1-26 B 3.3.1-27/B 3.3.1-28 B 3.3.1-27/B 3.3.1-28 B 3.3.1-29/B 3.3.1-30 B 3.3.1-29/B 3.3.1-30 B 3.3.1-31/B 3.3.1-32 B 3.3.1-31/B 3.3.1-32 B 3.3.1-33/B 3.3.1-34 B 3.3.1-33/B 3.3.1-34 B 3.3.1-35/B 3.3.1-36 B 3.3.1-35/B 3.3.1-36 B 3.3.1-37/B 3.3.1-38 B 3.3.1-37/B 3.3.1-38 B 3.3.1-39/B 3.3.1-40 B 3.3.1-39/B 3.3.1-40 B 3.3.1-41/blank B 3.3.1-41/B 3.3.1-42 B 3.3.1-43/blank B 3.3.2-5/B 3.3.2-6 B 3.3.2-5/B 3.3.2-6 B 3.3.2-7/B 3.3.2-8 B 3.3.2-7/B 3.3.2-8 B 3.3.2-9/B 3.3.2-10 B 3.3.2-9/B 3.3.3.2-10 B 3.3.2-11/B 3.3.2-12 B 3.3.2-11/B 3.3.2-12 B 3.3.2-13/B 3.3.2-14 B 3.3.2-13/B 3.3.2-14 B 3.3.2-15/blank B 3.3.2-15/B 3.3.2-16 B 3.3.2-17/blank "B 3.3.12-1/B 3.3.12-2 "B 3.3.12-1/B 3.3.12-2 "B 3.5.4-1/B 3.5.4-2 "B 3.5.4-1/B 3.5.4-2 "B 3.9.2-1/B 3.9.2-2 "B 3.9.2-1/B 3.9.2-2 "B 3.9.2-3/B 3.9.2-4 "B 3.9.2-3/B 3.9.2-4

PVNGS Palo Verde Nuclear GeneratingStation Units 1, 2, and 3 Technical Specification Bases Revision 15 March 13, 2002 I-

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. NO. No. No.

B 2.1.1-1 0 3.1.4-5 0 B 2.1.1-2 0 3.1.5-1 0 B 2.1.1-3 10 3.1.5-2 12 B 2.1.1-4 0 3.1.5-3 0 B 2.1.1-5 0 3.1.5-4 0 B 2.1.2-1 0 3.1.5-5 7 B 2.1.2-2 0 3.1.5-6 0 B 2.1.2-3 0 3.1.5-7 1 B 2.1.2-4 0 3.1.5-8 1 B 2.1.2-5 0 3.1.5-9 0 B 3.0-1 0 3.1.5-10 5 B 3.0-2 0 3.1.5-11 12 B 3.0-3 0 3.1.6-1 0 B 3.0-4 0 3.1.6-2 0 B 3.0-5 0 3.1.6-3 0 B 3.0-6 1 3.1.6-4 0 B 3.0-7 0 3.1.7-1 0 B 3.0-8 0 3.1.7-2 0 B 3.0-9 0 3.1.7-3 0 B 3.0-10 14 3.1.7-4 0 B 3.0-11 14 3.1.7-5 0 B 3.0-12 14 3.1.7-6 0 B 3.0-13 0 3.1.7-7 0 B 3.0-14 0 3.1.7-8 0 B 3.0-15 0 3.1.7-9 0 B 3.0-16 0 3.1.8-1 0 B 3.0-17 0 3.1.8-2 0 B 3.0-18 0 3 .1.8-3 0 B 3.0-19 0 3.1.8-4 0 B 3.1.1-1 0 3.1.8-5 0 B 3.1.1-2 0 3.1.9-1 0 B 3.1.1-3 12 3.1.9-2 0 B 3.1.1-4 12 3.1.9-3 0 B 3.1.1-5 12 3.1.9-4 0 B 3.1.1-6 0 3.1.9-5 7 B 3.1.2-1 0 3.1.9-6 1 B 3.1.2-2 0 3.1.10-1 0 B 3.1.2-3 5 3.1.10-2 0 B 3.1.2-4 12 3.1.10-3 0 B 3.1.2-5 0 3.1.10-4 0 B 3.1.2-6 0 3.1.10-5 0 B 3.1.2-7 12 3.1.10-6 0 B 3.1.2-8 0 3.1.11-1 0 B 3.1.2-9 0 3.1.11-2 0 B 3.1.3-1 0 3.1.11-3 0 B 3.1.3-2 0 3.1.11-4 0 B 3.1.3-3 0 3.1.11-5 0 B 3.1.3-4 0 3.2.1-1 0 B 3.1.3-5 0 3.2.1-2 10 B 3.1.3-6 0 3.2.1-3 0 B 3.1.4-1 0 3.2.1-4 0 B 3.1.4-2 0 3.2.1-5 0 B 3.1.4-3 0 3.2.1-6 0 B 3.1.4-4 0 3.2.1-7 0

.PALO VERDE UNITS 1, 2, AND 3 1 Revision 15 I.

March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. NO. No. No.

B 3.2.1-8 0 B 3.3.1-21 15 B 3.2.2-1 0 B 3.3.1-22 is 10 B 3.3.1-23 15 B 3.2.2-2 0 B 3.3.1-24 15 B 3.2.2-3 B 3.2.2-4 0 B 3.3.1-25 15 1 B 3.3.1-26 15 B 3.2.2-5 B 3.3.1-27 15 B 3.2.2-6 0 B 3.2.2-7 0 B 3.3.1-28 is 0 B 3.3.1-29 15 B 3.2.3-1 10 B 3.3.1-30 15 B 3.2.3-2 0 B 3.3.1-31 15 B 3.2.3-3 0 B 3.3.1-32 15 B 3.2.3-4 0 B 3.3.1-33 15 B 3.2.3-5 0 B 3.3.1-34 15 B 3.2.3-6 0 B 3.3.1-35 15 B 3.2.3-7 0 B 3.3.1-36 15 B 3.2.3-8 0 B 3.3.1-37 15 B 3.2.3-9 0 B 3.3.1-38 15 B 3.2.3-10 0 B 3.3.1-39 15 B 3.2.4-1 10 B 3.3.1-40 15 B 3.2.4-2 B 3.3.1-41 15 B 3.2.4-3 0 B 3.2.4-4 0 B 3.3.1-42 15 0 B 3.3.1-43 15 B 3.2.4-5 0 B 3.3.2-1 0 B 3.2.4-6 B 3.3.2-2 0 B 3.2.4-7 0 B 3.3.2-3 1 B 3.2.4-B 0 B 3.3.2-4 1 B 3.2.4-9 0 0 B 3.3.2-5 0 B 3.2.5-1 B 3.2.5-2 10 B 3.3.2-6 15 0 B 3.3.2-7 15 B 3.2.5-3 0 B 3.3.2-8 15 B 3.2.5-4 0 B 3.3.2-9 15 B 3.2.5-5 0 B 3.3.2-10 15 B 3.2.5-6 0 B 3.3.2-11 15 B 3.2.5-7 0 B 3.3.2-12 15 B 3.3.1-1 0 B 3.3.2-13 15 B 3.3.1-2 B 3.3.2-14 15 B 3.3.1-3 0 B 3.3.2-15 15 B 3.3.1-4 0 B 3.3.2-16 15 B 3.3.1-5 0 B 3.3.2-17 15 B 3.3.1-6 0 B 3.3.3-1 0 "B 3.3.1-7 0 "B 3.3.1-8 0 B 3.3.3-2 0 B 3.3.3-3 0 "B 3.3.1-9 15 0

"B 3.3.1-10 0 B 3.3.3-4 B 3.3.3-5 7 B 3.3.1-11 0 B 3.3.3-6 0 B 3.3.1-12 1 1 B 3.3.3-7 0 B 3.3.1-13 0 B 3.3.3-8 0 B 3.3.1-14 6 B 3.3.3-9 0 B 3.3.1-15 B 3.3.3-10 0 "B 3.3.1-16 0 0

"B 3.3.1-17 0 B 3.3.3-11 B 3.3.4-1 0 B 3.3.1-18 0 B 3.3.4-2 0 B 3.3.1-19 15 15 B 3.3.4-3 0 B 3.3.1-20 PALO VERDE UNITS 1, 2, AND 3 2 Revision 15 March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Rev. Page Rev Page No.

an- No. No.

NO -

0 B 3.3.6-14 0 B 3.3.4-4 B 3.3.6-15 0 B 3.3.4-5 0 B 3.3.6-16 0 B 3.3.4-6 0 B 3.3.6-17 0 B 3.3.4-7 0 B 3.3.6-18 0 B 3.3.4-8 0 B 3.3.6-19 0 B 3.3.4-9 0 B 3.3.6-20 0 B 3.3.4-10 0 B 3.3.6-21 B 3.3.4-11 0 B 3.3.6-22 B 3.3.4-12 0 B 3.3.7-1 2 B 3.3.4-13 0 B 3.3.7-2 2 B 3.3.4-14 0 0 B 3.3.7-3 B 3.3.4-15 0 B 3.3.7-4 0 B 3.3.5-1 0 B 3.3.7-5 0 B 3.3.5-2 0 B 3.3.7-6 0 B 3.3.5-3 0 B 3.3.7-7 0 B 3.3.5-4 0 B 3.3.7-8 0 B 3.3.5-5 0 B 3.3.7-9 2 B 3.3.5-6 0 B 3.3.8-1 0 B 3.3.5-7 0 B 3.3.8-2 0 B 3.3.5-8 0 B 3.3.8-3 0 B 3.3.5-9 0 B 3.3.8-4 0 B 3.3.5-10 0 B 3.3.8-5 0 B 3.3.5-11 0 B 3.3.8-6 1 B 3.3.5-12 1 B 3.3.8-7 0 B 3.3.5-13 0 B 3.3.8-8 0 B 3.3.5-14 0 B 3.3.9-1 0 B 3.3.5-15 0 B 3.3.9-2 2 B 3.3.5-16 0 B 3.3.9-3 0 B 3.3.5-17 0 B 3.3.9-4 10 B 3.3.5-18 0 B 3.3.9-5 1 B 3.3.5-19 0 1

"B 3.3.9-6 0 B 3.3.5-20 "B 3.3.9-7 0 B 3.3.5-21 0 0

"B 3.3.10-1 0 B 3.3.5-22 B 3.3.10-2 0 B 3.3.5-23 0 B 3.3.10-3 0 B 3.3.5-24 0 B 3.3.10-4 0 B 3.3.5-25 0 B 3.3.10-5 0 B 3.3.5-26 0 B 3.3.10-6 0 B 3.3.5-27 10 B 3.3.10-7 0 B 3.3.5-28 10 10 "B3.3.10-8 14 B 3.3.5-29 "B 3.3.10-9 14 B 3.3.6-1 0 0

"B 3.3.10-10 14 B 3.3.6-2 B 3.3.10-11 14 B 3.3.6-3 0 B 3.3.10-12 14 B 3.3.6-4 0 B 3.3.10-13 14 B 3.3.6-5 0 B 3.3.10-14 14 B 3.3.6-6 0 B 3.3.10-15 14 B 3.3.6-7 0 0 B 3.3.10-16 14 B 3.3.6-8 B 3.3.10-17 14 B 3.3.6-9 0 0 B 3.3.10-18 14 B 3.3.6-10 B 3.3.10-19 14 B 3.3.6-11 0 B 3.3.10-20 14 B 3.3.6-12 0 B 3.3.10-21 14 B 3.3.6-13 0 3 Revision 15 PALO VERDE UNITS 1, 2, AND 3 March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. NO. No. NO.

B 3.3.11-1 0 B 3.4.9-3 1 B 3.3.11-2 2 B 3.4.9-4 0 B 3.3.11-3 2 B 3.4.9-5 0 B 3.3.11-4 2 B 3.4.9-6 0 B 3.3.11-5 2 B 3.4.10-1 0 B 3.3.11-6 2 B 3.4.10-2 7 B 3.3.11-7 2 B 3.4.10-3 0 B 3.3.12-1 15 B 3.4.10-4 0 B 3.3.12-2 15 B 3.4.11-1 0 B 3.3.12-3 5 B 3.4.11-2 7 B 3.3.12-4 5 B 3.4.11-3 0 B 3.3.12-5 6 B 3.4.11-4 0 B 3.3.12-6 6 B 3.4.11-5 0 B 3.4.1-1 10 B 3.4.11-6 0 B 3.4.1-2 7 B 3.4.12-1 1 0 B 3.4.12-2 1 B 3.4.1-3 B 3.4.1-4 0 B 3.4.12-3 0 B 3.4.1-5 0 B 3.4.12-4 0 B 3.4.2-1 7 B 3.4.12-5 0 B 3.4.2-2 1 B 3.4.13-1 0 0 B 3.4.13-2 0 B 3.4.3-1 B 3.4.3-2 0 B 3.4.13-3 1 B 3.4.3-3 0 B 3.4.13-4 0 B 3.4.3-4 2 B 3.4.13-5 0 B 3.4.3-5 2 B 3.4.13-6 0 B 3.4.3-6 0 B 3.4.13-7 2 B 3.4.3-7 0 B 3.4.13-8 2 B 3.4.3-8 2 B 3.4.13-9 0 B 3.4.4-1 0 B 3.4.13-10 2 B 3.4.4-2 7 B 3.4.14-1 0 B 3.4.4-3 7 B 3.4.14-2 2 B 3.4.4-4 0 B 3.4.14-3 2 B 3.4.5-1 0 B 3.4.14-4 7 B 3.4.5-2 6 B 3.4.14-5 2 B 3.4.5-3 6 B 3.4.14-6 2 B 3.4.5-4 0 B 3.4.14-7 2 B 3.4.5-5 6 B 3.4.15-1 0 B 3.4.6-1 0 B 3.4.15-2 0 B 3.4.6-2 6 B 3.4.15-3 0 B 3.4.6-3 6 B 3.4.15-4 0 B 3.4.6-4 6 B 3.4.15-5 0 B 3.4.6-5 6 B 3.4.15-6 0 B 3.4.7-1 0 B 3.4.15-7 0 B 3.4.7-2 6 B 3.4.16-1 2 B 3.4.7-3 6 B 3.4.16-2 10 B 3.4.7-4 2 B 3.4.16-3 0 B 3.4.7-5 0 B 3.4.16-4 0 B 3.4.7-6 0 B 3.4.16-5 0 B 3.4.7-7 6 B 3.4.16-6 0 B 3.4.8-1 0 B 3.4.17-1 0 B 3.4.8-2 6 B 3.4.17-2 0 B 3.4.8-3 6 B 3.4.17-3 0 B 3.4.9-1 0 B 3.4.17-4 0 B 3.4.9-2 0 B 3.4.17-5 0 PALO VERDE UNITS 1, 2, AND 3 4 Revision 15 March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. NO. No. No.

B 3.4.17-6 0 B 3.6.2-4 0 B 3.5.1-1 0 B 3.6.2-5 0 B 3.5.1-2 0 B 3.6.2-6 0 B 3.5.1-3 7 B 3.6.2-7 0 B 3.5.1-4 0 B 3.6.2-8 0 B 3.5.1-5 0 B 3.6.3-1 0 B 3.5.1-6 0 B 3.6.3-2 0 B 3.5.1-7 1 B 3.6.3-3 0 B 3.5.1-8 1 B 3.6.3-4 1 B 3.5.1-9 0 B 3.6.3-5 1 B 3.5.1-10 1 B 3.6.3-6 1 B 3.5.2-1 0 B 3.6.3-7 1 B 3.6.3-8 ii B 3.5.2-2 0 B 3.5.2-3 0 B 3.6.3-9 1 3.6.3-10 11 "B 3.5.2-4 0 B 1i "B3.5.2-5 0 B 3.6.3-11 11 B 3.5.2-6 0 B 3.6.3-12 B 3.5.2-7 1 B 3.6.3-13 1 B 3.5.2-8 1 B 3.6.3-14 1 B 3.5.2-9 1 B 3.6.3-15 1 B 3.5.2-10 1 B 3.6.3-16 1 B 3.5.3-1 0 B 3.6.3-17 1 B 3.5.3-2 B 3.6.4-1 0 B 3.5.3-3 B 3.6.4-2 1 B 3.5.3-4 0 B 3.6.4-3 1 B 3.5.3-5 0 B 3.6.5-1 0 B 3.6.5-2 1 B 3.5.3-6 B 3.5.3-7 2 B 3.6.5-3 0 0 B 3.6.5-4 0 B 3.5.3-8 1 B 3.5.3-9 0 B 3.6.6-1 0 B 3.5.3-10 2 B 3.6.6-2 2 B 3.6.6-3 1 B 3.5.4-1 B 3.5.4-2 B 3.6.6-4 7 B 3.5.4-3 B 3.6.6-5 1 B 3.5.5-1 0 B 3.6.6-6 0 B 3.5.5-2 7 B 3.6.6-7 1 B 3.5.5-3 40 15 B 3.6.6-8 1 00 B 3.5.5-4 40 B 3.6.6-9 B 3.5.5-5 0 B 3.6.7-1 0 B 3.5.5-6 0 B 3.6.7-2 0 B 3.5.5-7 0 B 3.6.7-3 0 B 3.5.6-1 0 B 3.6.7-4 0 1 B 3.6.7-5 0 B 3.5.6-2 0 B 3.7.1-1 7 B 3.5.6-3 B 3.7.1-2 7 B 3.5.6-4 1 B 3.7.1-3 0 B 3.5.6-5 0 0 B 3.7.1-4 0 B 3.6.1-1 0 B 3.7.1-5 1 B 3.6.1-2 0 B 3.7.1-6 7 B 3.6.1-3 0 B 3.7.2-1 0 B 3.6.1-4 0 B 3.7.2-2 0 B 3.6.1-5 0 B 3.7.2-3 0 B 3.6.2-1 6 B 3.7.2-4 0 B 3.6.2-2 0 B 3.7.2-5 0 B 3.6.2-3 PALO VERDE UNITS 1, 2, AND 3 5 Revision 15 March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.7.2-6 0 B 3.7.13-4 0 B 3.7.3-1 1 B 3.7.13-5 0 B 3.7.3-2 1 B 3.7.14-1 0 B 3.7.3-3 1 B 3.7.14-2 0 B 3.7.3-4 0 B 3.7.14-3 0 B 3.7.3-5 0 B 3.7.15-1 3 B 3.7.4-1 0 B 3.7.15-2 3 B 3.7.4-2 0 B 3.7.16-1 7 B 3.7.4-3 0 B 3.7.16-2 0 B 3.7.4-4 0 B 3.7.16-3 0 B 3.7.5-1 0 B 3.7.16-4 0 B 3.7.5-2 0 B 3.7.17-1 3 B 3.7.5-3 0 B 3.7.17-2 3 B 3.7.5-4 0 B 3.7.17-3 3 B 3.7.5-5 9 B 3.7.17-4 3 B 3.7.5-6 9 B 3.7.17-5 3 B 3.7.5-7 9 B 3.7.17-6 3 B 3.7.5-8 9 B 3.8.1-1 0 B 3.7.5-9 9 B 3.8.1-2 2 B 3.7.5-10 9 B 3.8.1-3 13 B.3.7.5-11 9 B 3.8.1-4 2 B 3.7.6-1 0 B 3.8.1-5 2 B 3.7.6-2 0 B 3.8.1-6 2 B 3.7.6-3 5 B 3.8.1-7 2 B 3.7.6-4 0 B 3.8.1-8 2 B 3.7.7-1 0 B 3.8.1-9 2 B 3.7.7-2 1 B 3.8.1-10 2 B 3.7.7-3 1 B 3.8.1-11 2 B 3.7.7-4 1 B 3.8.1-12 2 B 3.7.7-5 1 B 3.8.1-13 2 B 3.7.8-1 1 B 3.8.1-14 2 B 3.7.8-2 1 B 3.8.1-15 2 B 3.7.8-3 1 B 3.8.1-16 2 B 3.7.8-4 1 B 3.8.1-17 2 B 3.7.9-1 0 B 3.8.1-18 2 B 3.7.9-2 1 B 3.8.1-19 13 B 3.7.9-3 0 B 3.8.1-20 13 B 3.7.10-1 10 B 3.8.1-21 13 B 3.7.10-2 1 B 3.8.1-22 13 B 3.7.10-3 1 B 3.8.1-23 6 B 3.7.10-4 1 B 3.8.1-24 6 B 3.7.11-1 0 B 3.8.1-25 6 B 3.7.11-2 0 B 3.8.1-26 6 B 3.7.11-3 1 B 3.8.1-27 6 B 3.7.11-4 10 B 3.8.1-28 6 B 3.7.11-5 10 B 3.8.1-29 6 B 3.7.11-6 10 B 3.8.1-30 6 B 3.7.12-1 1 B 3.8.1-31 6 B 3.7.12-2 1 B 3.8.1-32 6 B 3.7.12-3 10 B 3.8.1-33 6 B 3.7.12-4 10 B 3.8.1-34 6 B 3.7.13-1 0 B 3.8.1-35 6 B 3.7.13-2 0 B 3.8.1-36 6 B 3.7.13-3 0 B 3.8.1-37 6 PALO VERDE UNITS 1, 2, AND 3 6 Revision 15 March 13, 2002

TECHNICAL SPECIFICATION BASES LIST OF EFFECTIVE PAGES Page Rev. Page Rev No. No. No. No.

B 3.8.1-38 6 B 3.8.9-3 0 B 3.8.1-39 6 B 3.8.9-4 0 B 3.8.1-40 6 B 3.8.9-5 0 B 3.8.1-41 6 B 3.8.9-6 0 B 3.8.2-1 0 B 3.8.9-7 0 B 3.8.2-2 0 B 3.8.9-8 0 B 3.8.2-3 0 B 3.8.9-9 0 B 3.8.2-4 0 B 3.8.9-10 0 B 3.8.2-5 0 B 3.8.9-11 0 B 3.8.2-6 0 B 3.8.10-1 0 B 3.8.3-1 0 B 3.8.10-2 0 B 3.8.3-2 0 B 3.8.10-3 0 B 3.8.3-3 0 B 3.8.10-4 0 B 3.8.3-4 0 B 3.9.1-1 0 B 3.8.3-5 1 B 3.9.1-2 0 B 3.8.3-6 0 B 3.9.1-3 0 B 3.8.3-7 0 B 3.9.1-4 0 B 3.8.3-8 0 B 3.9.2-1 i5 B 3.8.3-9 0 B 3.9.2-2 15 B 3.8.4-1 0 B 3.9.2-3 15 B 3.8.4-2 0 B 3.9.2-4 15 B 3.8.4-3 0 B 3.9.3-1 0 B 3.8.4-4 2 B 3.9.3-2 0 B 3.8.4-5 2 B 3.9.3-3 0 B 3.8.4-6 2 B 3.9.3-4 0 B 3.8.4-7 2 B 3.9.3-5 1 B 3.8.4-8 2 B 3.9.4-1 0 B 3.8.4-9 2 B 3.9.4-2 1 B 3.8.4-10 2 B 3.9.4-3 0 B 3.8.4-11 2 B 3.9.4-4 0 B 3.8.5-1 1 B 3.9.5-1 0 B 3.8.5-2 1 B 3.9.5-2 1 B 3.8.5-3 1 B 3.9.5-3 0 B 3.8.5-4 1 B 3.9.5-4 0 B 3.8.5-5 2 B 3.9.6-1 0 B 3.8.5-6 2 B 3.9.6-2 0 B 3.8.6-1 0 B 3.9.6-3 0 B 3.8.6-2 0 B 3.9.7-1 0 B 3.8.6-3 0 B 3.9.7-2 0 B 3.8.6-4 6 B 3.9.7-3 0 B 3.8.6-5 6 B 3.8.6-6 6 B 3.8.6-7 0 B 3.8.7-1 0 B 3.8.7-2 0 B 3.8.7-3 0 B 3.8.7-4 0 B 3.8.8-1 1 B 3.8.8-2 1 B 3.8.8-3 1 B 3.8.8-4 1 B 3.8.8-5 1 B 3.8.9-1 0 B 3.8.9-2 0 PALO VERDE UNITS 1, 2, AND 3 7 Revision 15 March 13, 2002

RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND RPS Logic (continued)

It is possible to change the two-out-of-four RPS Logic to a two-out-of-three logic for a given input parameter in one channel at a time by trip channel bypassing select portions of the Matrix Logic. Trip channel bypassing a bistable effectively shorts the bistable relay contacts in the three matrices associated with that channel. Thus, the bistables will function normally, producing normal trip indication and annunciation, but a reactor trip will not occur unless two additional channels indicate a trip condition.

Trip channel bypassing carl be simultaneously performed on any number of parameters in any number of channels.

providing each parameter is bypassed in only one channel at a time. An interlock prevents simultaneous trip channel bypassing of the same parameter in more than one channel.

Trip channel bypassing is normally employed during maintenance or testing.

Two-out-of-three logic also prevents inadvertent trips caused by any single channel failure in a trip condition.

In addition to the trip channel bypasses, there are also operating bypasses on select RPS trips. These bypasses are enabled manually in all four RPS channels when plant conditions do not warrant the specific trip protection. All operating bypasses are automatically removed when enabling bypass conditions are no longer satisfied. Operating bypasses are normally implemented in the bistable, so that normal trip indication is also disabled. Trips with operating bypasses include Pressurizer Pressure - Low, Logarithmic Power Level - High. and CPC (DNBR - Low and LPD - High). Refer also to B 3.3.5 for ESFAS operating bypasses.

Reactor Trip Circuit Breakers (RTCBs)

The reactor trip switchgear, addressed in LCO 3.3.4.

consists of four RTCBs. Power input to the reactor trip switchgear comes from two full capacity MG sets operated in parallel, such that the loss of either MG set does not de-energize the CEDMs. Power is supplied from the MG sets to the CEDM's via two redundant paths (trip legs). Trip legs 1 and 3 are in parallel with Trip legs 2 and 4. This ensures that a fault or the opening of a breaker in one trip leg (i.e., for testing purposes) will not interrupt power to the CEDM buses.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-9 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES BACKGROUND Reactor Trip Circuit Breakers (RTCBs) (continued)

Each of the two trip legs consists of two RTCBs in series.

The two RTCBs within a trip leg are actuated by separate initiation circuits.

Each RTCB is operated by either a manual reactor trip push button. a Supplementary Protection System (SPS) trip relay or an RPS actuated Initiation relay. There are four Manual Trip push buttons each push button operates one of the four RTCBs. Depressing either of the push buttons in both trip legs will result in a reactor trip.

push When a Manual Trip is initiated using the control room buttons, the RPS trip paths and Initiation relays are not utilized, and the RTCB undervoltage and shunt trip attachments are actuated independent of the RPS.

Manual Trip circuitry includes the push button and interconnecting wiring to the RTCBs necessary to actuate both the undervoltage and shunt trip attachments but excludes the Initiation relay contacts and their interconnecting wiring to the RTCBs, which are considered part of the Initiation Logic.

Functional testing of the entire RPS, from bistable input through the opening of individual RTCBs, can be performed a either at power or shutdown and is normally performed on quarterly basis. UFSAR, Section 7.2 (Ref. 8). explains RPS testing in more detail.

APPLICABLE Design Basis Definition SAFETY ANALYSES The RPS is designed to ensure that the following operational criteria are met:

0 The associated actuation will occur when the parameter monitored by each channel reaches its setpoint and the specific coincidence logic is satisfied;

Separation and redundancy are maintained to permit a channel to be out of service for testing or maintenance while still maintaining redundancy within the RPS instrumentation network.

(continued)

B 3.3.1-10 REVISION 0 PALO VERDE UNITS 1.2,3

RPS Instrumentation - Operating B 3.3.1 BASES LCO 2. Logarithmic Power Level - High (continued)

This LCO requires all four channels of Logarithmic Power Level - High to be OPERABLE in MODE 2.

In MODES 3. 4, or 5 when the RTCBs are shut and the CEA Drive System is capable of CEA withdrawal conditions are addressed in LCO 3.3.2.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary Logarithmic Power Level - High reactor trips during normal plant operations. The Allowable Value is low enough for the system to maintain a margin to unacceptable fuel cladding damage should a CEA withdrawal event occur.

The Logarithmic Power Level - High trip may be bypassed when logarithmic power is above 1E-4% NRTP to allow the reactor to be brought to power during a reactor startup. This operating bypass is automatically removed when logarithmic power decreases below 1E-4% NRTP. Above 1E-4% NRTP, the Variable Over Power - High and Pressurizer Pressure - High trips provide protection for reactivity transients.

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%), the automatic Hi-Log power trip bypass removal feature in that channel cannot function.

Similarly, when the indicated Log power channel is failed low (below 1E-4%). the automatic DNBR-LPD trip bypass removal feature in that channel cannot function.

Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4%

NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-19 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 2. Logarithmic Power Level - High (continued)

When a Log channel is INOPERABLE, both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE. Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required. These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

3. Pressurizer Pressure - High This LCO requires four channels of Pressurizer Pressure - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is set below the nominal lift setting of the pressurizer code safety valves, and its operation avoids the undesirable operation of these valves during normal plant operation. In the event of a loss of condenser vacuum at 100% power. this setpoint ensures the reactor trip will take place, thereby limiting further heat input to the RCS and consequent pressure rise. The pressurizer safety valves may lift to prevent overpressurization of the RCS.

4. Pressurizer Pressure - Low This LCO requires four channels of Pressurizer Pressure - Low to be OPERABLE in MODES 1 and 2.

The Allowable Value is set low enough to prevent a reactor trip during normal plant operation and pressurizer pressure transients. However, the setpoint is high enough that with a LOCA, the reactor trip will occur soon enough to allow the ESF systems to perform as expected in the analyses and mitigate the consequences of the accident.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3. 1-20 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 5. Containment Pressure - High (continued)

The LCO requires four channels of Containment Pressure - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is set high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) and is not indicative of an abnormal condition. It is set low enough to initiate a reactor trip when an abnormal condition is indicated.

6, 7. Steam Generator Pressure - Low This LCO requires four channels of Steam Generator #1 Pressure - Low and Steam Generator #2 Pressure - Low to be OPERABLE in MODES 1 and 2.

This Allowable Value is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand. Since excessive steam demand causes the RCS to cool down, resulting in positive reactivity addition to the core. If the moderator temperature coefficient is negative a reactor trip is required to offset that effect.

The trip setpoint may be manually decreased as steam generator pressure is reduced during controlled plant cooldown. provided the margin between steam generator pressure and the setpoint is maintained

200 psia.

This allows for controlled depressurization of the secondary system while still maintaining an active reactor trip setpoint and MSIS setpoint, until the time is reached when the setpoints are no longer needed to protect the plant. The setpoint increases automatically as steam generator pressure increases until the specified trip setpoint is reached.

8, 9. Steam Generator Level - Low This LCO requires four channels of Steam Generator #1 Level - Low and Steam Generator #2 Level - Low for each steam generator to be OPERABLE in MODES 1 and 2. The Allowable Value is sufficiently below the normal operating level for the steam generators so as not to (continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-21 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 8, 9. Steam Generator Level - Low (continued) cause a reactor trip during normal plant operations.

The input signal providing the reactor trip input also provides an input to a bistable that initiates auxiliary feedwater to the affected generator via the Auxiliary Feedwater Actuation Signal (AFAS). The trip setpoint ensures that there will be sufficient water inventory in the steam generator at the time of the trip to provide a margin of at least 10 minutes before auxiliary feedwater is required to prevent degraded core cooling. The reactor trip will remove the heat source (except decay heat), thereby conserving the reactor heat sink.

10, 11. Steam Generator Level - High This LCO requires four channels of Steam Generator #1 Level - High and Steam Generator #2 Level - High to be OPERABLE in MODES 1 and 2.

The Allowable Value is high enough to allow for normal plant operation and transients without causing a reactor trip. It is set low enough to ensure a reactor trip occurs before the level reaches the steam dryers. Having steam generator water level at the trip value is indicative of the plant not being operated in a controlled manner.

12, 13. Reactor Coolant Flow - Low This LCO requires four channels of Reactor Coolant Flow Steam Generator #1-Low and Reactor Coolant Flow Steam Generator # 2-Low to be OPERABLE in MODES 1 and 2. The Allowable Value is set low enough to allow for slight variations in reactor coolant flow during normal plant operations while providing the required protection. Tripping the reactor ensures that the resultant power to flow ratio provides adequate core cooling to maintain DNBR under the expected pressure conditions for this event.

LCO 3.4.5, "RCS Loops - MODE 3," LCO 3.4.6, "RCS Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," ensure adequate RCS flow rate is maintained.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-22 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 14. Local Power Density - High (continued)

This LCO requires four channels of LPD - High to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AD0s and the consequences of accidents are acceptable.

A CPC is not considered inoperable if CEAC inputs to the CPC are inoperable. The Required Actions required in the event of CEAC channel failures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below 1E-4% NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR - Low and LPD - High trips from the RPS Logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are no longer satisfied.

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%), the automatic Hi-Log power trip bypass removal feature in that channel cannot function. Similarly, when the indicated Log power channel is failed low (below 1E-4%), the automatic DNBR-LPD trip bypass removal feature in that channel cannot function. Although one byp ass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4% NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-23 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 14. Local Power Density - High (continued)

When a Log channel is INOPERABLE, both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE. Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required.

These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

This operating bypass is required to perform a plant startup, since both CPC generated trips will be in effect whenever shutdown CEAs are inserted. It also allows system tests at low power with Pressurizer Pressure - Low or RCPs off.

15. Departure from Nucleate Boiling Ratio (DNBR) - Low This LCO requires four channels of DNBR - Low to be OPERABLE.

The LCO on the CPCs ensures that the SLs are maintained during all AD0s and the consequences of accidents are acceptable.

A CPC is not considered inoperable if CEAC inputs to the CPC are inoperable. The Required Actions required in the event of CEAC channel failures ensure the CPCs are capable of performing their safety Function.

The CPC channels may be manually bypassed below 1E-4% NRTP, as sensed by the logarithmic nuclear instrumentation. This bypass is enabled manually in all four CPC channels when plant conditions do not warrant the trip protection. The bypass effectively removes the DNBR - Low and LPD - High trips from the RPS logic circuitry. The operating bypass is automatically removed when enabling bypass conditions are no longer satisfied.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-24 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO 15. Departure from Nucleate Boiling Ratio (DNBR) - Low (continued)

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable. Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%). the automatic Hi-Log power trip bypass removal feature in that channel cannot function.

Similarly, when the indicated Log power channel is failed low (below 1E-4%). the automatic DNBR-LPD trip bypass removal feature in that channel cannot function. Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4% NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE.

When a Log channel is INOPERABLE, both the Hi-Log power and DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE.

requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE.

Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required.

These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

This operating bypass is required to perform a plant startup, since both CPC generated trips will be in effect whenever shutdown CEAs are inserted. It also allows system tests at low power with Pressurizer Pressure - Low or RCPs off.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-25 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES LCO Interlocks/Bypasses (continued)

The LCO on operating bypass permissive removal channels requires that the automatic operating bypass removal feature of all four operating bypass channels be OPERABLE for each RPS Function with an operating bypass in the MODES addressed in the specific LCO for each Function. All four bypass removal channels must be OPERABLE to ensure that none of the four RPS channels are inadvertently bypassed. Refer also to B 3.3.5 for ESFAS operating bypasses.

This LCO applies to the operating bypass removal feature only. If the bypass enable Function is failed so as to prevent entering a bypass condition, operation may continue.

In the case of the Logarithmic Power Level - High trip (Function 2), the absence of a bypass will limit maximum power to below the trip setpoint.

The interlock function Allowable Values are based upon analysis of functional requirements for the bypassed Functions. These are discussed above as part of the LCO discussion for the affected Functions.

APPLICABILITY This LCO is applicable to the RPS Instrumentation in MODES 1 and 2. LCO 3.3.2 is applicable to the RPS Instrumentation in MODES 3, 4, and 5 with any RTCB closed and any CEA capable of withdrawal. The requirements for the CEACs in MODES 1 and 2 are addressed in LCO 3.3.3. The RPS Matrix Logic, Initiation Logic, RTCBs, and Manual Trips in MODES 1, 2. 3, 4, and 5 are addressed in LCO 3.3.4.

Most RPS trips are required to be OPERABLE in MODES 1 and 2 because the reactor is critical in these MODES. The reactor trips are designed to take the reactor subcritical, which maintains the SLs during AOOs and assists the ESFAS in providing acceptable consequences during accidents. Most trips are not required to be OPERABLE in MODES 3, 4. and 5.

In MODES 3, 4, and 5, the emphasis is placed on return to power events. The reactor is protected in these MODES by ensuring adequate SDM. Exceptions to this are:

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-26 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES APPLICABILITY 0 The Logarithmic Power Level - High trip. RPS Logic (continued) RTCBs, and Manual Trip are required in MODES 3. 4.

and 5, with the RTCBs closed, to provide protection for boron dilution and CEA withdrawal events.

0 Steam Generator Pressure-Low trip, is required in MODE 3. with the RTCBs closed to provide protection for steam line break events in MODE 3.

The Logarithmic Power Level - High trip, and the Steam Generator Pressure-Low trip in these lower MODES are addressed in LCO 3.3.2. T Logarithmic Power Level - High trip is bypassed prior to MODE 1 entry and is not required in MODE 1.

ACTIONS The most common causes of channel inoperability are outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific setpoint analysis. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the trip setpoint is less conservative than the Allowable Value in Table 3.3.1-1, the channel is declared inoperable immediately, and the appropriate Condition(s) must be entered immediately.

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is found inoperable, then all affected functions provided by that channel must be declared inoperable, and the unit must enter the Condition for the particular protection Function affected.

When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-27 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS One Note has been added to the ACTIONS. Note 1 has been (continued) added to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered for that Function.

With a channel process measurement circuit that affects multiple functional units inoperable or in test, bypass or trip all associated functional units as listed below:

Process Measurement Circuit Functional Unit (Bypassed or Tripped)

1. Linear Power Variable Overpower (RPS)

(Subchannel or Linear) Local Power Density-High (RPS)

DNBR-Low (RPS)

2. Pressurizer Pressure-High Pressurizer Pressure-High (RPS)

(Narrow Range) Local Power Density-High (RPS)

DNBR-Low (RPS)

3. Steam Generator Pressure-Low Steam Generator Pressure-Low (RPS)

Steam Generator #1 Level-Low (ESF)

Steam Generator #2 Level-Low (ESF)

4. Steam Generator Level-Low Steam Generator Level-Low (RPS)

(Wide Range) Steam Generator #1 Level-Low (ESF)

Steam Generator #2 Level-Low (ESF)

5. Core Protection Calculator Local Power Density-High (RPS)

DNBR-Low (RPS)

A.1 and A.2 Condition A applies to the failure of a single trip channel or associated instrument channel inoperable in any RPS automatic trip Function. RPS coincidence logic is two-out-of-four.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-28 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BAS ES ACTIONS If one RPS channel is inoperable, startup or power (continued) operation is allowed to continue, providing the inoperable channel is placed in bypass or trip in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.1). The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allotted to bypass or trip the channel is sufficient to allow the operator to take all appropriate actions for the failed channel and still ensures that the risk involved in operating with the failed channel is acceptable. The failed channel must be restored to OPERABLE status prior to entering MODE 2 following the next MODE 5 entry. With a channel in bypass, the coincidence logic is now in a two-out-of-three confi gurati on.

The Completion Time of prior to entering MODE 2 following the next MODE 5 entry is based on adequate channel to channel independence, which allows a two-out-of-three channel operation since no single failure will cause or prevent a reactor trip.

B.1 Condition B applies to the failure of two channels in any RPS automatic trip Function.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES, even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

Required Action B.1 provides for placing one inoperable channel in bypass and the other channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed, the RPS is in a two-out-of-three logic; but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in trip.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.1-29 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS B.1 (continued)

This places the RPS in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, the reactor will trip.

One of the two inoperable channels will need to be restored to operable status prior to the next required CHANNEL FUNCTIONAL TEST, because channel surveillance testing on an OPERABLE channel requires that the OPERABLE channel be placed in bypass. However, it is not possible to bypass more than one RPS channel, and placing a second channel in trip will result in a reactor trip. Therefore, if one RPS channel is in trip and a second channel is in bypass, a third inoperable channel would place the unit in LCO 3.0.3.

C.1, C.2.1, and C.2.2 Condition C applies to one automatic bypass removal channel inoperable. If the inoperable operating bypass removal channel for any operating bypass channel cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channel must be declared inoperable, as in Condition A, and the affected automatic trip channel placed in maintenance (trip channel) bypass or trip. The operating bypass removal channel and the automatic trip channel must be repaired prior to entering MODE 2 following the next MODE 5 entry. The Bases for the Required Actions and required Completion Times are consistent with Condition A.

D.1 and D.2 Condition D applies to two inoperable automatic operating bypass removal channels. If the operating bypass removal channels for two operating bypasses cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channels must be declared inoperable, as in Condition B, and the operating bypass either removed or one automatic trip channel placed in maintenance (trip channel) bypass and the other i n trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

(continued)

PALO VERDE UNITS 1.2.3 B 3.3. 1-30 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST, or the plant must shut down per LCO 3.0.3 as explained in Condition B.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

E.1 Condition E applies if any CPC cabinet receives a high temperature alarm. There are redundant temperature sensors in each of the four CPC bays. Since CPC bays B and C also house CEAC calculators 1 and 2, respectively, a high temperature in either of these bays requires entry into LCO 3.3.3, Condition C.

If a CPC cabinet high temperature alarm is received, it is possible for an OPERABLE CPC to be affected and not be completely reliable. Therefore, a CHANNEL FUNCTIONAL TEST must be performed on OPERABLE CPCs within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate considering the low probability of undetected failure, the consequences of a single channel failure, and the time required to perform a CHANNEL FUNCTIONAL TEST.

F.1 Condition F applies if an OPERABLE CPC has three or more autorestarts in a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period.

CPCs and CEACs will attempt to autorestart if they detect a fault condition, such as a calculator malfunction or loss of power. A successful autorestart restores the calculator to operation; however, excessive autorestarts might be indicative of a calculator problem. The autorestart periodic test restart (Code 30), and normal system load (Code 33) are not included in the total.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.1-31 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES ACTIONS F.1 (continued)

If a nonbypassed CPC has three or more autorestarts, it may not be completely reliable. Therefore, a CHANNEL FUNCTIONAL TEST must be performed on the CPC to ensure it is functioning properly. Based on plant operating experience, the Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is adequate and reasonable to perform the test while still keeping the risk of operating in this condition at an acceptable level, since overt channel failure will most likely be indicated and annunciated in the control room by CPC online di agnosti cs.

G.1 Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C. D, E, or F are not met.

If the Required Actions associated with these Conditions cannot be completed within the required Completion Time, the reactor must be brought to a MODE where the Required Actions do not apply. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, for reaching the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR REQUIREMENTS column of Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, and response time testing.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-32 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

In the case of RPS trips with multiple inputs, such as the DNBR and LPD inputs to the CPCs, a CHANNEL CHECK must be performed on all inputs.

SR 3.3.1.2 The RCS flow rate indicated by each CPC is verified, as required by a Note, to be less than or equal to the actual RCS total flow rate, determined by either using the reactor coolant pump differential pressure instrumentation or by calorimetric calculations, every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when THERMAL POWER is Ž 70% RTP. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 70% RTP is for plant stabilization, data taking, and flow verification. This check (and if necessary, the adjustment of the CPC addressable constant flow coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications, as determined by the Core Operating Limits Supervisory System (COLSS).

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-33 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.2 (continued)

REQUIREMENTS The flow measurement uncertainty may be included in the BERRK term in the CPC and is equal to or greater than 4%.

SR 3.3.1.3 The CPC autorestart count is checked every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to monitor the CPC and CEAC for normal operation. If three or more autorestarts of a nonbypassed CPC occur within a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the CPC may not be completely reliable.

Therefore, the Required Action of Condition F must be performed. The auto restart periodic tests restart (Code 30) and normal system load (Code 33) are not included in this total. The Frequency is based on operating experience that demonstrates the rarity of more than one channel failing within the same 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval.

SR 3.3.1.4 A daily calibration (heat balance) is performed when THERMAL POWER is Ž 20%. The Linear Power Level signal and the CPC addressable constant multipliers are adjusted to make the CPC AT power and nuclear power calculations agree with the calorimetric calculation if the absolute difference is Ž 2% when THERMAL POWER is Ž 80% RTP, and

-0.5% to 10% when THERMAL POWER is between 20% and 80%.

The value of 2% when THERMAL POWER is Ž 80% RTP, and -0.5%

to 10% when THERMAL POWER is between 20% and 80% is adequate because this value is assumed in the safety analysis. These checks (and, if necessary, the adjustment of the Linear Power Level signal and the CPC addressable constant coefficients) are adequate to ensure that the accuracy of these CPC calculations is maintained within the analyzed error margins. The power level must be > 20% RTP to obtain accurate data. At lower power levels, the accuracy of calorimetric data is questionable.

The tolerance between 20% and 80% RTP is +10% to reduce the number of adjustments required as the power level increases. The -0.5% tolerance between 20% and 80% RTP is based on the reduced accuracy of the calorimetric data inputs at low power levels. Performing a calorimetric (continued)

PALO VERDE UNITS 1,2.3 B 3.3. 1-34 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS calibration with a -0.5% tolerance at low power levels ensures the difference will remain within -2.0% when power is increased above 80% RTP. If a calorimetric calculation is performed above 80% RTP, it will use accurate inputs to the calorimetric calculation available at higher power levels. When the power level is decreased below 80% RTP an additional performance of the SR to the -0.5% to 10%

tolerance is not required if the SR has been performed above 80% RTP.

The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs. The Frequency is modified by a Note indicating this Surveillance need only be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP.

The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 20% RTP is required for plant stabilization, data taking, and flow verification. The secondary calorimetric is inaccurate at lower power levels.

A second Note in the SR indicates the SR may be suspended during PHYSICS TESTS. The conditional suspension of the daily calibrations under strict administrative control is necessary to allow special testing to occur.

SR 3.3.1.5 The RCS flow rate indicated by each CPC is verified to be less than or equal to the RCS total flow rate every 31 days. The Note indicates the Surveillance is performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is > 70% RTP. This check (and. if necessary, the adjustment of the CPC addressable flow constant coefficients) ensures that the DNBR setpoint is conservatively adjusted with respect to actual flow indications as determined either using the reactor coolant pump differential pressure instrumentation and the ultrasonic flow meter adjusted pump curves or by a calorimetric calculation. Operating experience has shown the specified Frequency is adequate, as instrument drift is minimal and changes in actual flow rate are minimal over core life.

(continued)

PALO VERDE UNITS 1.2.3 B 3.3.1-35 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BAS ES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) The three vertically mounted excore nuclear instrumentation detectors in each channel are used to determine APD for use in the DNBR and LPD calculations. Because the detectors are mounted outside the reactor vessel, a portion of the signal from each detector is from core sections not adjacent to the detector. This is termed shape annealing and is compensated for after every refueling by performing SR 3.3.1.11, which adjusts the gains of the three detector amplifiers for shape annealing. SR 3.3.1.6 ensures that the preassigned gains are still proper. When power is

< 15% the CPCs do not use the excore generated signals for axial flux shape information. The Note allowing 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching 15% RTP is required for plant stabilization and testing. The 31 day Frequency is adequate because the demonstrated long term drift of the instrument channels is minimal.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on each channel is performed every 92 days to ensure the entire channel will perform its intended function when needed. The SR is modified by two Notes. Note 1 is a requirement to verify the correct CPC addressable constant values are installed in the CPCs when the CPC CHANNEL FUNCTIONAL TEST is performed. Note 2 allows the CHANNEL FUNCTIONAL TEST for the Logarithmic Power Level - High channels to be performed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months after logarithmic power drops below 1E-4% NRTP.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in Reference 8. These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs. They include:

(continued)

PALO VERDE UNITS 1,2,3 B 3.3. 1-36 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE Bistable Tests REQUIREMENTS (continued) A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS channel trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis.

The requirements for this review are outlined in Reference 9.

Matrix Logic Tests Matrix Logic tests are addressed in LCO 3.3.4. This test is performed one matrix at a time. It verifies that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state. This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path Tests Trip path (Initiation Logic) tests are addressed in LCO 3.3.4. These tests are similar to the Matrix Logic tests, except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, thereby opening the affected RTCB. The RTCB must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

The CPC and CEAC channels and excore nuclear instrumentation channels are tested separately.

(continued)

PALO VERDE UNITS 1.2,3 B 3.3.1-37 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE Trip Path Tests (continued)

REQUIREMENTS The excore channels use preassigned test signals to verify proper channel alignment. The excore logarithmic channel test signal is inserted into the preamplifier input, so as to test the first active element downstream of the detector.

The power range excore test signal is inserted at the drawer input, since there is no preamplifier.

The quarterly CPC CHANNEL FUNCTIONAL TEST is performed using software. This software includes preassigned addressable constant values that may differ from the current values.

Provisions are made to store the addressable constant values on a computer disk prior to testing and to reload them after testing. A Note is added to the Surveillance Requirements to verify that the CPC CHANNEL FUNCTIONAL TEST includes the correct values of addressable constants.

SR 3.3.1.8 A Note indicates that neutron detectors are excluded from CHANNEL CALIBRATION. A CHANNEL CALIBRATION of the power range neutron flux channels every 92 days ensures that the channels are reading accurately and within tolerance (Ref. 9). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the interval between surveillance interval extension analysis.

The requirements for this review are outlined in Reference 9. Operating experience has shown this Frequency to be satisfactory. The detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a (continued)

PALO VERDE UNITS 1,2,3 B 3.3. 1-38 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 (continued)

REQUIREMENTS meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4) and the monthly linear subchannel gain check (SR 3.3.1.6). In addition, the associated control room indications are monitored by the operators.

SR 3.3.1.9 SR 3.3.1.9 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 9.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis as well as operating experience and consistency with the typical 18 month fuel cycle.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4) and the monthly linear subchannel gain check (SR 3.3.1.6).

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-39 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.10 REQUI REM ENTS (continued) Every 18 months, a CHANNEL FUNCTIONAL TEST is performed on the CPCs. The CHANNEL FUNCTIONAL TEST shall include the injection of a signal as close to the sensors as practicable to verify OPERABILITY including alarm and trip Functions.

The basis for the 18 month Frequency is that the CPCs perform a continuous self monitoring function that eliminates the need for frequent CHANNEL FUNCTIONAL TESTS.

This CHANNEL FUNCTIONAL TEST essentially validates the self monitoring function and checks for a small set of failure modes that are undetectable by the self monitoring function. Operating experience has shown that undetected CPC or CEAC failures do not occur in any given 18 month interval.

SR 3.3.1.11 The three excore detectors used by each CPC channel for axial flux distribution information are far enough from the core to be exposed to flux from all heights in the core, although it is desired that they only read their particular level. The CPCs adjust for this flux overlap by using the predetermined shape annealing matrix elements in the CPC software.

After refueling, it is necessary to re-establish or verify the shape annealing matrix elements for the excore detectors based on more accurate incore detector readings.

This is necessary because refueling could possibly produce a significant change in the shape annealing matrix coeffi ci ents.

Incore detectors are inaccurate at low power levels.

THERMAL POWER should be significant but < 70% to perform an accurate axial shape calculation used to derive the shape annealing matrix e ements.

By restricting power to < 70% until shape annealing matrix elements are verified, excessive local power peaks within the fuel are avoided. Operating experience has shown this Frequency to be acceptable.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-40 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BAS ES SURVEILLANCE SR 3.3.1.12 REQUIREMENTS (continued) SR 3.3.1.12 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.1.7, except SR 3.3.1.12 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify operating bypass removal function OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327.

"RPS/ESFAS Extended Test Interval Evaluation" (Ref. 9).

Once the operating bypasses are removed, the bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST, SR 3.3.1.7.

Therefore, further testing of the operating bypass function after startup is unnecessary.

SR 3.3.1.13 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response times are conducted on an 18 month STAGGERED TEST BASIS. This results in the interval between successive surveillances of a given channel of n x 18 months, where n is the number of channels in the function. The Frequency of 18 months is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. Response time testing may be performed at power on a single channel or during plant outages when the equipment is not required to be operable.

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-41 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES SURVEILLANCE SR 3.3.1.13 (continued)

REQUIREMENTS Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from the records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD-1167-A. "Elimination of Pressure Sensor Response Time Testing Requirements." (Ref. 12) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report.

Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100.

3. NRC Safety Evaluation Report, July 15, 1994.

4. IEEE Standard 279-1971, April 5, 1972.

5. UFSAR, Chapters 6 and 15.

6. 10 CFR 50.49.

7. "Calculation of Trip Setpoint Values, Plant Protection System". CEN-286(v), or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip function.

8. UFSAR, Section 7.2.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3. 1-42 REVISION 15

RPS Instrumentation - Operating B 3.3.1 BASES REFERENCES 9. CEN-327, June 2. 1986. including Supplement 1, (continued) March3, 1989, and Calculation 13-JC-SB-200.

10. CEN-PSD-335-P. "Functional Design Requirements for a Core Protection Calculator."

11. CEN-PSD-336-P, "Functional Design Requirements for a Control Element Assembly Calculator."

12. CEOG Topical Report CE NPSD-1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements."

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.1-43 REVISION 15

This page intentionally blank RPS Instrumentation - Shutdown B 3.3.2 BASES LCO The LCO requires the Logarithmic Power Level - High, the Steam Generator #1 Pressure-Low, and the Steam Generator #2 Pressure-Low, RPS Functions to be OPERABLE. Failure of any required portion of the instrument channel renders the affected channel(s) inoperable and reduces the reliability of the affected Function.

Actions allow maintenance (trip channel) bypass of individual channels, but the bypass activates interlocks that prevent operation with a second channel in the same Function bypassed. With one channel in each Function trip channel bypassed, this effectively places the plant in a two-out-of-three logic configuration in those Functions.

Only the Allowable Values are specified for this RPS trip Function in the LCO. Nominal trip setpoints are specified in the plant specific setpoint calculations. The nominal setpoint is selected to ensure the setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed the Allowable Value if the bistable is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable provided that operation and testing are consistent with the assumptions of the plant specific setpoint calculations.

Each Allowable Value specified is more conservative than the analytical limit assumed in the safety analysis in order to account for instrument uncertainties appropriate to the trip Function.

These uncertainties are defined in the "Plant Protection System Selection of Trip Setpoint Values" (Ref. 4). A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

This LCO requires all four channels of the Logarithmic Power Level - High to be OPERABLE MODES in 3, 4. or 5 when the RTCBs are closed and the CEA Drive System is capable of CEA withdrawal.

A CEA is considered capable of withdrawal when power is applied to the Control Element Drive Mechanisms (CEDMs).

There are several methods used to remove power from the CEDMs. such as de-energizing the CEDM MGs, opening the CEDM MG output breakers, opening the Control Element Assembly Control System (CEDMCS) CEA breakers, opening the RTCBs, or disconnecting the power cables from the CEDMs. Any method (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-5 REVISION 0

RPS Instrumentation - Shutdown B 3.3.2 BASES LCO that removes power from the CEDMs may be used. The CEAs are (continued) still capable of withdrawal if the CEDMCS withdrawal circuits are disabled with power applied to the CEDMs because failures in the CEDMCS could result in CEA withdrawal.

This LCO requires all four channels of Steam Generator #1 Pressure-Low, and Steam Generator #2 Pressure-Low, to be OPERABLE in MODE 3, when the RTCBs are closed and the CEA Drive System is capable of CEA withdrawal. These RPS functions are not required in MODES 4 and 5 because the Steam Generator temperature is low, therefore the energy release and resulting cooldown following a large MSLB in MODES 4 and 5 is not significant.

The Allowable Values are high enough to provide an operating envelope that prevents unnecessary Logarithmic Power Level - High reactor trips during normal plant operations.

The Allowable Values are low enough for the system to maintain a safety margin for unacceptable fuel cladding damage should a CEA withdrawal or MSLB event occur.

The Logarithmic Power Level - High trip may be bypassed when logarithmic power is above 1E-4% NRTP to allow the reactor to be brought to power during a reactor startup. This bypass is automatically removed when logarithmic power decreases below 1E-4% NRTP. Above 1E-4% NRTP, the Variable Over Power - High and Pressurizer Pressure - High trips provide protection for reactivity transients.

The automatic bypass removal channel is INOPERABLE when the associated Log power channel has failed. The bypass function is manually controlled via station operating procedures and the bypass removal circuitry itself is fully capable of responding to a change in the associated input bistable.

Footnotes (a) and (b) in Table 3.3.1-1 and (d) in Table 3.3.2-1 clearly require an "automatic" removal of trip bypasses. A failed Log channel may prevent, depending on the failure mode, the associated input bistable from changing state as power transitions through the automatic bypass removal setpoint. Specifically, when the indicated Log power channel is failed high (above 1E-4%), the automatic Hi-Log power trip bypass removal feature in that channel cannot function. Similarly, when the indicated Log power channel is failed low (below 1E-4%), the automatic DNBR-LPD trip bypass removal feature in that channel cannot function. Although one bypass removal feature is applicable above 1E-4% NRTP and the other is applicable below 1E-4% NRTP, both are affected by a failed Log power channel and should therefore be considered INOPERABLE. (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-6 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES LCO When a Log channel is INOPERABLE, both the Hi-Log power and (continued) DNBR/LPD automatic trip bypass removal features in that channel are also INOPERABLE, requiring entry into LCO 3.3.1 Condition C or LCO 3.3.2 Condition C depending on plant operating MODE. Required Action C.1 for both LCOs 3.3.1 and 3.3.2 require the bypass channel to be disabled. Compliance with C.1 is met by placing the CR switches in "off" and "normal" for the Hi-Log power and DNBR/LPD bypasses respectively. No further action (key removal, periodic verification, etc.) is required. These CR switches are administratively controlled via station procedure therefore, the requirements of C.1 are continuously met.

APPLICABILITY This LCO is applicable to the RPS Instrumentation in MODES 3.

4, and 5 with any RTCB closed and any CEA capable of withdrawal. LCO 3.3.1 is applicable to the RPS Instrumentation in MODES 1 and 2. The requirements for the CEACs in MODES 1 and 2 are addressed in LCO 3.3.3. The RPS Matrix Logic, Initiation Logic, RTCBs, and Manual Trips in MODES 1. 2, 3, 4, and 5 are addressed in LCO 3.3.4.

Most RPS trips are required to be OPERABLE in MODES 1 and 2 because the reactor is critical in these MODES. The trips are designed to take the reactor subcritical, which maintains the SLs during AD0s and assists the Engineered Safety Features Actuation System (ESFAS) in providing acceptable consequences during accidents. Most trips are not required to be OPERABLE in MODES 3, 4, and 5.

In MODES 3. 4. and 5. the emphasis is placed on return to power events. The reactor is protected in these MODES by ensuring adequate SDM. Exceptions to this are:

The Logarithmic Power Level - High trip. RPS Logic RTCBs, and.Manual Trip are required in MODES 3, 4. and 5, with the RTCBs closed, to provide protection for boron dilution and CEA withdrawal events. The Logarithmic Power Level - High trip in these lower MODES is addressed in this LCO. The RPS Logic in MODES 1, 2, 3. 4, and 5 is addressed in LCO 3.3.4. "Reactor Protective System (RPS) Logic and Trip Initiation."

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-7 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES APPLICABILITY (conti nued)

The Steam Generator #1 Pressure-Low, and the Steam Generator #2 Pressure-Low trips, RPS Logic, RTCBs, and Manual Trip are required in MODE 3 with the RTCBs closed, to provide protection for large MSLB events in MODE 3. The Steam Generator Pressure-Low trip in this lower MODE is addressed in this LCO. The RPS Logic in MODES 1,2,3,4, and 5 is addressed in LCO 3.3.4, Reactor Protection System (RPS) Logic and Trip Initiation.

The applicability for the Logarithmic Power Level-High function is modified by a Note that allows the trip to be bypassed when logarithmic power is > 1E-4% NRTP, and the bypass is automatically removed when logarithmic power is

< 1E-4% NRTP.

ACTIONS The most common causes of channel inoperability are outright failure or drift of the bistable or process module sufficient to exceed the tolerance allowed by the plant specific setpoint analysis. Typically, the drift is found to be small and results in a delay of actuation rather than a total loss of function. This determination is generally made during the performance of a CHANNEL FUNCTIONAL TEST when the process instrument is set up for adjustment to bring it to within specification. If the trip setpoint is less conservative than the Allowable Value stated in the LCO, the channel is declared inoperable immediately, and the appropriate Condition(s) must be entered immediately.

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the excore logarithmic power channel or RPS bistable trip unit is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the unit must enter the Condition for the particular protection Function affected.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-8 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BAS ES ACTIONS With a channel process measurement circuit that affects (continued) multiple functional units inoperable or in test, bypass or trip all associated functional units as listed below:

PROCESS MEASUREMENT CIRCUIT FUNCTIONAL UNIT (Bypassed or Tripped)

Steam Generator Pressure-Low Steam Generator Pressure - Low (RPS)

Steam Generator #1 Level - Low (ESF)

Steam Generator #2 Level - Low (ESF)

When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered, if applicable in the current MODE of operation.

A.1, and A.2 Condition A applies to the failure of a single trip channel or associated instrument channel inoperable in any RPS function.

The RPS coincidence logic is two-out-of-four. If one channel is inoperable, operation in MODES 3, 4, and 5 is allowed to continue, providing the inoperable channel is placed in bypass or trip in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (Required Action A.D).

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allotted to bypass or trip the channel is sufficient to allow the operator to take all appropriate actions for the failed channel while ensuring that the risk involved in operating with the failed channel is acceptable.

The failed channel must be restored to OPERABLE status prior to entering MODE 2 following the next MODE 5 entry. With a channel bypassed, the coincidence logic is now in a two-out-of-three configuration. The Completion Time is based on adequate channel to channel independence, which allows a two-out-of-three channel operation since no single failure will cause or prevent a reactor trip.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.2-9 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES ACTIONS B.1 (continued)

Condition B applies to the failure of two trip channels or associated instrument channels, in any RPS automatic trip function. Required Action B.1 provides for placing one inoperable channel in bypass and the other channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels and still ensures the risk involved in operating with the failed channels is acceptable.

With one channel of protective instrumentation bypassed, the RPS is in a two-out-of-three logic; but with another channel failed, the RPS may be operating in a two-out-of-two logic.

This is outside the assumptions made in the analyses and should be corrected. To correct the problem, the second channel is placed in trip. This places the RPS in a one-out-of-two logic. If any of the other OPERABLE channels receives a trip signal, the reactor will trip.

One of the two inoperable channels will need to be restored to OPERABLE status prior to the next required CHANNEL FUNCTIONAL TEST because channel surveillance testing on an OPERABLE channel requires that the OPERABLE channel be placed in bypass. However, it is not possible to bypass more than one RPS channel, and placing a second channel in trip will result in a reactor trip. Therefore, if one RPS channel is in trip and a second channel is in bypass, a third inoperable channel would place the unit in LCO 3.0.3.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

C.1, C.2.1, and C.2.2 Condition C applies to one automatic operating bypass removal channel inoperable. If the operating bypass removal channel for the high logarithmic power level operating bypass cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-10 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES ACTIONS C.1, C.2.1 and C.2.2 (continued) the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channel must be declared inoperable, as in Condition A. and the operating bypass either removed or the affected automatic channel placed in trip or maintenance (trip channel) bypass. Both the operating bypass removal channel and the associated automatic trip channel must be repaired prior to entering MODE 2 following the next MODE 5 entry. The Bases for the Required Actions and required Completion Times are consistent with Condition A.

D.1 and D.2 Condition D applies to two inoperable automatic operating bypass removal channels. If the operating bypass removal channels for two operating bypasses cannot be restored to OPERABLE status within I hour, the associated RPS channel may be considered OPERABLE only if the operating bypass is not in effect. Otherwise, the affected RPS channels must be declared inoperable, as in Condition B, and the operating bypass either removed or one automatic trip channel placed in maintenance (trip channel) bypass and the other in trip within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The restoration of one affected bypassed automatic trip channel must be completed prior to the next CHANNEL FUNCTIONAL TEST or the plant must shut down per LCO 3.0.3, as explained in Condition B. Completion Times are consistent with Condition B.

The Required Action is modified by a Note stating that LCO 3.0.4 is not applicable. The Note was added to allow the changing of MODES even though two channels are inoperable, with one channel bypassed and one tripped. In this configuration, the protection system is in a one-out-of-two logic, which is adequate to ensure that no random failure will prevent protection system operation.

E.1 Condition E is entered when the Required Actions and associated Completion Times of Condition A. B, C. or D are not met.

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.2-11 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES ACTIONS E.1 (continued)

If Required Actions associated with these Conditions cannot be completed within the required Completion Time, all RTCBs must be opened, placing the plant in a condition where the RPS trip channels are not required to be OPERABLE. A Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is a reasonable time to perform the Required Action, which maintains the risk at an acceptable level while having one or two channels inoperable.

SURVEILLANCE The SR's for any particular RPS function are found in the SR REQUIREMENTS column of Table 3.3.2-1 for that function. The SRs are an extension of those listed in LCO 3.3.1, listed here because of their Applicability in these MODES.

SR 3.3.2.1 SR 3.3.2.1 is the performance of a CHANNEL CHECK of each RPS channel. This SR is identical to SR 3.3.1.1. Only the Applicability differs.

Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on another channel. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limits.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-12 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.1 (continued)

REQUIREMENTS The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure.

Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent. checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.2.2 A CHANNEL FUNCTIONAL TEST on each channel, except power range neutron flux, is performed every 92 days to ensure the entire channel will perform its intended function when needed. This SR is identical to SR 3.3.1.7. Only the Applicability differs.

The RPS CHANNEL FUNCTIONAL TEST consists of three overlapping tests as described in the UFSAR, Section 7.2 (Ref. 3). These tests verify that the RPS is capable of performing its intended function, from bistable input through the RTCBs.

They include:

Bistable Tests A test signal is superimposed on the input in one channel at a time to verify that the bistable trips within the specified tolerance around the setpoint. This is done with the affected RPS channel trip channel bypassed. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 6.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-13 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE Matrix Logic Tests REQUIREMENTS (continued) Matrix Logic Tests are addressed in LCO 3.3.4. This test is performed one matrix at a time. It verifies that a coincidence in the two input channels for each Function removes power from the matrix relays. During testing, power is applied to the matrix relay test coils and prevents the matrix relay contacts from assuming their de-energized state.

This test will detect any short circuits around the bistable contacts in the coincidence logic, such as may be caused by faulty bistable relay or trip channel bypass contacts.

Trip Path Test Trip path (Initiation Logic) tests are addressed in LCO 3.3.4. These tests are similar to the Matrix Logic tests except that test power is withheld from one matrix relay at a time, allowing the initiation circuit to de-energize, opening the affected set of RTCBs. The RTCBs must then be closed prior to testing the other three initiation circuits, or a reactor trip may result.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 6). The excore channels use preassigned test signals to verify proper channel alignment.

The excore logarithmic channel test signal is inserted into the preamplifier input, so as to test the first active element downstream of the detector.

SR 3.3.2.3 SR 3.3.2.3 is a CHANNEL FUNCTIONAL TEST similar to SR 3.3.2.2, except SR 3.3.2.3 is applicable only to operating bypass functions and is performed once within 92 days prior to each startup. This SR is identical to SR 3.3.1.12. Only the Applicability differs.

Proper operation of operating bypass permissives is critical during plant startup because the operating bypasses must be in place to allow startup operation and must be automatically removed at the appropriate points during power ascent to enable certain reactor trips. Consequently, the appropriate time to verify operating bypass removal function (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-14 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.3 (continued)

REQUIREMENTS OPERABILITY is just prior to startup. The allowance to conduct this Surveillance within 92 days of startup is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 6). Once the operating bypasses are removed, the operating bypasses must not fail in such a way that the associated trip Function gets inadvertently bypassed. This feature is verified by the trip Function CHANNEL FUNCTIONAL TEST. SR 3.3.2.2. Therefore, further testing of the operating bypass function after startup is unnecessary.

SR 3.3.2.4 SR 3.3.2.4 is the performance of a CHANNEL CALIBRATION every 18 months. This SR is identical to SR 3.3.1.9. Only the Applicability differs.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (the sensor is excluded for the Logarithmic Power Level Function). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the plant specific setpoint analysis.

The as found and as left values must also be recorded and reviewed for consistency with the assumptions of the surveillance interval extension analysis. The requirements for this review are outlined in Reference 6.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift in the setpoint analysis and includes operating experience and consistency with the typical 18 month fuel cycle.

The Surveillance is modified by a Note to indicate that the neutron detectors are excluded from CHANNEL CALIBRATION because they are passive devices with minimal drift and (continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-15 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES SURVEILLANCE SR 3.3.2.4 (continued)

REQUIREMENTS because of the difficulty of simulating a meaningful signal.

Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

SR 3.3.2.5 This SR ensures that the RPS RESPONSE TIMES are verified to be less than or equal to the maximum values assumed in the safety analysis. Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor to the point at which the RTCBs open. Response times are conducted on an 18 month STAGGERED TEST BASIS. This results in the interval between successive tests of a given channel of n x 18 months, where n is the number of channels in the Function. The 18 month Frequency is based upon operating experience, which has shown that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences. Response time testing may be performed at power on a single channel or during plant outages when the equipment is not required to be operable.

Testing may be performed in one measurement or in overlapping segments, with verification that all components are tested.

Response time may be verified by any series of sequential, overlapping or total channel measurements, including allocated sensor response time, such that the response time is verified. Allocations for sensor response times may be obtained from records of test results, vendor test data, or vendor engineering specifications. Topical Report CE NPSD 1167-A, "Elimination of Pressure Sensor Response Time Testing Requirements." (Ref. 7) provides the basis and methodology for using allocated sensor response times in the overall verification of the channel response time for specific sensors identified in the Topical Report. Response time verification for other sensor types must be demonstrated by test. The allocation of sensor response times must be verified prior to placing a new component in operation and reverified after maintenance that may adversely affect the sensor response time.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.2-16 REVISION 15

RPS Instrumentation - Shutdown B 3.3.2 BASES A Note is added to indicate that the neutron detectors are excluded from RPS RESPONSE TIME testing because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.4).

REFERENCES 1. 10 CFR 50.

2. 10 CFR 100.

3. UFSAR. Section 7.2.

4. "Calculation of Trip Setpoint Values Plant Protection System, CEN-286(v)", or Calculation 13-JC-SG-203 for the Low Steam Generator Pressure Trip Function.

5. NRC Safety Evaluation Report, July 15, 1994.

6. CEN-327, June 2, 1986, including Supplement 1.

March 3, 1989, and Calculation 13-JC-SB-200.

7. CEOG Topical Report CE NPSD-1167-A. "Elimination of Pressure Sensor Response Time Testing Requirements."

PALO VERDE UNITS 1,2,3 B 3.3.2-17 REVISION 15

This page intentionally blank Boron Dilution Alarm System (BDAS)

B 3.3.12 B 3.3 INSTRUMENTATION B 3.3.12 Boron Dilution Alarm System (BDAS)

BASES BACKGROUND The Boron Dilution Alarm System (BDAS) alerts the operator of a boron dilution event in MODES 3, 4. 5 and 6. The I boron dilution alarm is received at least 15 minutes prior to criticality in Modes 3-5 and at least 30 minutes prior to criticality in Mode 6 to allow the operator to terminate the boron dilution.

In MODES 1 and 2 protection for a boron dilution event is addressed by LCO 3.3.1. "Reactor Protective System (RPS)

Instrumentation-Operating." In MODES 3 and 4 with the CEAs withdrawn, LCO 3.3.2, "Reactor Protective System (RPS)

Instrumentation-Shutdown," provides protection.

The BDAS utilizes two channels that monitor the startup channel neutron flux indications. If the neutron flux signals increase to the calculated alarm setpoint a control room annunciation is received. The setpoint is automatically lowered to a fixed amount above the current flux level signal. The alarm setpoint will only follow decreasing or constant flux levels, not increasing levels.

Two channels of BDAS must be OPERABLE to provide single failure protection and to facilitate detection of channel failure by providing CHANNEL CHECK capability.

APPLICABLE The BDAS channels are necessary to monitor core reactivity SAFETY ANALYSES changes. They are the primary means for detecting and triggering operator actions to respond to boron dilution events initiated from conditions in which the RPS is not required to be OPERABLE.

The OPERABILITY of BDAS channels is necessary to meet the assumptions of the safety analyses to mitigate the consequences of an inadvertent boron dilution event as described in the UFSAR. Chapter 15 (Ref. 1).

The BDAS channels satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2.3 B 3.3.12-1 REVISION 15

Boron Dilution Alarm System (BDAS)

B 3.3.12 BASES (continued)

LCO The LCO on the BDAS channels ensures that adequate information is available to mitigate the consequences of a boron dilution event.

A minimum of two BDAS channels are required to be OPERABLE.

Because the BDAS utilizes the excore startup channel instrumentation as its detection system the OPERABILITY of the excore startup channel is also part of the OPERABILITY of the BDAS.

APPLICABILITY The BDAS must be OPERABLE in MODES 3, 4, 5 and 6 because the safety analysis assumes this alarm will be available in these MODES to alert the operator to take action to terminate the boron dilution. In MODES 1 and 2, and in MODES 3. 4, and 5, with the RTCBs shut and the CEAs capable of withdrawal, the logarithmic power monitoring channels are addressed as part of the RPS in LCO 3.3.1, "Reactor Protective System (RPS) Instrumentation - Operating" and LCO 3.3.2. "Reactor Protective System (RPS) Instrumentation Shutdown".

The requirements for source range neutron flux monitoring in MODE 6 are addressed in LCO 3.9.2, "Nuclear Instrumentation." The excore startup channels provide neutron flux coverage extending an additional one to two decades below the logarithmic channels for use during shutdown and refueling, when neutron flux may be extremely low.

The Applicability is modified by a Note that the BDAS is required in MODE 3 within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the neutron flux is within the startup range following a reactor shutdown. This allows the neutron flux level to decay to a level within the range of the excore startup channels and for the operator to initialize the BDAS. Neutron flux is defined to be within the startup range following a reactor shutdown when reactor power is 2E-6% NRTP or less.

(continued)

PALO VERDE UNITS 1,2,3 B 3.3.12-2 REVISION 15

ECCS - Shutdown B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 ECCS - Shutdown BASES BACKGROUND The Background section for Bases B 3.5.3, "ECCS Operating,"

is applicable to these Bases, with the following modifications.

In MODE 3 with pressurizer pressure < 1837 psia and RCS T, < 485 0 F. and in MODE 4. an ECCS train is defined as one High Pressure Safety Injection (HPSI) subsystem. The HPSI flow path consists of piping, valves, and pumps that enable water from the Refueling Water Tank (RWT) on a SIAS signal to be injected into the Reactor Coolant System (RCS) and automatically transferring HPSI suction to the containment sump on a Recirculation Actuation Signal (RAS) following the accidents described in Bases 3.5.3.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.3 is SAFETY ANALYSES applicable to these Bases.

Due to the stable conditions associated with operation in MODE 3 with pressurizer pressure <1837 psia and with RCS T,

< 485°F and in MODE 4. and the reduced probability of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the complete severance of the largest line connected to the RCS, i.e., a Safety Injection inlet line. I Only one train of ECCS is required for MODE 4. Protection against single failures is not relied on for thi s MODE of operation.

ECCS - Shutdown satisfies Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.4-1 REVISION 15

ECCS - Shutdown B 3.5.4 BASES LCO In MODE 3 with pressurizer pressure < 1837 psia and with RCS T, < 485 0 F and in MODE 4 an ECCS subsystem is composed of a single HPSI subsystem. Each HPSI subsystem includes the piping, instruments, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the RWT and transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to supply water from the RWT to the RCS via the HPSI pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term post (RAS), this flow path is manually switched 2 to 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months after a LOCA to supply part of its HPSI flow to the RCS hot legs via the HPSI hot leg injection valves which connect to the Shutdown Cooling (SDC) suction nozzles.

With RCS pressure < 1837 psia and with RCS T, < 485°F, one HPSI pump is acceptable without single failure consideration, based on the stable reactivity condition of the reactor and the limited core cooling requirements. The Low Pressure Safety Injection (LPSI) pumps may therefore be released from the ECCS train for use in SDC.

APPLICABILITY In MODES 1, 2, and 3 with RCS pressure Ž 1837 psia or with RCS T_ > 485 0 F, the OPERABILITY requirements for ECCS are covered by LCO 3.5.3.

In MODE 3 with RCS pressure < 1837 psia and with RCS Tc

< 485'F and in MODE 4. one OPERABLE ECCS train is acceptable without single failure consideration, based on the stable reactivity condition of the reactor and the limited core cooling requirements.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7. "RCS Loops - MODE 5, Loops Filled,"

and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Shutdown Cooling (SDC) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Shutdown Cooling (SDC) and Coolant Circulation - Low Water Level."

(continued)

PALO VERDE UNITS 1,2,3 B 3.5.4-2 REVISION 0

Nuclear Instrumentation B 3.9.2 B 3.9 REFUELING OPERATIONS B 3.9.2 Nuclear Instrumentation BASES BACKGROUND The Startup Channel Neutron Flux Monitors or Startup Range Monitors (SRMs) are used during core alterations or movement of irradiated fuel assemblies in containment to I

monitor the core reactivity condition. The installed SRMs are part of the Excore Nuclear Instrumentation System.

These detectors are located external to the reactor vessel and detect neutrons leaking from the core. The use of portable detectors is permitted, provided the LCO requirements are met.

The installed SRMs are BF3 detectors operating in the proportional region of the gas filled detector characteristic curve. The detectors monitor the neutron flux in counts per second. The instrument range covers five decades of neutron flux (IE+5 cps) with a 5% instrument accuracy. The detectors also-provide continuous visual indication in the control room and an audible indication in the control room and containment. An audible BDAS alarm alerts operators to a possible dilution accident. The excore startup channels are designed in accordance with the criteria presented in Reference 1.

APPLICABLE Two OPERABLE SRMs and the associated BDAS are required to SAFETY ANALYSES provide a signal to alert the operator to unexpected changes in core reactivity from a boron dilution accident. The safety analysis of the uncontrolled boron dilution accident is described in Reference 2. The analysis of the uncontrolled boron dilution accident shows that normally available reactor subcriticality would be reduced, but there is sufficient time for the operator to take corrective actions.

The SRMs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO This LCO requires two SRMs OPERABLE to ensure that redundant monitoring capability is available to detect changes in core reactivity.

(continued)

PALO VERDE UNITS 1.2.3 B 3.9.2-1 REVISION 15

Nuclear Instrumentation B 3.9.2 BASES LCO (continued) The SRMs include detectors, preamps, amplifiers, power supplies, indicators, recorders, speakers, alarms, switches and other components necessary to complete the SRM functions. Specifically, each SRM must provide continuous visual indication in the Control Room and each SRM must have the capability to provide audible indication in both the Control Room and Containment via use of the Control Room switch.

APPLICABILITY In MODE 6. the SRMs must be OPERABLE to determine changes in core reactivity. There is no other direct means available to check core reactivity levels.

The requirements for the associated Boron Dilution Alarm System (BDAS) operability in MODE 6 are contained in LCO 3.3.12, "Boron Dilution Alarm System." LCO 3.3.12 also covers SRM and BDAS operability requirements for MODES 3, 4 and 5.

ACTIONS A.1 and A.2 With only one SRM OPERABLE. redundancy has been lost. Since these instruments are the only direct means of monitoring core reactivity conditions, CORE ALTERATIONS and positive reactivity additions must be suspended immediately.

Performance of Required Action A.1 shall not preclude completion of movement of a component to a safe position.

With one required SRM channel inoperable, the associated BDAS is also inoperable. Action A.1 of LCO 3.3.12 requires the RCS boron concentration to be determined immediately and at the applicable monitoring frequency specified in the COLR Section 3.3.12 in order to satisfy the requirements of the inadvertent deboration safety analysis. The monitoring frequency specified in the COLR ensures that a decrease in the boron concentration during a boron dilution event will be detected with sufficient time for termination of the event before the reactor achieves criticality. The boron concentration measurement and the OPERABLE BDAS channel provide alternate methods of detection of boron dilution.

(continued)

PALO VERDE UNITS 1,2.3 B 3.9.2-2 REVISION 15

Nuclear Instrumentation B 3.9.2 BASES ACTIONS B.1 (continued)

With no SRM OPERABLE, action to restore a monitor to OPERABLE status shall be initiated immediately. Once initiated, action shall be continued until an SRM is restored to OPERABLE status.

With no SRM OPERABLE, there is no direct means of detecting changes in core reactivity. However, since CORE ALTERATIONS and positive reactivity additions are not to be made, the core reactivity condition is stabilized until the SRMs are OPERABLE. This stabilized condition is verified by performing Action B.1 of LCO 3.3.12 which requires RCS boron concentration to be determined by redundant methods immediately and at the monitoring frequency specified in the COLR Section 3.3.12. This action satisfies the requirements of the inadvertent deboration safety analysis.

RCS boron concentration sampling by redundant methods ensures a boron dilution will be detected with sufficient time to terminate the event before the reactor achieves criticality.

SURVEILLANCE SR 3.9.2.1 REQUIREMENTS SR 3.9.2.1 is the performance of a CHANNEL CHECK, which is a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that the two indication channels should be consistent with core conditions. Changes in fuel loading and core geometry can result in significant differences between source range channels, but each channel should be consistent with its local conditions.

The Frequency is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, a CHANNEL CHECK minimizes the chance of loss of function due to failure of redundant channels.

(continued)

PALO VERDE UNITS 1,2.3 B 3.9.2-3 REVISION 15

Nuclear Instrumentation B 3.9.2 BAS ES SURVEILLANCE SR 3.9.2.2 REQUIREMENTS (continued) SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION every 18 months. This SR is modified by a Note stating that neutron detectors are excluded from the CHANNEL CALIBRATION.

The detectors are of simple construction, and any failures in the detectors will be apparent as change in channel output. The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational.

This SR is an extension of SR 3.3.12 for the Boron Dilution Alarm System CHANNEL CALIBRATION listed here because of its Applicability in these MODES. The 18 month Frequency is based on operating experience which has shown these components usually pass the Surveillance when performed on the 18 month Frequency. The CHANNEL CALIBRATION is normally performed during a plant outage, but can be performed with the reactor at power if detector curve determination is not performed.

Detector curve determination can only be performed under conditions that apply during a plant outage since the flux level needs to be at shutdown levels for detector energi zati on.

REFERENCES 1. 10 CFR 50, Appendix A. GDC 13, GDC 26, GDC 28, and GDC 29.

2. UFSAR, Section 15.4.6.

PALO VERDE UNITS 1,2,3 B 3.9.2-4 REVISION 15

ML021070372

Contents

Text

Dear Sirs:

Subject:

Enclosure:

Navigation menu

ML021070372

Text

Dear Sirs:

Subject:

Enclosure:

Navigation menu

Search